[builtins] fix Allocate() call in ReduceStringIterator()

Use a NumberConstant op rather than an Int32Constant to make assertions in
v8::internal::compiler::EscapeAnalysis::ProcessAllocation() happy.

BUG=v8:5598
R=bmeurer@chromium.org, franzih@chromium.org

Review-Url: https://codereview.chromium.org/2478643002
Cr-Commit-Position: refs/heads/master@{#40746}

src/compiler/js-builtin-reducer.cc

@@ -1044,7 +1044,7 @@ Reduction JSBuiltinReducer::ReduceStringIterator(Node* node) {
         common()->BeginRegion(RegionObservability::kNotObservable), effect);
     Node* value = effect = graph()->NewNode(
         simplified()->Allocate(NOT_TENURED),
-        jsgraph()->Int32Constant(JSStringIterator::kSize), effect, control);
+        jsgraph()->Constant(JSStringIterator::kSize), effect, control);
     effect = graph()->NewNode(simplified()->StoreField(AccessBuilder::ForMap()),
                               value, map, effect, control);
     effect = graph()->NewNode(

test/mjsunit/es6/regress/regress-5598.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo --turbo-escape --allow-natives-syntax
+
+function fn(a) {
+  var [b] = a;
+  return b;
+}
+
+fn('a');
+fn('a');
+%OptimizeFunctionOnNextCall(fn);
+
+fn('a');