[turbofan] Fix over-restictive assertion in code generator.

test/mjsunit/regress/regress-crbug-489293.js

Index: test/mjsunit/regress/regress-crbug-489293.js
diff --git a/test/mjsunit/compiler/regress-468727.js b/test/mjsunit/regress/regress-crbug-489293.js
similarity index 51%
copy from test/mjsunit/compiler/regress-468727.js
copy to test/mjsunit/regress/regress-crbug-489293.js
index a69efe5a56552831afe052aa24d1225a87306ab5..38d58e72386951958e7e677e66be0446a427153f 100644
--- a/test/mjsunit/compiler/regress-468727.js
+++ b/test/mjsunit/regress/regress-crbug-489293.js
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax --turbo-filter=f --turbo-deoptimization
 // Flags: --noanalyze-environment-liveness
 
 function f() {
-  var __v_7 = -126 - __v_3;
-  var __v_17 = ((__v_15 & __v_14) != 4) | 16;
-  if (__v_17) {
-    var __v_11 = 1 << __v_7;
+  var x = 0;
+  for (var y = 0; y < 0; ++y) {
+    x = (x + y) | 0;
   }
-  __v_12 >>= __v_3;
+  return unbound;
 }
-
-assertThrows(f);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f, ReferenceError);