[turbofan] Fix type of inline cons-string allocation.

This propagates the existing type of a {JSAdd} node back to the newly
created {Allocate} node. There are cases where said type is {None}.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-772720
BUG=chromium:772720

Change-Id: Iab18d2108a789b51db4e405f7f335c5c0ca6f686
Reviewed-on: https://chromium-review.googlesource.com/708796Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48493}

src/compiler/js-typed-lowering.cc

@@ -668,6 +668,7 @@ Reduction JSTypedLowering::ReduceCreateConsString(Node* node) {
 
   // Morph the {node} into a {FinishRegion}.
   ReplaceWithValue(node, node, node, control);
+  NodeProperties::SetType(value, NodeProperties::GetType(node));
   node->ReplaceInput(0, value);
   node->ReplaceInput(1, effect);
   node->TrimInputCount(2);

test/mjsunit/regress/regress-crbug-772720.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var global;
+function f() {
+  var local = 'abcdefghijklmnopqrst';
+  local += 'abcdefghijkl' + (0 + global);
+  global += 'abcdefghijkl';
+}
+f();
+%OptimizeFunctionOnNextCall(f);
+f();