[turbofan] Make FindFrameStateBefore handle dead paths.

This makes sure {NodeProperties::FindFrameStateBefore} can deal with
effect chains that are marked as dead. This can happen when reducers
looking for frame states run together with other reducers killing some
execution paths within the same reduction phase.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-617567
BUG=chromium:617567,chromium:617224

Review-Url: https://codereview.chromium.org/2041833002
Cr-Commit-Position: refs/heads/master@{#36743}

src/compiler/node-properties.cc

@@ -239,6 +239,7 @@ void NodeProperties::ChangeOp(Node* node, const Operator* new_op) {
 Node* NodeProperties::FindFrameStateBefore(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   while (effect->opcode() != IrOpcode::kCheckpoint) {
+    if (effect->opcode() == IrOpcode::kDead) return effect;
     DCHECK_EQ(1, effect->op()->EffectInputCount());
     effect = NodeProperties::GetEffectInput(effect);
   }

test/mjsunit/regress/regress-crbug-617567.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-filter=* --allow-natives-syntax
+
+var v1 = {};
+function g() {
+  v1 = [];
+  for (var i = 0; i < 1; i++) {
+    v1[i]();
+  }
+}
+
+var v2 = {};
+var v3 = {};
+function f() {
+  v3 = v2;
+  g();
+}
+
+assertThrows(g);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f);