[turbofan] Weakening of types must handle ranges inside unions.

test/mjsunit/regress/regress-weakening-multiplication.js

Index: test/mjsunit/regress/regress-weakening-multiplication.js
diff --git a/test/mjsunit/regress/regress-store-global-proxy.js b/test/mjsunit/regress/regress-weakening-multiplication.js
similarity index 67%
copy from test/mjsunit/regress/regress-store-global-proxy.js
copy to test/mjsunit/regress/regress-weakening-multiplication.js
index c85531c5fd917daa67b54e87141a164b90f3729b..dcf00114b7e46dfebb505eaeff57c484663c6fcb 100644
--- a/test/mjsunit/regress/regress-store-global-proxy.js
+++ b/test/mjsunit/regress/regress-weakening-multiplication.js
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-delete Object.prototype.__proto__;
-
 function f() {
-  this.toString = 1;
+  for (var j = 1; j < 1; j *= -8) {
+  }
+  for (var i = 1; i < 1; j += 2) {
+    j * -1;
+  }
 }
-
-f.apply({});
 f();