Adds a function to call Builtins::kToObject returning a JSReceiver.
Also changes all previous uses of CallBuiltin(Builtins:kToObject to use
it.

Also fixed a case in builtins-object-gen.cc, where the result of
ToObject is cast (unchecked so it doesn't crash) to a JSObject before
actually checking it is a JSObject.

Change-Id: I3b1ff50babc3b3cbf44d56970099d105f7a66d34
Reviewed-on: https://chromium-review.googlesource.com/906778
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51232}