[turbofan] Rewrite ToObject as TurboFan stub.

src/full-codegen/ia32/full-codegen-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/ast/scopes.h"
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/codegen.h"
@@ skipping 927 matching lines @@
   // it to a JS receiver.  See ECMA-262 version 5, section 12.6.4.
   Label convert, done_convert;
   __ JumpIfSmi(eax, &convert, Label::kNear);
   __ CmpObjectType(eax, FIRST_JS_RECEIVER_TYPE, ecx);
   __ j(above_equal, &done_convert, Label::kNear);
   __ cmp(eax, isolate()->factory()->undefined_value());
   __ j(equal, &exit);
   __ cmp(eax, isolate()->factory()->null_value());
   __ j(equal, &exit);
   __ bind(&convert);
+  __ Push(esi);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  __ Pop(esi);
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   __ push(eax);
 
   // Check cache validity in generated code. If we cannot guarantee cache
   // validity, call the runtime system to check cache validity or get the
   // property names in a fixed array. Note: Proxies never have an enum cache,
   // so will always take the slow path.
   Label call_runtime, use_cache, fixed_array;
   __ CheckEnumCache(&call_runtime);
@@ skipping 2710 matching lines @@
       isolate->builtins()->OnStackReplacement()->entry(),
       Assembler::target_address_at(call_target_address, unoptimized_code));
   return ON_STACK_REPLACEMENT;
 }
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_IA32