Merged r16128, r16135, r16136 into trunk branch.

Fix smi-based math floor.

Allow HPhis to have an invalid merge index.

Make sure polymorphic element access creates non-replaying phis.

BUG=chromium:270268,v8:2815,v8:2815
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/22857004

git-svn-id: https://v8.googlecode.com/svn/trunk@16155 ce2b1a6d-e550-0410-aec6-3dcde31c8c00