[turbofan] Fix more places where IfSuccess lacks on a non-NoThrow node.

These places were found by the trybots.

- regress-crbug-485410

BUG=

Review-Url: https://codereview.chromium.org/2230923002
Cr-Commit-Position: refs/heads/master@{#38572}

src/compiler/js-typed-lowering.cc

@@ -1123,6 +1123,7 @@ Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) {
             value = effect =
                 graph()->NewNode(javascript()->ToNumber(), value, context,
                                  frame_state_for_to_number, effect, control);
+            control = graph()->NewNode(common()->IfSuccess(), value);
           }
         }
         // Check if we can avoid the bounds check.

test/unittests/compiler/js-typed-lowering-unittest.cc

@@ -889,6 +889,7 @@ TEST_F(JSTypedLoweringTest, JSStorePropertyToExternalTypedArrayWithConversion) {
       Matcher<Node*> value_matcher =
           IsToNumber(value, context, checkpoint, control);
       Matcher<Node*> effect_matcher = value_matcher;
+      Matcher<Node*> control_matcher = IsIfSuccess(value_matcher);
 
       ASSERT_TRUE(r.Changed());
       EXPECT_THAT(
@@ -897,7 +898,7 @@ TEST_F(JSTypedLoweringTest, JSStorePropertyToExternalTypedArrayWithConversion) {
                         IsIntPtrConstant(bit_cast<intptr_t>(&backing_store[0])),
                         offset_matcher,
                         IsNumberConstant(array->byte_length()->Number()),
-                        value_matcher, effect_matcher, control));
+                        value_matcher, effect_matcher, control_matcher));
     }
   }
 }