Merged: [turbofan] Respect ConsString invariant.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 31d4a3fc8c80281e21d36260a8c7786057cecec6..1e2df16f923765c831ca7d72a03c78ae9f0fb229 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -82,18 +82,25 @@ class JSBinopReduction final {
     if (BothInputsAre(Type::String()) ||
         ((lowering_->flags() & JSTypedLowering::kDeoptimizationEnabled) &&
          BinaryOperationHintOf(node_->op()) == BinaryOperationHint::kString)) {
-      if (left_type()->IsConstant() &&
-          left_type()->AsConstant()->Value()->IsString()) {
-        Handle<String> left_string =
-            Handle<String>::cast(left_type()->AsConstant()->Value());
-        if (left_string->length() >= ConsString::kMinLength) return true;
-      }
       if (right_type()->IsConstant() &&
           right_type()->AsConstant()->Value()->IsString()) {
         Handle<String> right_string =
             Handle<String>::cast(right_type()->AsConstant()->Value());
         if (right_string->length() >= ConsString::kMinLength) return true;
       }
+      if (left_type()->IsConstant() &&
+          left_type()->AsConstant()->Value()->IsString()) {
+        Handle<String> left_string =
+            Handle<String>::cast(left_type()->AsConstant()->Value());
+        if (left_string->length() >= ConsString::kMinLength) {
+          // The invariant for ConsString requires the left hand side to be
+          // a sequential or external string if the right hand side is the
+          // empty string. Since we don't know anything about the right hand
+          // side here, we must ensure that the left hand side satisfy the
+          // constraints independent of the right hand side.
+          return left_string->IsSeqString() || left_string->IsExternalString();
+        }
+      }
     }
     return false;
   }