[turbofan] Properly allocate constant-folded string.

When constant-folding S[K], make sure to return a String, and not the
character code as Number.

BUG=chromium:664942
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2503433002
Cr-Commit-Position: refs/heads/master@{#40960}

src/compiler/js-native-context-specialization.cc

@@ -706,8 +706,9 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
       NumberMatcher mindex(index);
       if (mindex.IsInteger() && mindex.IsInRange(0.0, string->length() - 1)) {
         // Constant-fold the {index} access to {string}.
-        Node* value =
-            jsgraph()->Constant(string->Get(static_cast<int>(mindex.Value())));
+        Node* value = jsgraph()->HeapConstant(
+            factory()->LookupSingleCharacterStringFromCode(
+                string->Get(static_cast<int>(mindex.Value()))));
         ReplaceWithValue(node, value, effect, control);
         return Replace(value);
       } else if (flags() & kDeoptimizationEnabled) {

test/mjsunit/regress/regress-crbug-664942.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return 'x'[0];
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("x", foo());