Revert of Revert "In RegExp, lastIndex is read with ToLength, not ToInteger"

Revert of Revert "In RegExp, lastIndex is read with ToLength, not ToInteger" (patchset #1 id:1 of https://codereview.chromium.org/1243053005/)

Reason for revert:
[Sheriff] This causes a breakage with custom snapshot (bisected locally):
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/1190

Original issue's description:
> Revert "In RegExp, lastIndex is read with ToLength, not ToInteger"
>
> $toLength is slow, causing a 3.8%-8% regression in the Octane RegExp
> benchmark. Reverting this patch brings it back up. To make this change,
> we'll need a faster implementation fo $toLength.
>
> BUG=chromium:513160
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/477d651c6a978bdf34954048a235895c62dab0ac
> Cr-Commit-Position: refs/heads/master@{#29830}

TBR=adamk@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:513160
Committed: https://crrev.com/7d02830e7436d23cb00e1d39ea0347fb1be2265d
Cr-Commit-Position: refs/heads/master@{#29835}

[Michael Achenbach, 2015-07-24 08:25:44]

Created Revert of Revert "In RegExp, lastIndex is read with ToLength, not
ToInteger"

[commit-bot: I haz the power, 2015-07-24 08:25:54]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1254723005/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1254723005/1

[commit-bot: I haz the power, 2015-07-24 08:26:05]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-07-24 08:26:20]

Patchset 1 (id:??) landed as
https://crrev.com/7d02830e7436d23cb00e1d39ea0347fb1be2265d
Cr-Commit-Position: refs/heads/master@{#29835}

[Michael Achenbach, 2015-07-24 08:37:14]

Repro instructions:
git checkout 477d651
gclient sync --nohooks
GYP_GENERATORS=ninja GYP_DEFINES="target_arch=x64 v8_target_arch=x64 use_goma=1
embed_script=/path/to/v8/test/mjsunit/mjsunit.js v8_enable_slow_dchecks=1
v8_optimized_debug=1" gclient runhooks
ninja -j1000 -C out/Debug d8
out/Debug/d8 --test --random-seed=517830310 --turbo --always-opt --nohard-abort
--nodead-code-elimination --nofold-constants --enable-slow-asserts --debug-code
--verify-heap --allow-natives-syntax test/mjsunit/regress/regress-3960.js
--gc-interval=500 --stress-compaction --concurrent-recompilation-queue-length=64
--concurrent-recompilation-delay=500 --concurrent-recompilation

[Dan Ehrenberg, 2015-07-24 18:17:00]

Are you sure you chose this patch correctly? When I run the failing test
locally, including the patch that you reverted, it passes.

[Dan Ehrenberg, 2015-07-24 18:49:03]

On 2015/07/24 18:17:00, Dan Ehrenberg wrote:
> Are you sure you chose this patch correctly? When I run the failing test
> locally, including the patch that you reverted, it passes.

Oh, sorry, following those precise instructions that Yang mailed, I can
reproduce the error. And the rollback fixes it.