[crankshaft] Fix string addition to check for max length of cons string.

src/crankshaft/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/crankshaft/hydrogen.h"
 
 #include <memory>
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
@@ skipping 2223 matching lines @@
     if (c_right_length->Integer32Value() + 1 >= ConsString::kMinLength) {
       // The left string contains at least one character.
       return BuildCreateConsString(length, left, right, allocation_mode);
     }
   }
 
   // Check if we should create a cons string.
   IfBuilder if_createcons(this);
   if_createcons.If<HCompareNumericAndBranch>(
       length, Add<HConstant>(ConsString::kMinLength), Token::GTE);
+  if_createcons.And();
+  if_createcons.If<HCompareNumericAndBranch>(
+      length, Add<HConstant>(ConsString::kMaxLength), Token::LTE);
   if_createcons.Then();
   {
     // Create a cons string.
     Push(BuildCreateConsString(length, left, right, allocation_mode));
   }
   if_createcons.Else();
   {
     // Determine the string instance types.
     HValue* left_instance_type = AddLoadStringInstanceType(left);
     HValue* right_instance_type = AddLoadStringInstanceType(right);
@@ skipping 10758 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8