[turbofan] Fix indirect escapes in escape analysis.

test/mjsunit/compiler/regress-escape-analysis-indirect.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --turbo --turbo-escape
 
-function f() {
-  try {
-    throw "boom";
-  } catch(e) {
-    %_DeoptimizeNow();
-  }
+function f(apply) {
+  var value = 23;
+  apply(function bogeyman() { value = 42 });
+  return value;
 }
-
-f();
-f();
+function apply(fun) { fun() }
+assertEquals(42, f(apply));
+assertEquals(42, f(apply));
+%NeverOptimizeFunction(apply);
 %OptimizeFunctionOnNextCall(f);
-f();
+assertEquals(42, f(apply));