[turbofan] Properly assign types to Array/String iterators.

When inlining allocations for Array and String iterators, make sure the
allocations have proper types on it (rather than just Type::Any). This
allows us to escape analyze the iterators in a couple of more cases,
i.e. in this very simple case:

  function f(a) {
    const it = a[Symbol.iterator]();
    return it.next().value;
  }

R=jarin@chromium.org
BUG=v8:4586,v8:5448

Review-Url: https://codereview.chromium.org/2640743003
Cr-Commit-Position: refs/heads/master@{#42449}

src/compiler/js-builtin-reducer.cc

@@ -307,6 +307,7 @@ Reduction JSBuiltinReducer::ReduceArrayIterator(Handle<Map> receiver_map,
   Node* value = effect = graph()->NewNode(
       simplified()->Allocate(NOT_TENURED),
       jsgraph()->Constant(JSArrayIterator::kSize), effect, control);
+  NodeProperties::SetType(value, Type::OtherObject());
   effect = graph()->NewNode(simplified()->StoreField(AccessBuilder::ForMap()),
                             value, jsgraph()->Constant(map), effect, control);
   effect = graph()->NewNode(
@@ -1743,6 +1744,7 @@ Reduction JSBuiltinReducer::ReduceStringIterator(Node* node) {
     Node* value = effect = graph()->NewNode(
         simplified()->Allocate(NOT_TENURED),
         jsgraph()->Constant(JSStringIterator::kSize), effect, control);
+    NodeProperties::SetType(value, Type::OtherObject());
     effect = graph()->NewNode(simplified()->StoreField(AccessBuilder::ForMap()),
                               value, map, effect, control);
     effect = graph()->NewNode(