[turbofan] Fix incorrect CheckNonEmptyString lowering.

The CheckNonEmptyString lowering was the wrong way around and would
deoptimize if it doesn't see the empty string. This leads to the
creation of invalid ConsStrings and also to unnecessary deopt loops
with proper code.

Bug: chromium:947949, v8:8834, v8:8931, v8:8939, v8:8951
Change-Id: Ib2cc4e92cc9ec7e0284d94f74d14f67f8c878dec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1545908Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60542}

src/compiler/effect-control-linearizer.cc

@@ -1782,8 +1782,8 @@ Node* EffectControlLinearizer::LowerCheckNonEmptyString(Node* node,
 
   // The empty string "" is canonicalized.
   Node* check = __ WordEqual(value, __ EmptyStringConstant());
-  __ DeoptimizeIfNot(DeoptimizeReason::kWrongInstanceType, VectorSlotPair(),
-                     check, frame_state);
+  __ DeoptimizeIf(DeoptimizeReason::kWrongInstanceType, VectorSlotPair(), check,
+                  frame_state);
 
   return value;
 }

test/mjsunit/regress/regress-crbug-947949-1.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+
+function foo(s) { return s + '0123456789012'; }
+foo('a');
+foo('\u1000');
+%OptimizeFunctionOnNextCall(foo);
+foo('');

test/mjsunit/regress/regress-crbug-947949-2.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --noalways-opt --opt
+
+function foo(s) { return s + '0123456789012'; }
+foo('a');
+foo('\u1000');
+%OptimizeFunctionOnNextCall(foo);
+foo('a');
+assertOptimized(foo);
+foo('');
+assertUnoptimized(foo);