JIT: `StaysWithinManagedObject` should be able to handle more cloned loops patterns

[jakobbotsch]

For example

public bool Contains(char c, char[] s, int n)
{
    for (int i = 0; i < n; i++)
    {
        if (s[i] == c)
            return true;
    }

    return false;
}

produces

G_M59418_IG03:  ;; offset=0x000B
       test     r8, r8
       je       SHORT G_M59418_IG08
       cmp      dword ptr [r8+0x08], r9d
       jl       SHORT G_M59418_IG08
       movzx    r10, dx
       mov      eax, 16
       align    [1 bytes for IG04]
						;; size=21 bbWeight=0.90 PerfScore 5.40
G_M59418_IG04:  ;; offset=0x0020
       movzx    rcx, word  ptr [r8+rax]
       cmp      ecx, r10d
       je       SHORT G_M59418_IG10
						;; size=10 bbWeight=4.69 PerfScore 15.24
G_M59418_IG05:  ;; offset=0x002A
       add      rax, 2
       dec      r9d
       jne      SHORT G_M59418_IG04
						;; size=9 bbWeight=5.21 PerfScore 7.82

for the hot cloned loop. We should be able to prove that the byref stays within the array here in the hot loop of the cloned case.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.