[turbofan] Make FindFrameStateBefore handle dead paths.

test/mjsunit/regress/regress-crbug-617567.js

Index: test/mjsunit/regress/regress-crbug-617567.js
diff --git a/test/mjsunit/regress/regress-599412.js b/test/mjsunit/regress/regress-crbug-617567.js
similarity index 50%
copy from test/mjsunit/regress/regress-599412.js
copy to test/mjsunit/regress/regress-crbug-617567.js
index d5c411d0f11a1b81139c4eaefdecfb169c3b007b..f0c696e14b205c8094bb04f909b43a2677bf4c26 100644
--- a/test/mjsunit/regress/regress-599412.js
+++ b/test/mjsunit/regress/regress-crbug-617567.js
@@ -2,21 +2,23 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --turbo-filter=* --allow-natives-syntax
 
-function h(a) {
-  if (!a) return false;
-  print();
+var v1 = {};
+function g() {
+  v1 = [];
+  for (var i = 0; i < 1; i++) {
+    v1[i]();
+  }
 }
 
-function g(a) { return a.length; }
-g('0');
-g('1');
-
+var v2 = {};
+var v3 = {};
 function f() {
-  h(g([]));
+  v3 = v2;
+  g();
 }
 
-f();
+assertThrows(g);
 %OptimizeFunctionOnNextCall(f);
-f();
+assertThrows(f);