[turbofan] Allow ReplaceWithValue to kill control.

test/unittests/compiler/js-type-feedback-unittest.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/js-type-feedback.h"
@@ skipping 25 matching lines @@
  protected:
   Reduction Reduce(Node* node,
                    JSTypeFeedbackSpecializer::DeoptimizationMode mode) {
     Handle<GlobalObject> global_object(
         isolate()->native_context()->global_object(), isolate());
 
     MachineOperatorBuilder machine(zone());
     JSGraph jsgraph(isolate(), graph(), common(), javascript(), &machine);
     JSTypeFeedbackTable table(zone());
     // TODO(titzer): mock the GraphReducer here for better unit testing.
-    GraphReducer graph_reducer(graph(), zone());
+    GraphReducer graph_reducer(zone(), graph());
     JSTypeFeedbackSpecializer reducer(&graph_reducer, &jsgraph, &table, nullptr,
                                       global_object, mode, &dependencies_);
     return reducer.Reduce(node);
   }
 
   Node* EmptyFrameState() {
     MachineOperatorBuilder machine(zone());
     JSGraph jsgraph(isolate(), graph(), common(), javascript(), &machine);
     return jsgraph.EmptyFrameState();
   }
@@ skipping 278 matching lines @@
               IsReturn(load_field_match, load_field_match, graph()->start()));
   EXPECT_THAT(graph()->end(), IsEnd(ret));
 
   EXPECT_FALSE(dependencies()->IsEmpty());
   dependencies()->Rollback();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8