[turbofan] Add missing LoopExit for HoleCheckAndThrow

BuildHoleCheckAndThrow in the bytecode graph builder did not
insert a loop exit; this defeated loop peeling, so we missed
out on performance. This CL inserts the LoopExit in that place,
and inserts two TODOs at places where additional loop exits might
be needed.

Bug: v8:7099
Change-Id: I08c08103cf125d505e37d3aa29a79aaff63a2d61
Reviewed-on: https://chromium-review.googlesource.com/960123Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51903}

src/compiler/bytecode-graph-builder.cc

@@ -1899,6 +1899,7 @@ void BytecodeGraphBuilder::VisitCallRuntime() {
 
   // Connect to the end if {function_id} is non-returning.
   if (Runtime::IsNonReturning(function_id)) {
+    // TODO(7099): Investigate if we need LoopExit node here.
     Node* control = NewNode(common()->Throw());
     MergeControlToLeaveFunction(control);
   }
@@ -2053,6 +2054,8 @@ void BytecodeGraphBuilder::BuildHoleCheckAndThrow(
     SubEnvironment sub_environment(this);
 
     NewIfTrue();
+    BuildLoopExitsForFunctionExit(bytecode_analysis()->GetInLivenessFor(
+        bytecode_iterator().current_offset()));
     Node* node;
     const Operator* op = javascript()->CallRuntime(runtime_id);
     if (runtime_id == Runtime::kThrowReferenceError) {
@@ -2859,6 +2862,7 @@ void BytecodeGraphBuilder::BuildSwitchOnGeneratorState(
     // the default to represent one of the cases above/fallthrough below?
     NewIfDefault();
     NewNode(simplified()->RuntimeAbort(AbortReason::kInvalidJumpTableIndex));
+    // TODO(7099): Investigate if we need LoopExit here.
     Node* control = NewNode(common()->Throw());
     MergeControlToLeaveFunction(control);
   }