[turbofan] Fix encoding issue in string iteration

This fixes %StringIteratorPrototype%.next to not mixup
UTF16 and UTF32, and consistently use UTF32 for now.

Bug: chromium:805855
Change-Id: If58e2fe0d9bebd894e12abf8af82881c74388294
Reviewed-on: https://chromium-review.googlesource.com/888741
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50886}

src/compiler/js-builtin-reducer.cc

@@ -2035,7 +2035,7 @@ Reduction JSBuiltinReducer::ReduceStringIteratorNext(Node* node) {
       Node* codepoint = etrue0 = graph()->NewNode(
           simplified()->StringCodePointAt(), string, index, etrue0, if_true0);
       vtrue0 = graph()->NewNode(
-          simplified()->StringFromCodePoint(UnicodeEncoding::UTF16), codepoint);
+          simplified()->StringFromCodePoint(UnicodeEncoding::UTF32), codepoint);
 
       // Update iterator.[[NextIndex]]
       Node* char_length =

test/mjsunit/regress/string-next-encoding.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+function f() {
+  var s = "äϠ�𝌆";
+  var i = s[Symbol.iterator]();
+  assertEquals("ä", i.next().value);
+  assertEquals("Ϡ", i.next().value);
+  assertEquals("�", i.next().value);
+  assertEquals("𝌆", i.next().value);
+  assertSame(undefined, i.next().value);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();