[turbofan] Assign proper type to %ClassOf/%_ClassOf.

The %ClassOf runtime function and %_ClassOf intrinsics always produce an
internalized string, or Null for primitive inputs.

BUG=v8:5267
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2646523004
Cr-Commit-Position: refs/heads/master@{#42522}

src/compiler/typer.cc

@@ -1561,6 +1561,9 @@ Type* Typer::Visitor::TypeJSCallRuntime(Node* node) {
       return TypeUnaryOp(node, ToObject);
     case Runtime::kInlineToString:
       return TypeUnaryOp(node, ToString);
+    case Runtime::kClassOf:
+    case Runtime::kInlineClassOf:
+      return Type::Union(Type::InternalizedString(), Type::Null(), zone());
     case Runtime::kHasInPrototypeChain:
       return Type::Boolean();
     default: