Merged r11518, r11519 into trunk branch.

Fix unsigned-Smi check in MappedArgumentsLookup

Fix crash bug in VisitChoice

BUG=chromium:126414,chromium:126272
R=jkummerow@chromium.org
TEST=test/mjsunit/regress/regress-crbug-126414.js

Review URL: https://chromiumcodereview.appspot.com/10310041

git-svn-id: http://v8.googlecode.com/svn/trunk@11520 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
7 files changed