[turbofan] Properly connect potentially throwing ToNumber to control chain.

In JSTypedLowering we insert JSToNumber nodes for implicit type
conversions, which can potentially throw (i.e. the input not statically
known to be a plain primitive).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1900383002

Cr-Commit-Position: refs/heads/master@{#35639}

src/compiler/js-typed-lowering.cc

@@ -233,6 +233,8 @@ class JSBinopReduction final {
     DCHECK(!NodeProperties::GetType(node)->Is(Type::PlainPrimitive()));
     Node* const n = graph()->NewNode(javascript()->ToNumber(), node, context(),
                                      frame_state, effect(), control());
+    Node* const if_success = graph()->NewNode(common()->IfSuccess(), n);
+    NodeProperties::ReplaceControlInput(node_, if_success);
     NodeProperties::ReplaceUses(node_, node_, node_, n, n);
     update_effect(n);
     return n;