[turbofan] Make FindFrameStateBefore handle dead paths.

test/mjsunit/regress/regress-crbug-617567.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --turbo-filter=* --allow-natives-syntax
 
-function h(a) {
-  if (!a) return false;
-  print();
+var v1 = {};
+function g() {
+  v1 = [];
+  for (var i = 0; i < 1; i++) {
+    v1[i]();
+  }
 }
 
-function g(a) { return a.length; }
-g('0');
-g('1');
-
+var v2 = {};
+var v3 = {};
 function f() {
-  h(g([]));
+  v3 = v2;
+  g();
 }
 
-f();
+assertThrows(g);
 %OptimizeFunctionOnNextCall(f);
-f();
+assertThrows(f);