[turbofan] Allow ReplaceWithValue to kill control.

test/cctest/compiler/test-changes-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <limits>
 
 #include "src/compiler/change-lowering.h"
 #include "src/compiler/control-builders.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties.h"
@@ skipping 112 matching lines @@
     this->graph()->SetEnd(end);
     LowerChange(change);
   }
 
   void LowerChange(Node* change) {
     // Run the graph reducer with changes lowering on a single node.
     Typer typer(this->isolate(), this->graph(), Handle<Context>());
     typer.Run();
     ChangeLowering change_lowering(&jsgraph);
     SelectLowering select_lowering(this->graph(), this->common());
-    GraphReducer reducer(this->graph(), this->zone());
+    GraphReducer reducer(this->zone(), this->graph());
     reducer.AddReducer(&change_lowering);
     reducer.AddReducer(&select_lowering);
     reducer.ReduceNode(change);
     Verifier::Run(this->graph(), Verifier::UNTYPED);
   }
 
   Factory* factory() { return this->isolate()->factory(); }
   Heap* heap() { return this->isolate()->heap(); }
 };
 
@@ skipping 243 matching lines @@
 
         input = *i;
         Object* result = t.CallWithPotentialGC<Object>();
         t.CheckNumber(input, result);
       }
     }
   }
 }
 
 #endif  // V8_TURBOFAN_BACKEND