[stubs] Properly convert the receiver for GetPropertyStub.

Call ToObject on the GetPropertyStub input first, so that lookups on
Strings and other primitives don't automatically hit the runtime, i.e.
as the stub is also used to lookup the special @@split and @@replace
symbols for various String builtins.

BUG=v8:5269
R=ishell@chromium.org

Change-Id: I5dbbc84aa2051173bf10be71c782fbe448481034
Reviewed-on: https://chromium-review.googlesource.com/488441
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44961}

src/code-stubs.cc

@@ -856,6 +856,10 @@ TF_STUB(GetPropertyStub, CodeStubAssembler) {
         Goto(if_bailout);
       };
 
+  // Ensure that the {object} is actually a JSReceiver.
+  Callable callable = CodeFactory::ToObject(isolate());
+  object = CallStub(callable, context, object);
+
   TryPrototypeChainLookup(object, key, lookup_property_in_holder,
                           lookup_element_in_holder, &return_undefined,
                           &call_runtime);