The i1 from a type.test may be merged with another type.test into a phi which
gets fed to an assume. Previously we wouldn't delete the type.test in some
cases, causing an assume(false).
Try harder to find corresponding assumes by looking through phis. This still
isn't ideal because there may be other sorts of valid transformations that can
obfuscate the use-def chain between a type test and an assume, but it at least
resolves a miscompile in Chrome when turning on opaque pointers.
This may also end up deleting an assume of a phi where one side is a type test
and another side is something unrelated, meaning we lose non-WPD-related