[JSC] Fix StrCat(ToPrimitive(x), ...) in attemptToMakeFastStringAdd

https://bugs.webkit.org/show_bug.cgi?id=259074
rdar://112016271

Reviewed by Yusuke Suzuki.

Previously, we introduced a fast path [1] for string catenation with
ToPrimitive. And the path doesn't need canOptimizeStringObjectAccess
to be true. This patch reorders the if checks in attemptToMakeFastStringAdd
to avoid canOptimizeStringObjectAccess assertion.

[1] https://commits.webkit.org/265636@main

* JSTests/stress/strcat-str-str-bigint.js: Added.
(foo):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):

Canonical link: https://commits.webkit.org/265927@main

JSTests/stress/strcat-str-str-bigint.js

@@ -0,0 +1,7 @@
+function foo() {
+    '' + '' + 1n;
+}
+
+for (let i = 0; i < 100; i++) {
+    foo();
+}

Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -3753,6 +3753,10 @@ class FixupPhase : public Phase {
                     convertStringAddUse<Int32Use>(node, edge);
                     return;
                 }
+                if (edge->op() == ToPrimitive) {
+                    convertStringAddUse<KnownPrimitiveUse>(node, edge);
+                    return;
+                }
                 if (!Options::useConcurrentJIT())
                     ASSERT(m_graph.canOptimizeStringObjectAccess(node->origin.semantic));
                 if (edge->shouldSpeculateStringObject()) {
@@ -3765,10 +3769,6 @@ class FixupPhase : public Phase {
                     convertStringAddUse<StringOrStringObjectUse>(node, edge);
                     return;
                 }
-                if (edge->op() == ToPrimitive) {
-                    convertStringAddUse<KnownPrimitiveUse>(node, edge);
-                    return;
-                }
                 RELEASE_ASSERT_NOT_REACHED();
             });