FIxed GC bug in StringBuilderConcat.

Test regress-regexp-codeflush.js completes now.