[builtins] fix Allocate() call in ReduceStringIterator()

test/mjsunit/es6/regress/regress-5598.js

Index: test/mjsunit/es6/regress/regress-5598.js
diff --git a/test/mjsunit/compiler/regress-v8-5573.js b/test/mjsunit/es6/regress/regress-5598.js
similarity index 51%
copy from test/mjsunit/compiler/regress-v8-5573.js
copy to test/mjsunit/es6/regress/regress-5598.js
index 216b791a713bbb5977aeb8248924980da2a6ae2d..600a8664700a22156bf03dc1c9c9ecda33ca072b 100644
--- a/test/mjsunit/compiler/regress-v8-5573.js
+++ b/test/mjsunit/es6/regress/regress-5598.js
@@ -2,14 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --turbo --turbo-escape --allow-natives-syntax
 
-var global = true;
-global = false;
-
-function f() {
-  return !global;
+function fn(a) {
+  var [b] = a;
+  return b;
 }
 
-%OptimizeFunctionOnNextCall(f);
-assertTrue(f());
+fn('a');
+fn('a');
+%OptimizeFunctionOnNextCall(fn);
+
+fn('a');