[turbofan] Respect ConsString invariant.

For ConsString, the left hand side must be either sequential or external
if the right hand side is empty.

R=jarin@chromium.org
BUG=chromium:654723
NOTRY=true

Review-Url: https://codereview.chromium.org/2410893003
Cr-Commit-Position: refs/heads/master@{#40192}

src/compiler/js-typed-lowering.cc

@@ -83,14 +83,21 @@ class JSBinopReduction final {
         ((lowering_->flags() & JSTypedLowering::kDeoptimizationEnabled) &&
          BinaryOperationHintOf(node_->op()) == BinaryOperationHint::kString)) {
       HeapObjectBinopMatcher m(node_);
-      if (m.left().HasValue() && m.left().Value()->IsString()) {
-        Handle<String> left_string = Handle<String>::cast(m.left().Value());
-        if (left_string->length() >= ConsString::kMinLength) return true;
-      }
       if (m.right().HasValue() && m.right().Value()->IsString()) {
         Handle<String> right_string = Handle<String>::cast(m.right().Value());
         if (right_string->length() >= ConsString::kMinLength) return true;
       }
+      if (m.left().HasValue() && m.left().Value()->IsString()) {
+        Handle<String> left_string = Handle<String>::cast(m.left().Value());
+        if (left_string->length() >= ConsString::kMinLength) {
+          // The invariant for ConsString requires the left hand side to be
+          // a sequential or external string if the right hand side is the
+          // empty string. Since we don't know anything about the right hand
+          // side here, we must ensure that the left hand side satisfy the
+          // constraints independent of the right hand side.
+          return left_string->IsSeqString() || left_string->IsExternalString();
+        }
+      }
     }
     return false;
   }

test/mjsunit/regress/regress-crbug-654723.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var k = "0101010101010101" + "01010101";
+
+function foo(s) {
+  return k + s;
+}
+
+foo("a");
+foo("a");
+%OptimizeFunctionOnNextCall(foo);
+var x = foo("");