[turbofan] escape analysis: revisit of uses afer FinishRegion marked as escaped

test/mjsunit/compiler/escape-analysis-15.js

Index: test/mjsunit/compiler/escape-analysis-15.js
diff --git a/test/mjsunit/compiler/escape-analysis-15.js b/test/mjsunit/compiler/escape-analysis-15.js
new file mode 100644
index 0000000000000000000000000000000000000000..4ebd0f788798b2754f79cc3a6fd9e39aea09e8df
--- /dev/null
+++ b/test/mjsunit/compiler/escape-analysis-15.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo --turbo-escape --turbo-experimental --no-turbo-load-elimination
+
+function f(i) {
+  var o1 = {a: 1, b: 2};
+  var o2 = {a: 1, b: 3};
+  var o3 = {a: o2.b};
+  o3.a = "";
+  o2.a = o1;
+  if (i == 4) return o3;
+}
+for (var i = 0; i < 100; ++i){
+  f(i%5)
+}
+%OptimizeFunctionOnNextCall(f);
+f(false);