[turbofan] Properly connect potentially throwing ToNumber to control chain.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
@@ skipping 215 matching lines @@
     }
     return graph()->NewNode(
         javascript()->ToNumber(), node, jsgraph()->NoContextConstant(),
         jsgraph()->EmptyFrameState(), graph()->start(), graph()->start());
   }
 
   Node* ConvertSingleInputToNumber(Node* node, Node* frame_state) {
     DCHECK(!NodeProperties::GetType(node)->Is(Type::PlainPrimitive()));
     Node* const n = graph()->NewNode(javascript()->ToNumber(), node, context(),
                                      frame_state, effect(), control());
+    Node* const if_success = graph()->NewNode(common()->IfSuccess(), n);
+    NodeProperties::ReplaceControlInput(node_, if_success);
     NodeProperties::ReplaceUses(node_, node_, node_, n, n);
     update_effect(n);
     return n;
   }
 
   void ConvertBothInputsToNumber(Node** left_result, Node** right_result,
                                  Node* frame_state) {
     Node* projections[2];
 
     // Find {IfSuccess} and {IfException} continuations of the operation.
@@ skipping 1581 matching lines @@
 }
 
 
 CompilationDependencies* JSTypedLowering::dependencies() const {
   return dependencies_;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8