Revert of Revert "In RegExp, lastIndex is read with ToLength, not ToInteger" (patchset #1 id:1 of https://codereview.chromium.org/1243053005/)

Reason for revert:
[Sheriff] This causes a breakage with custom snapshot (bisected locally):
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/1190

Original issue's description:
> Revert "In RegExp, lastIndex is read with ToLength, not ToInteger"
>
> $toLength is slow, causing a 3.8%-8% regression in the Octane RegExp
> benchmark. Reverting this patch brings it back up. To make this change,
> we'll need a faster implementation fo $toLength.
>
> BUG=chromium:513160
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/477d651c6a978bdf34954048a235895c62dab0ac
> Cr-Commit-Position: refs/heads/master@{#29830}

TBR=adamk@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:513160

Review URL: https://codereview.chromium.org/1254723005

Cr-Commit-Position: refs/heads/master@{#29835}