[turbofan] Allow ReplaceWithValue to kill control.

test/unittests/compiler/js-intrinsic-lowering-unittest.cc

Index: test/unittests/compiler/js-intrinsic-lowering-unittest.cc
diff --git a/test/unittests/compiler/js-intrinsic-lowering-unittest.cc b/test/unittests/compiler/js-intrinsic-lowering-unittest.cc
index 01468cc022b36b5ec3cd977378586c0d7924a38f..d8380036d4ae5b13b77962c8f85877915205b14b 100644
--- a/test/unittests/compiler/js-intrinsic-lowering-unittest.cc
+++ b/test/unittests/compiler/js-intrinsic-lowering-unittest.cc
@@ -34,7 +34,7 @@ class JSIntrinsicLoweringTest : public GraphTest {
     MachineOperatorBuilder machine(zone(), kMachPtr, flags);
     JSGraph jsgraph(isolate(), graph(), common(), javascript(), &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
-    GraphReducer graph_reducer(graph(), zone());
+    GraphReducer graph_reducer(zone(), graph());
     JSIntrinsicLowering reducer(&graph_reducer, &jsgraph,
                                 JSIntrinsicLowering::kDeoptimizationEnabled);
     return reducer.Reduce(node);