Add ToObject call in Array.prototype.sort

Add ToObject call in Array.prototype.sort

The spec says ToObject is called on the receiver, and this is
observable if you call sort on a primitive. This patch trivially
adds the call and a test.

BUG=v8:4125
R=adamk
LOG=Y

Committed: https://crrev.com/cbf9137707edcc6c4e09b2a680667a52c3226621
Cr-Commit-Position: refs/heads/master@{#28972}

[Dan Ehrenberg, 2015-06-11 20:29:07]

littledan@chromium.org changed reviewers:
+ littledan@chromium.org

[adamk, 2015-06-11 20:30:49]

lgtm

At some point we should decide when to use TO_OBJECT_INLINE vs $toObject, but
this should be fine for now.

[adamk, 2015-06-11 20:31:19]

The CQ bit was checked by adamk@chromium.org

[commit-bot: I haz the power, 2015-06-11 20:31:36]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1178193004/1

[Dan Ehrenberg, 2015-06-11 20:32:25]

The CQ bit was checked by littledan@chromium.org

[commit-bot: I haz the power, 2015-06-11 20:32:42]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1178193004/1

[commit-bot: I haz the power, 2015-06-11 21:43:14]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-06-11 21:43:32]

Patchset 1 (id:??) landed as
https://crrev.com/cbf9137707edcc6c4e09b2a680667a52c3226621
Cr-Commit-Position: refs/heads/master@{#28972}