[TurboFan] Intrinsic IsInstanceType lowering needs control

We introduce nodes with control output during intrinsic IsInstanceType
lowering, and must carefully connect them to subsequent control inputs.

Bug: v8:7002
Change-Id: I2e3066943b8f7e36652438ae6ca560932188203e
Reviewed-on: https://chromium-review.googlesource.com/763633Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49302}

src/compiler/js-intrinsic-lowering.cc

@@ -254,7 +254,7 @@ Reduction JSIntrinsicLowering::ReduceIsInstanceType(
 
   // Replace all effect uses of {node} with the {ephi}.
   Node* ephi = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, merge);
-  ReplaceWithValue(node, node, ephi);
+  ReplaceWithValue(node, node, ephi, merge);
 
   // Turn the {node} into a Phi.
   return Change(node, common()->Phi(MachineRepresentation::kTagged, 2), vtrue,