[builtins] Object.prototype.toString() as TurboFan stub.

For angular.js on Speedometer, this results in 8.96%
speed up, i.e., the tests take on average 762ms
with this patch, 837ms without.

BUG= v8:5175

Review-Url: https://codereview.chromium.org/2134803002
Cr-Commit-Position: refs/heads/master@{#37827}

src/bootstrapper.cc

@@ -2482,7 +2482,7 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
     Handle<JSFunction> to_string = InstallFunction(
         container, "object_to_string", JS_OBJECT_TYPE, JSObject::kHeaderSize,
         MaybeHandle<JSObject>(), Builtins::kObjectProtoToString);
-    to_string->shared()->DontAdaptArguments();
+    to_string->shared()->set_internal_formal_parameter_count(0);
     to_string->shared()->set_length(0);
     native_context->set_object_to_string(*to_string);
   }

src/builtins/builtins.h

@@ -331,8 +331,8 @@ namespace internal {
   CPP(ObjectLookupGetter)                                                   \
   CPP(ObjectLookupSetter)                                                   \
   CPP(ObjectPreventExtensions)                                              \
+  TFJ(ObjectProtoToString, 1)                                               \
   CPP(ObjectPrototypePropertyIsEnumerable)                                  \
-  CPP(ObjectProtoToString)                                                  \
   CPP(ObjectSeal)                                                           \
   CPP(ObjectValues)                                                         \
   /* Proxy */                                                               \
@@ -720,6 +720,9 @@ class Builtins {
   // ES6 section 19.1.3.2 Object.prototype.hasOwnProperty
   static void Generate_ObjectHasOwnProperty(CodeStubAssembler* assembler);
 
+  // ES6 section 19.1.3.6 Object.prototype.toString ()
+  static void Generate_ObjectProtoToString(CodeStubAssembler* assembler);
+
   // ES6 section 22.1.2.2 Array.isArray
   static void Generate_ArrayIsArray(CodeStubAssembler* assembler);