[turbofan] Re-type JSAdd("", prim) reduction to ToString.

Bug: chromium:934175
Change-Id: I00b4d6931d196037f0ead168cc9cbb19cb83a12d
Reviewed-on: https://chromium-review.googlesource.com/c/1481632Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59787}

src/compiler/js-typed-lowering.cc

@@ -536,12 +536,16 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
       // JSAdd("", x:primitive) => JSToString(x)
       NodeProperties::ReplaceValueInputs(node, r.right());
       NodeProperties::ChangeOp(node, javascript()->ToString());
+      NodeProperties::SetType(
+          node, Type::Intersect(r.type(), Type::String(), graph()->zone()));
       Reduction const reduction = ReduceJSToString(node);
       return reduction.Changed() ? reduction : Changed(node);
     } else if (r.RightInputIs(empty_string_type_)) {
       // JSAdd(x:primitive, "") => JSToString(x)
       NodeProperties::ReplaceValueInputs(node, r.left());
       NodeProperties::ChangeOp(node, javascript()->ToString());
+      NodeProperties::SetType(
+          node, Type::Intersect(r.type(), Type::String(), graph()->zone()));
       Reduction const reduction = ReduceJSToString(node);
       return reduction.Changed() ? reduction : Changed(node);
     }

test/mjsunit/compiler/regress-934175.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function ShortcutEmptyStringAddRight() {
+  let ar = new Float32Array(1);
+  function opt(i){
+    return ar[i] + (NaN ? 0 : '');
+  }
+  ar[0] = 42;
+  opt(1);
+  %OptimizeFunctionOnNextCall(opt);
+  assertEquals("42", opt(0));
+})();
+
+(function ShortcutiEmptyStringAddLeft() {
+  let ar = new Float32Array(1);
+  function opt(i){
+    return (NaN ? 0 : '') + ar[i];
+  }
+  ar[0] = 42;
+  opt(1);
+  %OptimizeFunctionOnNextCall(opt);
+  assertEquals("42", opt(0));
+})();