Add exception prediction for ArrayForEachLoopLazyDeoptContinuation

BUG=v8:6526

Review-Url: https://codereview.chromium.org/2958973003
Cr-Commit-Position: refs/heads/master@{#46276}

src/builtins/builtins-definitions.h

@@ -1108,6 +1108,7 @@ namespace internal {
 // The exception thrown in the following builtins are not caught
 // internally and should trigger the catch prediction heuristic.
 #define BUILTIN_EXCEPTION_UNCAUGHT_PREDICTION_LIST(V) \
+  V(ArrayForEachLoopLazyDeoptContinuation)            \
   V(MapConstructor)                                   \
   V(SetConstructor)                                   \
   V(GeneratorPrototypeNext)                           \

test/debugger/regress/regress-6526.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-inspector --allow-natives-syntax
+
+const Debug = debug.Debug;
+Debug.setListener(() => {});
+
+var a = [0,1,2,3,4,5,6,7,8,9];
+
+var f = function() {
+  a.forEach(function(v) {
+    try {
+      throw new Error();
+    } catch (e) {
+    }
+  });
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+f();