[turbofan] Properly connect potentially throwing ToNumber to control chain.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 17079961d0f5d5a3a7cf0f353ed4f33614f01efa..aacc74b5859f0f5207ba6ccb8b2238ba9d9a042b 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -233,6 +233,8 @@ class JSBinopReduction final {
     DCHECK(!NodeProperties::GetType(node)->Is(Type::PlainPrimitive()));
     Node* const n = graph()->NewNode(javascript()->ToNumber(), node, context(),
                                      frame_state, effect(), control());
+    Node* const if_success = graph()->NewNode(common()->IfSuccess(), n);
+    NodeProperties::ReplaceControlInput(node_, if_success);
     NodeProperties::ReplaceUses(node_, node_, node_, n, n);
     update_effect(n);
     return n;