port e6b6e554 (r35163)

  original commit message:
  In the earlier implementation of GenerateDoubleToObject the context
  is loaded from the parent's frame. rsi is clobbered because it is used
  to store kHoleNan constnat. It is not always safe to peek at
  the parents frame. Bytecode handlers have TypedFrame and the type of
  frame is stored at FP + 1. GenerateDoubleToObject expects context
  to be store at that place. In the current implementation rsi is pushed
  onto the stack and is popped when exiting this function.

BUG=

Review URL: https://codereview.chromium.org/1884873007

Cr-Commit-Position: refs/heads/master@{#35478}