[turbofan] Implement JSBuiltinReducer for String.prototype[Symbol.iterator].

src/bootstrapper.cc

Index: src/bootstrapper.cc
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 6f799e2599aef030cf449847593b53787c8a8f02..906f288ff70ee35b2baba0a19ff083faca4cef6d 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1475,7 +1475,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     Handle<JSFunction> iterator = SimpleCreateFunction(
         isolate, factory->NewStringFromAsciiChecked("[Symbol.iterator]"),
         Builtins::kStringPrototypeIterator, 0, true);
-    iterator->shared()->set_native(true);

[caitp, 2016/10/17 21:54:29]

I don't think we need to get rid of the set_native() call, I believe it's there
for a reason. This is done by the InstallFunction() helpers.

I __believe__ this emulates strict mode and prevents undefined/null receivers
from being converted to the global proxy (among other things), which is hit by
tests and probably causes some failures.

+    iterator->shared()->set_builtin_function_id(kStringIterator);
     JSObject::AddProperty(prototype, factory->iterator_symbol(), iterator,
                           static_cast<PropertyAttributes>(DONT_ENUM));
   }