--- a/nashorn/src/jdk/nashorn/internal/codegen/LocalVariableTypesCalculator.java	Mon Jun 30 20:23:16 2014 +0530
+++ b/nashorn/src/jdk/nashorn/internal/codegen/LocalVariableTypesCalculator.java	Mon Jun 30 17:31:28 2014 +0200
@@ -1196,7 +1196,9 @@
                 } else if(binaryNode.isOptimisticUndecidedType()) {
                     // At this point, we can assign a static type to the optimistic binary ADD operator as now we know
                     // the types of its operands.
-                    return binaryNode.setType(Type.widest(binaryNode.lhs().getType(), binaryNode.rhs().getType()));
+                    final Type type = Type.widest(binaryNode.lhs().getType(), binaryNode.rhs().getType());
+                    // Use Type.CHARSEQUENCE instead of Type.STRING to avoid conversion of ConsStrings to Strings.
+                    return binaryNode.setType(type.equals(Type.STRING) ? Type.CHARSEQUENCE : type);
                 }
                 return binaryNode;
             }

--- a/nashorn/src/jdk/nashorn/internal/codegen/types/ObjectType.java	Mon Jun 30 20:23:16 2014 +0530
+++ b/nashorn/src/jdk/nashorn/internal/codegen/types/ObjectType.java	Mon Jun 30 17:31:28 2014 +0200
@@ -171,6 +171,8 @@
             invokestatic(method, JSType.TO_BOOLEAN);
         } else if (to.isString()) {
             invokestatic(method, JSType.TO_PRIMITIVE_TO_STRING);
+        } else if (to.isCharSequence()) {
+            invokestatic(method, JSType.TO_PRIMITIVE_TO_CHARSEQUENCE);
         } else {
             throw new UnsupportedOperationException("Illegal conversion " + this + " -> " + to + " " + isString() + " " + toString);
         }

--- a/nashorn/src/jdk/nashorn/internal/codegen/types/Type.java	Mon Jun 30 20:23:16 2014 +0530
+++ b/nashorn/src/jdk/nashorn/internal/codegen/types/Type.java	Mon Jun 30 17:31:28 2014 +0200
@@ -417,6 +417,15 @@
     }
 
     /**
+     * Determines whether a type is a CHARSEQUENCE type used internally strings
+     *
+     * @return true if CharSequence (internal string) type, false otherwise
+     */
+    public boolean isCharSequence() {
+        return this.equals(Type.CHARSEQUENCE);
+    }
+
+    /**
      * Determine if two types are equivalent, i.e. need no conversion
      *
      * @param type the second type to check
@@ -800,6 +809,13 @@
     public static final Type STRING = putInCache(new ObjectType(String.class));
 
     /**
+     * This is the CharSequence singleton used to represent JS strings internally
+     * (either a {@code java.lang.String} or {@code jdk.nashorn.internal.runtime.ConsString}.
+     */
+    public static final Type CHARSEQUENCE = putInCache(new ObjectType(CharSequence.class));
+
+
+    /**
      * This is the object singleton, used for all object types
      */
     public static final Type OBJECT = putInCache(new ObjectType());

--- a/nashorn/src/jdk/nashorn/internal/runtime/JSType.java	Mon Jun 30 20:23:16 2014 +0530
+++ b/nashorn/src/jdk/nashorn/internal/runtime/JSType.java	Mon Jun 30 17:31:28 2014 +0200
@@ -130,6 +130,9 @@
     /** Combined call to toPrimitive followed by toString. */
     public static final Call TO_PRIMITIVE_TO_STRING = staticCall(JSTYPE_LOOKUP, JSType.class, "toPrimitiveToString", String.class, Object.class);
 
+    /** Combined call to toPrimitive followed by toCharSequence. */
+    public static final Call TO_PRIMITIVE_TO_CHARSEQUENCE = staticCall(JSTYPE_LOOKUP, JSType.class, "toPrimitiveToCharSequence", CharSequence.class, Object.class);
+
     /** Throw an unwarranted optimism exception */
     public static final Call THROW_UNWARRANTED = staticCall(JSTYPE_LOOKUP, JSType.class, "throwUnwarrantedOptimismException", Object.class, Object.class, int.class);
 
@@ -488,6 +491,16 @@
     }
 
     /**
+     * Like {@link #toPrimitiveToString(Object)}, but avoids conversion of ConsString to String.
+     *
+     * @param obj  an object
+     * @return the CharSequence form of the primitive form of the object
+     */
+    public static CharSequence toPrimitiveToCharSequence(final Object obj) {
+        return toCharSequence(toPrimitive(obj));
+    }
+
+    /**
      * JavaScript compliant conversion of number to boolean
      *
      * @param num a number

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/nashorn/test/script/basic/JDK-8048586.js	Mon Jun 30 17:31:28 2014 +0200
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * 
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ * 
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ * 
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * 
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8048586: String concatenation with optimistic types is slow
+ *
+ * @test
+ * @run
+ */
+
+var body = '';
+
+for (var i = 0; i < 1024 * 1024; i++) {
+  body += 'hello world\n';
+}
+
+body = '';
+
+for (var i = 0; i < 1024 * 1024; i++) {
+  body = body + 'hello world\n';
+}