[TurboFan] Ensure typer knows all inputs to StringConcat are Strings.

Adds a CheckString to all operand inputs of JSStringConcat. The operands are
already known to be strings, so this will get eliminated in almost all cases,
however, if there is a yield within the concatenation then we lose the
knowledge that the previous operands are strings since the values are loaded
from the generator object. Adds a test for this case.

BUG=v8:6243

Change-Id: I1601a316e6efbed1c53486f1027cb0ea023ff030
Reviewed-on: https://chromium-review.googlesource.com/549301
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46243}

src/compiler/bytecode-graph-builder.cc

@@ -2178,8 +2178,12 @@ void BytecodeGraphBuilder::VisitStringConcat() {
       local_zone()->NewArray<Node*>(static_cast<size_t>(operand_count));
   int operand_base = first_reg.index();
   for (int i = 0; i < operand_count; ++i) {
-    operands[i] =
+    Node* reg =
         environment()->LookupRegister(interpreter::Register(operand_base + i));
+    // Explicitly insert a string check here. All operands are already strings,
+    // however in the case of generator yields in the middle of string
+    // concatenations we might lose the knowledge that the operand is a string.
+    operands[i] = NewNode(simplified()->CheckString(), reg);
   }
 
   Node* node = MakeNode(javascript()->StringConcat(operand_count),

test/mjsunit/compiler/string-concat-yield.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function* foo() {
+  var f = `foo${ yield 'yielded' }bar`;
+  return f;
+}
+
+%OptimizeFunctionOnNextCall(foo);
+var gen = foo();
+assertEquals('yielded', gen.next('unused').value);
+assertEquals('foobazbar', gen.next('baz').value);