Revert "[turbofan] Remove optimization for Cons strings"

This reverts commit 941d5f96.

Reason for revert: Regressed performance tests https://bugs.chromium.org/p/chromium/issues/detail?id=864540

Original change's description:
> [turbofan] Remove optimization for Cons strings
> 
> We used to have an optimized version for nodes that are concatenating
> two strings which was allocating an object on the heap, therefore
> preventing this code from being executed on the compiler thread.
> Octane benchmark results show insignificant increase in performance
> (< 0.5%) without this optimization - see
> https://docs.google.com/spreadsheets/d/1MC5NrMoMSsqxZqw0ojoZvomBb7q2EOt1S0sFoJ8ld2c/edit?usp=sharing
> which leads to the conclusion we can safely remove the optimization for now.
> 
> Bug: v8:7790
> Change-Id: I6492c6a76118cac568d28805995d55c5360bb123
> Reviewed-on: https://chromium-review.googlesource.com/1138246
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54467}

TBR=jarin@chromium.org,neis@chromium.org,mslekova@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7790
Change-Id: I20a8a11e40bcd2bcfaf58154a1ab5e4daa7a25e4
Reviewed-on: https://chromium-review.googlesource.com/1143144
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54556}

src/compiler/js-typed-lowering.cc

@@ -529,6 +529,33 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
         NodeProperties::ReplaceValueInput(node, reduction.replacement(), 0);
       }
     }
+    // We might be able to constant-fold the String concatenation now.
+    if (r.BothInputsAre(Type::String())) {
+      HeapObjectBinopMatcher m(node);
+      if (m.IsFoldable()) {
+        StringRef left(js_heap_broker(), m.left().Value());
+        StringRef right(js_heap_broker(), m.right().Value());
+        if (left.length() + right.length() > String::kMaxLength) {
+          // No point in trying to optimize this, as it will just throw.
+          return NoChange();
+        }
+        // TODO(mslekova): get rid of these allows by doing either one of:
+        // 1. remove the optimization and check if it ruins the performance
+        // 2. leave a placeholder and do the actual allocations once back on the
+        // MT
+        AllowHandleDereference allow_handle_dereference;
+        AllowHandleAllocation allow_handle_allocation;
+        AllowHeapAllocation allow_heap_allocation;
+        ObjectRef cons(
+            js_heap_broker(),
+            factory()
+                ->NewConsString(left.object<String>(), right.object<String>())
+                .ToHandleChecked());
+        Node* value = jsgraph()->Constant(cons);
+        ReplaceWithValue(node, value);
+        return Replace(value);
+      }
+    }
     // We might know for sure that we're creating a ConsString here.
     if (r.ShouldCreateConsString()) {
       return ReduceCreateConsString(node);