buffer: avoid 'in' operator

This change results in ~50% improvement when creating a Buffer from
an array-like object.

benchmark/buffers/buffer-from.js

@@ -10,7 +10,8 @@ const bench = common.createBenchmark(main, {
     'buffer',
     'uint8array',
     'string',
-    'string-base64'
+    'string-base64',
+    'object'
   ],
   len: [10, 2048],
   n: [1024]
@@ -25,6 +26,7 @@ function main(conf) {
   const str = 'a'.repeat(len);
   const buffer = Buffer.allocUnsafe(len);
   const uint8array = new Uint8Array(len);
+  const obj = { length: null }; // Results in a new, empty Buffer
 
   var i;
 
@@ -80,6 +82,13 @@ function main(conf) {
       }
       bench.end(n);
       break;
+    case 'object':
+      bench.start();
+      for (i = 0; i < n * 1024; i++) {
+        Buffer.from(obj);
+      }
+      bench.end(n);
+      break;
     default:
       assert.fail(null, null, 'Should not get here');
   }

lib/buffer.js

@@ -263,7 +263,7 @@ function fromObject(obj) {
   }
 
   if (obj) {
-    if ('length' in obj || isArrayBuffer(obj.buffer) ||
+    if (obj.length !== undefined || isArrayBuffer(obj.buffer) ||
         isSharedArrayBuffer(obj.buffer)) {
       if (typeof obj.length !== 'number' || obj.length !== obj.length) {
         return new FastBuffer();