[deoptimizer] Fix materialization of iterators.

Bug: chromium:787301
Change-Id: If32310f9f2f3f04daa5bdaa9779302f4a012d397
Reviewed-on: https://chromium-review.googlesource.com/806223
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49843}

src/deoptimizer.cc

@@ -3317,6 +3317,7 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
     case JS_SET_VALUE_ITERATOR_TYPE: {
       Handle<JSSetIterator> object = Handle<JSSetIterator>::cast(
           isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
+      slot->value_ = object;
       Handle<Object> properties = materializer.FieldAt(value_index);
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> table = materializer.FieldAt(value_index);
@@ -3332,6 +3333,7 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
     case JS_MAP_VALUE_ITERATOR_TYPE: {
       Handle<JSMapIterator> object = Handle<JSMapIterator>::cast(
           isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
+      slot->value_ = object;
       Handle<Object> properties = materializer.FieldAt(value_index);
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> table = materializer.FieldAt(value_index);

test/mjsunit/compiler-regress-787301.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(b) {
+    let iterator = new Set().values();
+    iterator.x = 0;
+
+    let arr = [iterator, iterator];
+    if (b)
+        return arr.slice();
+}
+
+opt(false);
+opt(false);
+%OptimizeFunctionOnNextCall(opt);
+
+let res = opt(true);
+let a = res[0];
+let b = res[1];
+
+assertTrue(a === b);
+a.x = 7;
+assertEquals(7, b.x);