[turbofan] Allow ReplaceWithValue to kill control.

test/unittests/compiler/js-intrinsic-lowering-unittest.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/diamond.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-intrinsic-lowering.h"
 #include "src/compiler/js-operator.h"
 #include "test/unittests/compiler/graph-unittest.h"
@@ skipping 16 matching lines @@
  public:
   JSIntrinsicLoweringTest() : GraphTest(3), javascript_(zone()) {}
   ~JSIntrinsicLoweringTest() override {}
 
  protected:
   Reduction Reduce(Node* node, MachineOperatorBuilder::Flags flags =
                                    MachineOperatorBuilder::kNoFlags) {
     MachineOperatorBuilder machine(zone(), kMachPtr, flags);
     JSGraph jsgraph(isolate(), graph(), common(), javascript(), &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
-    GraphReducer graph_reducer(graph(), zone());
+    GraphReducer graph_reducer(zone(), graph());
     JSIntrinsicLowering reducer(&graph_reducer, &jsgraph,
                                 JSIntrinsicLowering::kDeoptimizationEnabled);
     return reducer.Reduce(node);
   }
 
   Node* EmptyFrameState() {
     MachineOperatorBuilder machine(zone());
     JSGraph jsgraph(isolate(), graph(), common(), javascript(), &machine);
     return jsgraph.EmptyFrameState();
   }
@@ skipping 362 matching lines @@
                             CaptureEq(&if_false0)))))),
           IsMerge(
               IsIfTrue(AllOf(CaptureEq(&branch0),
                              IsBranch(IsObjectIsSmi(input), control))),
               AllOf(CaptureEq(&if_false0), IsIfFalse(CaptureEq(&branch0))))));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8