[builtins] fix Allocate() call in ReduceStringIterator()

test/mjsunit/es6/regress/regress-5598.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --turbo --turbo-escape --allow-natives-syntax
 
-var global = true;
-global = false;
-
-function f() {
-  return !global;
+function fn(a) {
+  var [b] = a;
+  return b;
 }
 
-%OptimizeFunctionOnNextCall(f);
-assertTrue(f());
+fn('a');
+fn('a');
+%OptimizeFunctionOnNextCall(fn);
+
+fn('a');