Remove unnecessary checks and runtime calls from ToLength

src/runtime.js

Index: src/runtime.js
diff --git a/src/runtime.js b/src/runtime.js
index de64541496f41ac4ce59cc7836943588804a0acb..ab088e7adfbdd45943fe8a3799af8b66592e1496 100644
--- a/src/runtime.js
+++ b/src/runtime.js
@@ -732,12 +732,12 @@ function ToInteger(x) {
 }
 
 
-// ES6, draft 08-24-14, section 7.1.15
+// ES6, section 7.1.15
 function ToLength(arg) {
-  arg = ToInteger(arg);
-  if (arg < 0) return 0;
-  return arg < GlobalNumber.MAX_SAFE_INTEGER ? arg
-                                             : GlobalNumber.MAX_SAFE_INTEGER;
+  arg = TO_NUMBER_INLINE(arg);
+  if (arg <= 0 || NUMBER_IS_NAN(arg)) return 0;
+  arg = %_MathFloor(arg);

[adamk, 2015/08/25 21:55:42]

This line is the problem. I get a crash if |arg| is a Smi. Repro:

d8 --harmony-reflect --turbo --always-opt -e 'Reflect.apply(function(){}, {}, {
length: 1 })'

Even more bizarrely, adding a Smi check results in a crash under --stress-opt
--always-opt on a different case:

function f() { 'use strict'; }
Reflect.apply(f, undefined, {});
for (var i = 0; i < 256; ++i) {
  Reflect.apply(f, undefined, { length: i });
}

Seems like something is particularly screwy with either the Reflect stuff or
MathFloor (both of which have strange implementations).

+  return arg < kMaxSafeInteger ? arg : kMaxSafeInteger;
 }