[turbofan] We cannot unconditionally flatten cons strings in the JSGraph.

It is not always safe to allocate new heap objects in the JSGraph. We
might have to revisit this later once we do the canonicalization for
HeapConstants.

R=jarin@chromium.org
BUG=chromium:545364
LOG=n

Review URL: https://codereview.chromium.org/1413373002

Cr-Commit-Position: refs/heads/master@{#31421}

src/compiler/js-graph.cc

@@ -12,9 +12,7 @@ namespace internal {
 namespace compiler {
 
 Node* JSGraph::ImmovableHeapConstant(Handle<HeapObject> value) {
-  if (value->IsConsString()) {
-    value = String::Flatten(Handle<String>::cast(value), TENURED);
-  }
+  // TODO(bmeurer): Flatten cons strings here before we canonicalize them?
   return graph()->NewNode(common()->HeapConstant(value));
 }
 

test/mjsunit/regress/regress-crbug-545364.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  "use asm";
+  return function(x) {
+    for (var i = 0; i < 100000; ++i) {}
+    return x;
+  }
+})()(this + "i");