[fullcode] Restore context after calling ToNumber builtin.

test/mjsunit/regress/regress-crbug-628573.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
-var a = [0, ""];
-a[0] = 0;
+var z = {valueOf: function() { return 3; }};
 
-function g(array) {
-  array[1] = undefined;
-}
-
-function f() {
-  g(function() {});
-  g(a);
-}
-
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+(function() {
+  try {
+    var tmp = { x: 12 };
+    with (tmp) {
+      z++;
+    }
+    throw new Error("boom");
+  } catch(e) {}
+})();