port e678a0f9 (r31358)

    original commit message:
    Use %_ToLength for TO_LENGTH, implemented via a ToLengthStub
    that supports a fast path for small integers. Everything else is still
    handled in the runtime.

BUG=

Review URL: https://codereview.chromium.org/1421803002

Cr-Commit-Position: refs/heads/master@{#31542}