[turbofan] The speculative number operations don't produce control.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index f8c297ab615b775f73f494f0d5919375b4b595e4..f5c2dafa2f613f8a8753266397064fc468410e36 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -147,7 +147,7 @@ class JSBinopReduction final {
     DCHECK_EQ(1, op->EffectOutputCount());
     DCHECK_EQ(false, OperatorProperties::HasContextInput(op));
     DCHECK_EQ(1, op->ControlInputCount());
-    DCHECK_EQ(1, op->ControlOutputCount());
+    DCHECK_EQ(0, op->ControlOutputCount());
     DCHECK_EQ(0, OperatorProperties::GetFrameStateInputCount(op));
     DCHECK_EQ(2, op->ValueInputCount());
 
@@ -165,7 +165,7 @@ class JSBinopReduction final {
       DCHECK(!user->IsDead());
       if (NodeProperties::IsControlEdge(edge)) {
         if (user->opcode() == IrOpcode::kIfSuccess) {
-          user->ReplaceUses(node_);
+          user->ReplaceUses(NodeProperties::GetControlInput(node_));
           user->Kill();
         } else {
           DCHECK_EQ(user->opcode(), IrOpcode::kIfException);