[deoptimizer] Materialize string iterators.

BUG=chromium:683617

Review-Url: https://codereview.chromium.org/2651553003
Cr-Commit-Position: refs/heads/master@{#42606}

src/deoptimizer.cc

@@ -3738,6 +3738,24 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
       object->set_object_map(*iterated_object_map);
       return object;
     }
+    case JS_STRING_ITERATOR_TYPE: {
+      Handle<JSStringIterator> object = Handle<JSStringIterator>::cast(
+          isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
+      slot->value_ = object;
+      // Initialize the index to zero to make the heap verifier happy.
+      object->set_index(0);
+      Handle<Object> properties = materializer.FieldAt(value_index);
+      Handle<Object> elements = materializer.FieldAt(value_index);
+      Handle<Object> iterated_string = materializer.FieldAt(value_index);
+      Handle<Object> next_index = materializer.FieldAt(value_index);
+      object->set_properties(FixedArray::cast(*properties));
+      object->set_elements(FixedArrayBase::cast(*elements));
+      CHECK(iterated_string->IsString());
+      object->set_string(String::cast(*iterated_string));
+      CHECK(next_index->IsSmi());
+      object->set_index(Smi::cast(*next_index)->value());
+      return object;
+    }
     case JS_ARRAY_TYPE: {
       Handle<JSArray> object = Handle<JSArray>::cast(
           isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
@@ -3886,7 +3904,6 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
     case JS_MAP_TYPE:
     case JS_SET_ITERATOR_TYPE:
     case JS_MAP_ITERATOR_TYPE:
-    case JS_STRING_ITERATOR_TYPE:
     case JS_WEAK_MAP_TYPE:
     case JS_WEAK_SET_TYPE:
     case JS_PROMISE_CAPABILITY_TYPE:

test/mjsunit/regress/regress-683617.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+global = 'n';
+function f(deopt) {
+  let it = global[Symbol.iterator]();
+  if (deopt) {
+    return it.next().value;
+  }
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals('n', f(true));