[es6] Introduce %ToInteger and %ToLength.

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 0742f08e9cb8fcc8578eb2bcedf5d335344ec898..444f9a308b4297012940a1aa1829593a00695146 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -1000,11 +1000,11 @@ bool IterateElements(Isolate* isolate, Handle<JSObject> receiver,
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
         isolate, val, Runtime::GetObjectProperty(isolate, receiver, key),
         false);
+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val,
+                                     Object::ToLength(isolate, val), false);
     // TODO(caitp): Support larger element indexes (up to 2^53-1).
     if (!val->ToUint32(&length)) {
-      ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-          isolate, val, Execution::ToLength(isolate, val), false);
-      val->ToUint32(&length);
+      length = 0;
     }
   }