[JSC] Add String fast iteration
// JSTests/stress/iterator-fast-path-mode-mixing.js
var array = [1, 2, 3];
var map = new Map([[1, 2], [3, 4]]);
var set = new Set([1, 2, 3, 4]);
var ascii = "abcde";
var unicode = "a\u{20BB7}b";
// Mixing more iterable types at one for-of site than the fast iteration
// mode limit must keep working correctly.
JSC's fast iteration protocol allows the JIT to recognize that certain for-of loops iterate over known-typed collections and skip the full ECMAScript iteration protocol: no Symbol.iterator call, no .next() dispatch, no {value, done} allocation per step. Previously only Array, Map, and Set had fast modes. In DFG/FTL the pattern represents the loop body's output as a tuple node whose results are extracted with GetProjection; ObjectAllocationSinking can then prove the backing iterator never escapes and eliminate it entirely.
This commit extends the protocol to JSString across all four JIT tiers. LLInt/Baseline use a new JSStringIterator::nextWithAdvance() helper to avoid result-object allocation; DFG/FTL introduce StringIteratorNext(string, position) — a tuple-returning node that, combined with allocation sinking, eliminates the JSStringIterator allocation entirely. The 8-bit single-character case gets an inline fast path returning a cached JSString; ropes, 16-bit strings, and surrogate pairs fall back to operationStringIteratorNext. A per-site cap of 2 fast modes limits inline code growth — sites mixing more than 2 iterable types degrade to Generic.
Significance
~4x speedup on ASCII for-of loops and ~1.8x on surrogate-pair strings; adds string as a fourth recognized type in a JIT fast path that bypasses the full JS iteration protocol, making it a new high-value target for JIT correctness bugs.