Currently we didn't always consistently use the String feedback on
JSAdd, but only if JSTypedLowering would already figure out statically
that one of the inputs is already a String. That leads to some odd
performance cliffs, as highlighted in the referenced bug.

This CL fixes the JSTypedLowering::ReduceJSAdd to always bake in the
String feedback. This improves the relevant performance tests from the
bug from

  console.timeEnd: Runtime join3, 967.512000
  console.timeEnd: Runtime join, 1004.599000
  console.timeEnd: Runtime join3, 1124.764000
  console.timeEnd: Runtime join, 966.164000
  console.timeEnd: Runtime join3, 1145.296000
  console.timeEnd: Runtime join, 966.176000
  console.timeEnd: Runtime join3, 1145.272000
  console.timeEnd: Runtime join, 931.266000

to

  console.timeEnd: Runtime join3, 903.050000
  console.timeEnd: Runtime join, 856.509000
  console.timeEnd: Runtime join3, 945.144000
  console.timeEnd: Runtime join, 840.038000
  console.timeEnd: Runtime join3, 927.965000
  console.timeEnd: Runtime join, 841.263000
  console.timeEnd: Runtime join3, 929.342000
  console.timeEnd: Runtime join, 858.143000

which corresponds to an 8-18% improvement.

Bug: v8:7415
Change-Id: I62e008298e4ee0864885b37817c91d055acf2a09
Reviewed-on: https://chromium-review.googlesource.com/936643Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51551}