[turbofan] Don't loose arguments of String#concat

Bug: v8:7516
Change-Id: I0a43197527e3fd4f14862fb782029e9325ae2a00
Reviewed-on: https://chromium-review.googlesource.com/966103
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51982}

src/compiler/js-call-reducer.cc

@@ -5067,7 +5067,9 @@ Reduction JSCallReducer::ReduceStringIteratorPrototypeNext(Node* node) {
 // ES #sec-string.prototype.concat
 Reduction JSCallReducer::ReduceStringPrototypeConcat(
     Node* node, Handle<SharedFunctionInfo> shared) {
-  if (node->op()->ValueInputCount() < 2) return NoChange();
+  if (node->op()->ValueInputCount() < 2 || node->op()->ValueInputCount() > 3) {
+    return NoChange();
+  }
   CallParameters const& p = CallParametersOf(node->op());
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
     return NoChange();

test/mjsunit/compiler/string-concat-deopt.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(() => {
+  function f(a) {
+    return "abc".concat();
+  }
+
+  assertEquals("abc", f());
+  assertEquals("abc", f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc", f());
+})();
+
+(() => {
+  function f(a) {
+    return "abc".concat(a);
+  }
+
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abcde", f("de"));
+})();
+
+(() => {
+  function f(a) {
+    return "abc".concat(a);
+  }
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc1", f(1));
+})();
+
+(() => {
+  function f(a) {
+    return "abc".concat(a);
+  }
+
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  var s = "x".repeat((1 << 28) - 16);
+  try {
+    s = "x".repeat((1 << 30) - 1 - 24);
+  } catch (e) {
+  }
+  assertThrows(() => f(s), RangeError);
+})();
+
+
+(() => {
+  function f(a) {
+    return "ab".concat("c");
+  }
+
+  assertEquals("abc", f());
+  assertEquals("abc", f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc", f());
+})();
+
+(() => {
+  function f(a) {
+    return "ab".concat("c", a);
+  }
+
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abcde", f("de"));
+})();
+
+(() => {
+  function f(a) {
+    return "ab".concat("c", a);
+  }
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc1", f(1));
+})();
+
+(() => {
+  function f(a) {
+    return "ab".concat("c", a);
+  }
+
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  var s = "x".repeat((1 << 28) - 16);
+  try {
+    s = "x".repeat((1 << 30) - 1 - 24);
+  } catch (e) {
+  }
+  assertThrows(() => f(s), RangeError);
+})();