[turbofan] Rewrite ToObject as TurboFan stub.

src/full-codegen/x64/full-codegen-x64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/ast/scopes.h"
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/codegen.h"
@@ skipping 942 matching lines @@
   // it to a JS receiver.  See ECMA-262 version 5, section 12.6.4.
   Label convert, done_convert;
   __ JumpIfSmi(rax, &convert, Label::kNear);
   __ CmpObjectType(rax, FIRST_JS_RECEIVER_TYPE, rcx);
   __ j(above_equal, &done_convert, Label::kNear);
   __ CompareRoot(rax, Heap::kNullValueRootIndex);
   __ j(equal, &exit);
   __ CompareRoot(rax, Heap::kUndefinedValueRootIndex);
   __ j(equal, &exit);
   __ bind(&convert);
+  __ Push(rsi);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  __ Pop(rsi);
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   __ Push(rax);
 
   // Check cache validity in generated code. If we cannot guarantee cache
   // validity, call the runtime system to check cache validity or get the
   // property names in a fixed array. Note: Proxies never have an enum cache,
   // so will always take the slow path.
   Label call_runtime;
   __ CheckEnumCache(&call_runtime);
@@ skipping 2686 matching lines @@
   DCHECK_EQ(
       isolate->builtins()->OnStackReplacement()->entry(),
       Assembler::target_address_at(call_target_address, unoptimized_code));
   return ON_STACK_REPLACEMENT;
 }
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X64