Version 2.5.2

src/runtime.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 81 matching lines @@
 // a variable of the specified type with the given name.  If the
 // object is not a Number call IllegalOperation and return.
 #define CONVERT_NUMBER_CHECKED(type, name, Type, obj)                \
   RUNTIME_ASSERT(obj->IsNumber());                                   \
   type name = NumberTo##Type(obj);
 
 // Non-reentrant string buffer for efficient general use in this file.
 static StaticResource<StringInputBuffer> runtime_string_input_buffer;
 
 
-MUST_USE_RESULT static Object* DeepCopyBoilerplate(JSObject* boilerplate) {
+MUST_USE_RESULT static MaybeObject* DeepCopyBoilerplate(JSObject* boilerplate) {
   StackLimitCheck check;
   if (check.HasOverflowed()) return Top::StackOverflow();
 
-  Object* result = Heap::CopyJSObject(boilerplate);
-  if (result->IsFailure()) return result;
+  Object* result;
+  { MaybeObject* maybe_result = Heap::CopyJSObject(boilerplate);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
   JSObject* copy = JSObject::cast(result);
 
   // Deep copy local properties.
   if (copy->HasFastProperties()) {
     FixedArray* properties = copy->properties();
     for (int i = 0; i < properties->length(); i++) {
       Object* value = properties->get(i);
       if (value->IsJSObject()) {
         JSObject* js_object = JSObject::cast(value);
-        result = DeepCopyBoilerplate(js_object);
-        if (result->IsFailure()) return result;
+        { MaybeObject* maybe_result = DeepCopyBoilerplate(js_object);
+          if (!maybe_result->ToObject(&result)) return maybe_result;
+        }
         properties->set(i, result);
       }
     }
     int nof = copy->map()->inobject_properties();
     for (int i = 0; i < nof; i++) {
       Object* value = copy->InObjectPropertyAt(i);
       if (value->IsJSObject()) {
         JSObject* js_object = JSObject::cast(value);
-        result = DeepCopyBoilerplate(js_object);
-        if (result->IsFailure()) return result;
+        { MaybeObject* maybe_result = DeepCopyBoilerplate(js_object);
+          if (!maybe_result->ToObject(&result)) return maybe_result;
+        }
         copy->InObjectPropertyAtPut(i, result);
       }
     }
   } else {
-    result = Heap::AllocateFixedArray(copy->NumberOfLocalProperties(NONE));
-    if (result->IsFailure()) return result;
+    { MaybeObject* maybe_result =
+          Heap::AllocateFixedArray(copy->NumberOfLocalProperties(NONE));
+      if (!maybe_result->ToObject(&result)) return maybe_result;
+    }
     FixedArray* names = FixedArray::cast(result);
     copy->GetLocalPropertyNames(names, 0);
     for (int i = 0; i < names->length(); i++) {
       ASSERT(names->get(i)->IsString());
       String* key_string = String::cast(names->get(i));
       PropertyAttributes attributes =
           copy->GetLocalPropertyAttribute(key_string);
       // Only deep copy fields from the object literal expression.
       // In particular, don't try to copy the length attribute of
       // an array.
       if (attributes != NONE) continue;
-      Object* value = copy->GetProperty(key_string, &attributes);
-      ASSERT(!value->IsFailure());
+      Object* value =
+          copy->GetProperty(key_string, &attributes)->ToObjectUnchecked();
       if (value->IsJSObject()) {
         JSObject* js_object = JSObject::cast(value);
-        result = DeepCopyBoilerplate(js_object);
-        if (result->IsFailure()) return result;
-        result = copy->SetProperty(key_string, result, NONE);
-        if (result->IsFailure()) return result;
+        { MaybeObject* maybe_result = DeepCopyBoilerplate(js_object);
+          if (!maybe_result->ToObject(&result)) return maybe_result;
+        }
+        { MaybeObject* maybe_result =
+              copy->SetProperty(key_string, result, NONE);
+          if (!maybe_result->ToObject(&result)) return maybe_result;
+        }
       }
     }
   }
 
   // Deep copy local elements.
   // Pixel elements cannot be created using an object literal.
   ASSERT(!copy->HasPixelElements() && !copy->HasExternalArrayElements());
   switch (copy->GetElementsKind()) {
     case JSObject::FAST_ELEMENTS: {
       FixedArray* elements = FixedArray::cast(copy->elements());
       if (elements->map() == Heap::fixed_cow_array_map()) {
         Counters::cow_arrays_created_runtime.Increment();
 #ifdef DEBUG
         for (int i = 0; i < elements->length(); i++) {
           ASSERT(!elements->get(i)->IsJSObject());
         }
 #endif
       } else {
         for (int i = 0; i < elements->length(); i++) {
           Object* value = elements->get(i);
           if (value->IsJSObject()) {
             JSObject* js_object = JSObject::cast(value);
-            result = DeepCopyBoilerplate(js_object);
-            if (result->IsFailure()) return result;
+            { MaybeObject* maybe_result = DeepCopyBoilerplate(js_object);
+              if (!maybe_result->ToObject(&result)) return maybe_result;
+            }
             elements->set(i, result);
           }
         }
       }
       break;
     }
     case JSObject::DICTIONARY_ELEMENTS: {
       NumberDictionary* element_dictionary = copy->element_dictionary();
       int capacity = element_dictionary->Capacity();
       for (int i = 0; i < capacity; i++) {
         Object* k = element_dictionary->KeyAt(i);
         if (element_dictionary->IsKey(k)) {
           Object* value = element_dictionary->ValueAt(i);
           if (value->IsJSObject()) {
             JSObject* js_object = JSObject::cast(value);
-            result = DeepCopyBoilerplate(js_object);
-            if (result->IsFailure()) return result;
+            { MaybeObject* maybe_result = DeepCopyBoilerplate(js_object);
+              if (!maybe_result->ToObject(&result)) return maybe_result;
+            }
             element_dictionary->ValueAtPut(i, result);
           }
         }
       }
       break;
     }
     default:
       UNREACHABLE();
       break;
   }
   return copy;
 }
 
 
-static Object* Runtime_CloneLiteralBoilerplate(Arguments args) {
+static MaybeObject* Runtime_CloneLiteralBoilerplate(Arguments args) {
   CONVERT_CHECKED(JSObject, boilerplate, args[0]);
   return DeepCopyBoilerplate(boilerplate);
 }
 
 
-static Object* Runtime_CloneShallowLiteralBoilerplate(Arguments args) {
+static MaybeObject* Runtime_CloneShallowLiteralBoilerplate(Arguments args) {
   CONVERT_CHECKED(JSObject, boilerplate, args[0]);
   return Heap::CopyJSObject(boilerplate);
 }
 
 
 static Handle<Map> ComputeObjectLiteralMap(
     Handle<Context> context,
     Handle<FixedArray> constant_properties,
     bool* is_result_from_cache) {
   int properties_length = constant_properties->length();
@@ skipping 170 matching lines @@
       return CreateObjectLiteralBoilerplate(literals, elements, false);
     case CompileTimeValue::ARRAY_LITERAL:
       return CreateArrayLiteralBoilerplate(literals, elements);
     default:
       UNREACHABLE();
       return Handle<Object>::null();
   }
 }
 
 
-static Object* Runtime_CreateArrayLiteralBoilerplate(Arguments args) {
+static MaybeObject* Runtime_CreateArrayLiteralBoilerplate(Arguments args) {
   // Takes a FixedArray of elements containing the literal elements of
   // the array literal and produces JSArray with those elements.
   // Additionally takes the literals array of the surrounding function
   // which contains the context from which to get the Array function
   // to use for creating the array literal.
   HandleScope scope;
   ASSERT(args.length() == 3);
   CONVERT_ARG_CHECKED(FixedArray, literals, 0);
   CONVERT_SMI_CHECKED(literals_index, args[1]);
   CONVERT_ARG_CHECKED(FixedArray, elements, 2);
 
   Handle<Object> object = CreateArrayLiteralBoilerplate(literals, elements);
   if (object.is_null()) return Failure::Exception();
 
   // Update the functions literal and return the boilerplate.
   literals->set(literals_index, *object);
   return *object;
 }
 
 
-static Object* Runtime_CreateObjectLiteral(Arguments args) {
+static MaybeObject* Runtime_CreateObjectLiteral(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 4);
   CONVERT_ARG_CHECKED(FixedArray, literals, 0);
   CONVERT_SMI_CHECKED(literals_index, args[1]);
   CONVERT_ARG_CHECKED(FixedArray, constant_properties, 2);
   CONVERT_SMI_CHECKED(fast_elements, args[3]);
   bool should_have_fast_elements = fast_elements == 1;
 
   // Check if boilerplate exists. If not, create it first.
   Handle<Object> boilerplate(literals->get(literals_index));
   if (*boilerplate == Heap::undefined_value()) {
     boilerplate = CreateObjectLiteralBoilerplate(literals,
                                                  constant_properties,
                                                  should_have_fast_elements);
     if (boilerplate.is_null()) return Failure::Exception();
     // Update the functions literal and return the boilerplate.
     literals->set(literals_index, *boilerplate);
   }
   return DeepCopyBoilerplate(JSObject::cast(*boilerplate));
 }
 
 
-static Object* Runtime_CreateObjectLiteralShallow(Arguments args) {
+static MaybeObject* Runtime_CreateObjectLiteralShallow(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 4);
   CONVERT_ARG_CHECKED(FixedArray, literals, 0);
   CONVERT_SMI_CHECKED(literals_index, args[1]);
   CONVERT_ARG_CHECKED(FixedArray, constant_properties, 2);
   CONVERT_SMI_CHECKED(fast_elements, args[3]);
   bool should_have_fast_elements = fast_elements == 1;
 
   // Check if boilerplate exists. If not, create it first.
   Handle<Object> boilerplate(literals->get(literals_index));
   if (*boilerplate == Heap::undefined_value()) {
     boilerplate = CreateObjectLiteralBoilerplate(literals,
                                                  constant_properties,
                                                  should_have_fast_elements);
     if (boilerplate.is_null()) return Failure::Exception();
     // Update the functions literal and return the boilerplate.
     literals->set(literals_index, *boilerplate);
   }
   return Heap::CopyJSObject(JSObject::cast(*boilerplate));
 }
 
 
-static Object* Runtime_CreateArrayLiteral(Arguments args) {
+static MaybeObject* Runtime_CreateArrayLiteral(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 3);
   CONVERT_ARG_CHECKED(FixedArray, literals, 0);
   CONVERT_SMI_CHECKED(literals_index, args[1]);
   CONVERT_ARG_CHECKED(FixedArray, elements, 2);
 
   // Check if boilerplate exists. If not, create it first.
   Handle<Object> boilerplate(literals->get(literals_index));
   if (*boilerplate == Heap::undefined_value()) {
     boilerplate = CreateArrayLiteralBoilerplate(literals, elements);
     if (boilerplate.is_null()) return Failure::Exception();
     // Update the functions literal and return the boilerplate.
     literals->set(literals_index, *boilerplate);
   }
   return DeepCopyBoilerplate(JSObject::cast(*boilerplate));
 }
 
 
-static Object* Runtime_CreateArrayLiteralShallow(Arguments args) {
+static MaybeObject* Runtime_CreateArrayLiteralShallow(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 3);
   CONVERT_ARG_CHECKED(FixedArray, literals, 0);
   CONVERT_SMI_CHECKED(literals_index, args[1]);
   CONVERT_ARG_CHECKED(FixedArray, elements, 2);
 
   // Check if boilerplate exists. If not, create it first.
   Handle<Object> boilerplate(literals->get(literals_index));
   if (*boilerplate == Heap::undefined_value()) {
     boilerplate = CreateArrayLiteralBoilerplate(literals, elements);
     if (boilerplate.is_null()) return Failure::Exception();
     // Update the functions literal and return the boilerplate.
     literals->set(literals_index, *boilerplate);
   }
   if (JSObject::cast(*boilerplate)->elements()->map() ==
       Heap::fixed_cow_array_map()) {
     Counters::cow_arrays_created_runtime.Increment();
   }
   return Heap::CopyJSObject(JSObject::cast(*boilerplate));
 }
 
 
-static Object* Runtime_CreateCatchExtensionObject(Arguments args) {
+static MaybeObject* Runtime_CreateCatchExtensionObject(Arguments args) {
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(String, key, args[0]);
   Object* value = args[1];
   // Create a catch context extension object.
   JSFunction* constructor =
       Top::context()->global_context()->context_extension_function();
-  Object* object = Heap::AllocateJSObject(constructor);
-  if (object->IsFailure()) return object;
+  Object* object;
+  { MaybeObject* maybe_object = Heap::AllocateJSObject(constructor);
+    if (!maybe_object->ToObject(&object)) return maybe_object;
+  }
   // Assign the exception value to the catch variable and make sure
   // that the catch variable is DontDelete.
-  value = JSObject::cast(object)->SetProperty(key, value, DONT_DELETE);
-  if (value->IsFailure()) return value;
+  { MaybeObject* maybe_value =
+        JSObject::cast(object)->SetProperty(key, value, DONT_DELETE);
+    if (!maybe_value->ToObject(&value)) return maybe_value;
+  }
   return object;
 }
 
 
-static Object* Runtime_ClassOf(Arguments args) {
+static MaybeObject* Runtime_ClassOf(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Object* obj = args[0];
   if (!obj->IsJSObject()) return Heap::null_value();
   return JSObject::cast(obj)->class_name();
 }
 
 
-static Object* Runtime_IsInPrototypeChain(Arguments args) {
+static MaybeObject* Runtime_IsInPrototypeChain(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
   // See ECMA-262, section 15.3.5.3, page 88 (steps 5 - 8).
   Object* O = args[0];
   Object* V = args[1];
   while (true) {
     Object* prototype = V->GetPrototype();
     if (prototype->IsNull()) return Heap::false_value();
     if (O == prototype) return Heap::true_value();
     V = prototype;
   }
 }
 
 
 // Inserts an object as the hidden prototype of another object.
-static Object* Runtime_SetHiddenPrototype(Arguments args) {
+static MaybeObject* Runtime_SetHiddenPrototype(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(JSObject, jsobject, args[0]);
   CONVERT_CHECKED(JSObject, proto, args[1]);
 
   // Sanity checks.  The old prototype (that we are replacing) could
   // theoretically be null, but if it is not null then check that we
   // didn't already install a hidden prototype here.
   RUNTIME_ASSERT(!jsobject->GetPrototype()->IsHeapObject() ||
     !HeapObject::cast(jsobject->GetPrototype())->map()->is_hidden_prototype());
   RUNTIME_ASSERT(!proto->map()->is_hidden_prototype());
 
   // Allocate up front before we start altering state in case we get a GC.
-  Object* map_or_failure = proto->map()->CopyDropTransitions();
-  if (map_or_failure->IsFailure()) return map_or_failure;
+  Object* map_or_failure;
+  { MaybeObject* maybe_map_or_failure = proto->map()->CopyDropTransitions();
+    if (!maybe_map_or_failure->ToObject(&map_or_failure)) {
+      return maybe_map_or_failure;
+    }
+  }
   Map* new_proto_map = Map::cast(map_or_failure);
 
-  map_or_failure = jsobject->map()->CopyDropTransitions();
-  if (map_or_failure->IsFailure()) return map_or_failure;
+  { MaybeObject* maybe_map_or_failure = jsobject->map()->CopyDropTransitions();
+    if (!maybe_map_or_failure->ToObject(&map_or_failure)) {
+      return maybe_map_or_failure;
+    }
+  }
   Map* new_map = Map::cast(map_or_failure);
 
   // Set proto's prototype to be the old prototype of the object.
   new_proto_map->set_prototype(jsobject->GetPrototype());
   proto->set_map(new_proto_map);
   new_proto_map->set_is_hidden_prototype();
 
   // Set the object's prototype to proto.
   new_map->set_prototype(proto);
   jsobject->set_map(new_map);
 
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_IsConstructCall(Arguments args) {
+static MaybeObject* Runtime_IsConstructCall(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 0);
   JavaScriptFrameIterator it;
   return Heap::ToBoolean(it.frame()->IsConstructor());
 }
 
 
 // Recursively traverses hidden prototypes if property is not found
 static void GetOwnPropertyImplementation(JSObject* obj,
                                          String* name,
@@ skipping 22 matching lines @@
   DESCRIPTOR_SIZE
 };
 
 // Returns an array with the property description:
 //  if args[1] is not a property on args[0]
 //          returns undefined
 //  if args[1] is a data property on args[0]
 //         [false, value, Writeable, Enumerable, Configurable]
 //  if args[1] is an accessor on args[0]
 //         [true, GetFunction, SetFunction, Enumerable, Configurable]
-static Object* Runtime_GetOwnProperty(Arguments args) {
+static MaybeObject* Runtime_GetOwnProperty(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   Handle<FixedArray> elms = Factory::NewFixedArray(DESCRIPTOR_SIZE);
   Handle<JSArray> desc = Factory::NewJSArrayWithElements(elms);
   LookupResult result;
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
   CONVERT_ARG_CHECKED(String, name, 1);
 
   // This could be an element.
   uint32_t index;
@@ skipping 66 matching lines @@
   GetOwnPropertyImplementation(*obj, *name, &result);
 
   if (!result.IsProperty()) {
     return Heap::undefined_value();
   }
   if (result.type() == CALLBACKS) {
     Object* structure = result.GetCallbackObject();
     if (structure->IsProxy() || structure->IsAccessorInfo()) {
       // Property that is internally implemented as a callback or
       // an API defined callback.
-      Object* value = obj->GetPropertyWithCallback(
-          *obj, structure, *name, result.holder());
-      if (value->IsFailure()) return value;
+      Object* value;
+      { MaybeObject* maybe_value = obj->GetPropertyWithCallback(
+            *obj, structure, *name, result.holder());
+        if (!maybe_value->ToObject(&value)) return maybe_value;
+      }
       elms->set(IS_ACCESSOR_INDEX, Heap::false_value());
       elms->set(VALUE_INDEX, value);
       elms->set(WRITABLE_INDEX, Heap::ToBoolean(!result.IsReadOnly()));
     } else if (structure->IsFixedArray()) {
       // __defineGetter__/__defineSetter__ callback.
       elms->set(IS_ACCESSOR_INDEX, Heap::true_value());
       elms->set(GETTER_INDEX, FixedArray::cast(structure)->get(0));
       elms->set(SETTER_INDEX, FixedArray::cast(structure)->get(1));
     } else {
       return Heap::undefined_value();
     }
   } else {
     elms->set(IS_ACCESSOR_INDEX, Heap::false_value());
     elms->set(VALUE_INDEX, result.GetLazyValue());
     elms->set(WRITABLE_INDEX, Heap::ToBoolean(!result.IsReadOnly()));
   }
 
   elms->set(ENUMERABLE_INDEX, Heap::ToBoolean(!result.IsDontEnum()));
   elms->set(CONFIGURABLE_INDEX, Heap::ToBoolean(!result.IsDontDelete()));
   return *desc;
 }
 
 
-static Object* Runtime_PreventExtensions(Arguments args) {
+static MaybeObject* Runtime_PreventExtensions(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(JSObject, obj, args[0]);
   return obj->PreventExtensions();
 }
 
-static Object* Runtime_IsExtensible(Arguments args) {
+static MaybeObject* Runtime_IsExtensible(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(JSObject, obj, args[0]);
   return obj->map()->is_extensible() ?  Heap::true_value()
                                      : Heap::false_value();
 }
 
 
-static Object* Runtime_RegExpCompile(Arguments args) {
+static MaybeObject* Runtime_RegExpCompile(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 3);
   CONVERT_ARG_CHECKED(JSRegExp, re, 0);
   CONVERT_ARG_CHECKED(String, pattern, 1);
   CONVERT_ARG_CHECKED(String, flags, 2);
   Handle<Object> result = RegExpImpl::Compile(re, pattern, flags);
   if (result.is_null()) return Failure::Exception();
   return *result;
 }
 
 
-static Object* Runtime_CreateApiFunction(Arguments args) {
+static MaybeObject* Runtime_CreateApiFunction(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   CONVERT_ARG_CHECKED(FunctionTemplateInfo, data, 0);
   return *Factory::CreateApiFunction(data);
 }
 
 
-static Object* Runtime_IsTemplate(Arguments args) {
+static MaybeObject* Runtime_IsTemplate(Arguments args) {
   ASSERT(args.length() == 1);
   Object* arg = args[0];
   bool result = arg->IsObjectTemplateInfo() || arg->IsFunctionTemplateInfo();
   return Heap::ToBoolean(result);
 }
 
 
-static Object* Runtime_GetTemplateField(Arguments args) {
+static MaybeObject* Runtime_GetTemplateField(Arguments args) {
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(HeapObject, templ, args[0]);
   CONVERT_CHECKED(Smi, field, args[1]);
   int index = field->value();
   int offset = index * kPointerSize + HeapObject::kHeaderSize;
   InstanceType type = templ->map()->instance_type();
   RUNTIME_ASSERT(type ==  FUNCTION_TEMPLATE_INFO_TYPE ||
                  type ==  OBJECT_TEMPLATE_INFO_TYPE);
   RUNTIME_ASSERT(offset > 0);
   if (type == FUNCTION_TEMPLATE_INFO_TYPE) {
     RUNTIME_ASSERT(offset < FunctionTemplateInfo::kSize);
   } else {
     RUNTIME_ASSERT(offset < ObjectTemplateInfo::kSize);
   }
   return *HeapObject::RawField(templ, offset);
 }
 
 
-static Object* Runtime_DisableAccessChecks(Arguments args) {
+static MaybeObject* Runtime_DisableAccessChecks(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(HeapObject, object, args[0]);
   Map* old_map = object->map();
   bool needs_access_checks = old_map->is_access_check_needed();
   if (needs_access_checks) {
     // Copy map so it won't interfere constructor's initial map.
-    Object* new_map = old_map->CopyDropTransitions();
-    if (new_map->IsFailure()) return new_map;
+    Object* new_map;
+    { MaybeObject* maybe_new_map = old_map->CopyDropTransitions();
+      if (!maybe_new_map->ToObject(&new_map)) return maybe_new_map;
+    }
 
     Map::cast(new_map)->set_is_access_check_needed(false);
     object->set_map(Map::cast(new_map));
   }
   return needs_access_checks ? Heap::true_value() : Heap::false_value();
 }
 
 
-static Object* Runtime_EnableAccessChecks(Arguments args) {
+static MaybeObject* Runtime_EnableAccessChecks(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(HeapObject, object, args[0]);
   Map* old_map = object->map();
   if (!old_map->is_access_check_needed()) {
     // Copy map so it won't interfere constructor's initial map.
-    Object* new_map = old_map->CopyDropTransitions();
-    if (new_map->IsFailure()) return new_map;
+    Object* new_map;
+    { MaybeObject* maybe_new_map = old_map->CopyDropTransitions();
+      if (!maybe_new_map->ToObject(&new_map)) return maybe_new_map;
+    }
 
     Map::cast(new_map)->set_is_access_check_needed(true);
     object->set_map(Map::cast(new_map));
   }
   return Heap::undefined_value();
 }
 
 
-static Object* ThrowRedeclarationError(const char* type, Handle<String> name) {
+static Failure* ThrowRedeclarationError(const char* type, Handle<String> name) {
   HandleScope scope;
   Handle<Object> type_handle = Factory::NewStringFromAscii(CStrVector(type));
   Handle<Object> args[2] = { type_handle, name };
   Handle<Object> error =
       Factory::NewTypeError("redeclaration", HandleVector(args, 2));
   return Top::Throw(*error);
 }
 
 
-static Object* Runtime_DeclareGlobals(Arguments args) {
+static MaybeObject* Runtime_DeclareGlobals(Arguments args) {
   HandleScope scope;
   Handle<GlobalObject> global = Handle<GlobalObject>(Top::context()->global());
 
   Handle<Context> context = args.at<Context>(0);
   CONVERT_ARG_CHECKED(FixedArray, pairs, 1);
   bool is_eval = Smi::cast(args[2])->value() == 1;
 
   // Compute the property attributes. According to ECMA-262, section
   // 13, page 71, the property must be read-only and
   // non-deletable. However, neither SpiderMonkey nor KJS creates the
@@ skipping 91 matching lines @@
       // SetProperty).  Also, we must use the handle-based version to
       // avoid GC issues.
       IgnoreAttributesAndSetLocalProperty(global, name, value, attributes);
     }
   }
 
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_DeclareContextSlot(Arguments args) {
+static MaybeObject* Runtime_DeclareContextSlot(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 4);
 
   CONVERT_ARG_CHECKED(Context, context, 0);
   Handle<String> name(String::cast(args[1]));
   PropertyAttributes mode =
       static_cast<PropertyAttributes>(Smi::cast(args[2])->value());
   RUNTIME_ASSERT(mode == READ_ONLY || mode == NONE);
   Handle<Object> initial_value(args[3]);
 
@@ skipping 64 matching lines @@
     Handle<Object> value(Heap::undefined_value());
     if (*initial_value != NULL) value = initial_value;
     SetProperty(context_ext, name, value, mode);
     ASSERT(context_ext->GetLocalPropertyAttribute(*name) == mode);
   }
 
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_InitializeVarGlobal(Arguments args) {
+static MaybeObject* Runtime_InitializeVarGlobal(Arguments args) {
   NoHandleAllocation nha;
 
   // Determine if we need to assign to the variable if it already
   // exists (based on the number of arguments).
   RUNTIME_ASSERT(args.length() == 1 || args.length() == 2);
   bool assign = args.length() == 2;
 
   CONVERT_ARG_CHECKED(String, name, 0);
   GlobalObject* global = Top::context()->global();
 
@@ skipping 72 matching lines @@
   global = Top::context()->global();
   if (assign) {
     return global->IgnoreAttributesAndSetLocalProperty(*name,
                                                        args[1],
                                                        attributes);
   }
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_InitializeConstGlobal(Arguments args) {
+static MaybeObject* Runtime_InitializeConstGlobal(Arguments args) {
   // All constants are declared with an initial value. The name
   // of the constant is the first argument and the initial value
   // is the second.
   RUNTIME_ASSERT(args.length() == 2);
   CONVERT_ARG_CHECKED(String, name, 0);
   Handle<Object> value = args.at<Object>(1);
 
   // Get the current global object from top.
   GlobalObject* global = Top::context()->global();
 
@@ skipping 27 matching lines @@
 
     // Throw re-declaration error if the intercepted property is present
     // but not read-only.
     if (intercepted != ABSENT && (intercepted & READ_ONLY) == 0) {
       return ThrowRedeclarationError("var", name);
     }
 
     // Restore global object from context (in case of GC) and continue
     // with setting the value because the property is either absent or
     // read-only. We also have to do redo the lookup.
-    global = Top::context()->global();
+    HandleScope handle_scope;
+    Handle<GlobalObject>global(Top::context()->global());
 
     // BUG 1213579: Handle the case where we have to set a read-only
     // property through an interceptor and only do it if it's
     // uninitialized, e.g. the hole. Nirk...
-    global->SetProperty(*name, *value, attributes);
+    SetProperty(global, name, value, attributes);
     return *value;
   }
 
   // Set the value, but only we're assigning the initial value to a
   // constant. For now, we determine this by checking if the
   // current value is the hole.
   PropertyType type = lookup.type();
   if (type == FIELD) {
     FixedArray* properties = global->properties();
     int index = lookup.GetFieldIndex();
     if (properties->get(index)->IsTheHole()) {
       properties->set(index, *value);
     }
   } else if (type == NORMAL) {
     if (global->GetNormalizedProperty(&lookup)->IsTheHole()) {
       global->SetNormalizedProperty(&lookup, *value);
     }
   } else {
     // Ignore re-initialization of constants that have already been
     // assigned a function value.
     ASSERT(lookup.IsReadOnly() && type == CONSTANT_FUNCTION);
   }
 
   // Use the set value as the result of the operation.
   return *value;
 }
 
 
-static Object* Runtime_InitializeConstContextSlot(Arguments args) {
+static MaybeObject* Runtime_InitializeConstContextSlot(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 3);
 
   Handle<Object> value(args[0]);
   ASSERT(!value->IsTheHole());
   CONVERT_ARG_CHECKED(Context, context, 1);
   Handle<String> name(String::cast(args[2]));
 
   // Initializations are always done in the function context.
   context = Handle<Context>(context->fcontext());
@@ skipping 84 matching lines @@
         ASSERT(Top::has_pending_exception());
         return Failure::Exception();
       }
     }
   }
 
   return *value;
 }
 
 
-static Object* Runtime_OptimizeObjectForAddingMultipleProperties(
+static MaybeObject* Runtime_OptimizeObjectForAddingMultipleProperties(
     Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
   CONVERT_ARG_CHECKED(JSObject, object, 0);
   CONVERT_SMI_CHECKED(properties, args[1]);
   if (object->HasFastProperties()) {
     NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, properties);
   }
   return *object;
 }
 
 
-static Object* Runtime_RegExpExec(Arguments args) {
+static MaybeObject* Runtime_RegExpExec(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 4);
   CONVERT_ARG_CHECKED(JSRegExp, regexp, 0);
   CONVERT_ARG_CHECKED(String, subject, 1);
   // Due to the way the JS calls are constructed this must be less than the
   // length of a string, i.e. it is always a Smi.  We check anyway for security.
   CONVERT_SMI_CHECKED(index, args[2]);
   CONVERT_ARG_CHECKED(JSArray, last_match_info, 3);
   RUNTIME_ASSERT(last_match_info->HasFastElements());
   RUNTIME_ASSERT(index >= 0);
   RUNTIME_ASSERT(index <= subject->length());
   Counters::regexp_entry_runtime.Increment();
   Handle<Object> result = RegExpImpl::Exec(regexp,
                                            subject,
                                            index,
                                            last_match_info);
   if (result.is_null()) return Failure::Exception();
   return *result;
 }
 
 
-static Object* Runtime_RegExpConstructResult(Arguments args) {
+static MaybeObject* Runtime_RegExpConstructResult(Arguments args) {
   ASSERT(args.length() == 3);
   CONVERT_SMI_CHECKED(elements_count, args[0]);
   if (elements_count > JSArray::kMaxFastElementsLength) {
     return Top::ThrowIllegalOperation();
   }
-  Object* new_object = Heap::AllocateFixedArrayWithHoles(elements_count);
-  if (new_object->IsFailure()) return new_object;
+  Object* new_object;
+  { MaybeObject* maybe_new_object =
+        Heap::AllocateFixedArrayWithHoles(elements_count);
+    if (!maybe_new_object->ToObject(&new_object)) return maybe_new_object;
+  }
   FixedArray* elements = FixedArray::cast(new_object);
-  new_object = Heap::AllocateRaw(JSRegExpResult::kSize,
-                                 NEW_SPACE,
-                                 OLD_POINTER_SPACE);
-  if (new_object->IsFailure()) return new_object;
+  { MaybeObject* maybe_new_object = Heap::AllocateRaw(JSRegExpResult::kSize,
+                                                      NEW_SPACE,
+                                                      OLD_POINTER_SPACE);
+    if (!maybe_new_object->ToObject(&new_object)) return maybe_new_object;
+  }
   {
     AssertNoAllocation no_gc;
     HandleScope scope;
     reinterpret_cast<HeapObject*>(new_object)->
         set_map(Top::global_context()->regexp_result_map());
   }
   JSArray* array = JSArray::cast(new_object);
   array->set_properties(Heap::empty_fixed_array());
   array->set_elements(elements);
   array->set_length(Smi::FromInt(elements_count));
   // Write in-object properties after the length of the array.
   array->InObjectPropertyAtPut(JSRegExpResult::kIndexIndex, args[1]);
   array->InObjectPropertyAtPut(JSRegExpResult::kInputIndex, args[2]);
   return array;
 }
 
 
-static Object* Runtime_RegExpCloneResult(Arguments args) {
+static MaybeObject* Runtime_RegExpCloneResult(Arguments args) {
   ASSERT(args.length() == 1);
   Map* regexp_result_map;
   {
     AssertNoAllocation no_gc;
     HandleScope handles;
     regexp_result_map = Top::global_context()->regexp_result_map();
   }
   if (!args[0]->IsJSArray()) return args[0];
 
   JSArray* result = JSArray::cast(args[0]);
   // Arguments to RegExpCloneResult should always be fresh RegExp exec call
   // results (either a fresh JSRegExpResult or null).
   // If the argument is not a JSRegExpResult, or isn't unmodified, just return
   // the argument uncloned.
   if (result->map() != regexp_result_map) return result;
 
   // Having the original JSRegExpResult map guarantees that we have
   // fast elements and no properties except the two in-object properties.
   ASSERT(result->HasFastElements());
   ASSERT(result->properties() == Heap::empty_fixed_array());
   ASSERT_EQ(2, regexp_result_map->inobject_properties());
 
-  Object* new_array_alloc = Heap::AllocateRaw(JSRegExpResult::kSize,
-                                              NEW_SPACE,
-                                              OLD_POINTER_SPACE);
-  if (new_array_alloc->IsFailure()) return new_array_alloc;
+  Object* new_array_alloc;
+  { MaybeObject* maybe_new_array_alloc =
+        Heap::AllocateRaw(JSRegExpResult::kSize, NEW_SPACE, OLD_POINTER_SPACE);
+    if (!maybe_new_array_alloc->ToObject(&new_array_alloc)) {
+      return maybe_new_array_alloc;
+    }
+  }
 
   // Set HeapObject map to JSRegExpResult map.
   reinterpret_cast<HeapObject*>(new_array_alloc)->set_map(regexp_result_map);
 
   JSArray* new_array = JSArray::cast(new_array_alloc);
 
   // Copy JSObject properties.
   new_array->set_properties(result->properties());  // Empty FixedArray.
 
   // Copy JSObject elements as copy-on-write.
@@ skipping 10 matching lines @@
   new_array->FastPropertyAtPut(JSRegExpResult::kIndexIndex,
                                result->FastPropertyAt(
                                    JSRegExpResult::kIndexIndex));
   new_array->FastPropertyAtPut(JSRegExpResult::kInputIndex,
                                result->FastPropertyAt(
                                    JSRegExpResult::kInputIndex));
   return new_array;
 }
 
 
-static Object* Runtime_RegExpInitializeObject(Arguments args) {
+static MaybeObject* Runtime_RegExpInitializeObject(Arguments args) {
   AssertNoAllocation no_alloc;
   ASSERT(args.length() == 5);
   CONVERT_CHECKED(JSRegExp, regexp, args[0]);
   CONVERT_CHECKED(String, source, args[1]);
 
   Object* global = args[2];
   if (!global->IsTrue()) global = Heap::false_value();
 
   Object* ignoreCase = args[3];
   if (!ignoreCase->IsTrue()) ignoreCase = Heap::false_value();
@@ skipping 11 matching lines @@
     // Both true and false should be in oldspace at all times.
     regexp->InObjectPropertyAtPut(JSRegExp::kGlobalFieldIndex, global);
     regexp->InObjectPropertyAtPut(JSRegExp::kIgnoreCaseFieldIndex, ignoreCase);
     regexp->InObjectPropertyAtPut(JSRegExp::kMultilineFieldIndex, multiline);
     regexp->InObjectPropertyAtPut(JSRegExp::kLastIndexFieldIndex,
                                   Smi::FromInt(0),
                                   SKIP_WRITE_BARRIER);
     return regexp;
   }
 
-  // Map has changed, so use generic, but slower, method.
+  // Map has changed, so use generic, but slower, method.  Since these
+  // properties were all added as DONT_DELETE they must be present and
+  // normal so no failures can be expected.
   PropertyAttributes final =
       static_cast<PropertyAttributes>(READ_ONLY | DONT_ENUM | DONT_DELETE);
   PropertyAttributes writable =
       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
-  regexp->IgnoreAttributesAndSetLocalProperty(Heap::source_symbol(),
-                                              source,
-                                              final);
-  regexp->IgnoreAttributesAndSetLocalProperty(Heap::global_symbol(),
-                                              global,
-                                              final);
-  regexp->IgnoreAttributesAndSetLocalProperty(Heap::ignore_case_symbol(),
-                                              ignoreCase,
-                                              final);
-  regexp->IgnoreAttributesAndSetLocalProperty(Heap::multiline_symbol(),
-                                              multiline,
-                                              final);
-  regexp->IgnoreAttributesAndSetLocalProperty(Heap::last_index_symbol(),
-                                              Smi::FromInt(0),
-                                              writable);
+  MaybeObject* result;
+  result = regexp->IgnoreAttributesAndSetLocalProperty(Heap::source_symbol(),
+                                                       source,
+                                                       final);
+  ASSERT(!result->IsFailure());
+  result = regexp->IgnoreAttributesAndSetLocalProperty(Heap::global_symbol(),
+                                                       global,
+                                                       final);
+  ASSERT(!result->IsFailure());
+  result =
+      regexp->IgnoreAttributesAndSetLocalProperty(Heap::ignore_case_symbol(),
+                                                  ignoreCase,
+                                                  final);
+  ASSERT(!result->IsFailure());
+  result = regexp->IgnoreAttributesAndSetLocalProperty(Heap::multiline_symbol(),
+                                                       multiline,
+                                                       final);
+  ASSERT(!result->IsFailure());
+  result =
+      regexp->IgnoreAttributesAndSetLocalProperty(Heap::last_index_symbol(),
+                                                  Smi::FromInt(0),
+                                                  writable);
+  ASSERT(!result->IsFailure());
+  USE(result);
   return regexp;
 }
 
 
-static Object* Runtime_FinishArrayPrototypeSetup(Arguments args) {
+static MaybeObject* Runtime_FinishArrayPrototypeSetup(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   CONVERT_ARG_CHECKED(JSArray, prototype, 0);
   // This is necessary to enable fast checks for absence of elements
   // on Array.prototype and below.
   prototype->set_elements(Heap::empty_fixed_array());
   return Smi::FromInt(0);
 }
 
 
 static Handle<JSFunction> InstallBuiltin(Handle<JSObject> holder,
                                          const char* name,
                                          Builtins::Name builtin_name) {
   Handle<String> key = Factory::LookupAsciiSymbol(name);
   Handle<Code> code(Builtins::builtin(builtin_name));
   Handle<JSFunction> optimized = Factory::NewFunction(key,
                                                       JS_OBJECT_TYPE,
                                                       JSObject::kHeaderSize,
                                                       code,
                                                       false);
   optimized->shared()->DontAdaptArguments();
   SetProperty(holder, key, optimized, NONE);
   return optimized;
 }
 
 
-static Object* Runtime_SpecialArrayFunctions(Arguments args) {
+static MaybeObject* Runtime_SpecialArrayFunctions(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   CONVERT_ARG_CHECKED(JSObject, holder, 0);
 
   InstallBuiltin(holder, "pop", Builtins::ArrayPop);
   InstallBuiltin(holder, "push", Builtins::ArrayPush);
   InstallBuiltin(holder, "shift", Builtins::ArrayShift);
   InstallBuiltin(holder, "unshift", Builtins::ArrayUnshift);
   InstallBuiltin(holder, "slice", Builtins::ArraySlice);
   InstallBuiltin(holder, "splice", Builtins::ArraySplice);
   InstallBuiltin(holder, "concat", Builtins::ArrayConcat);
 
   return *holder;
 }
 
 
-static Object* Runtime_GetGlobalReceiver(Arguments args) {
+static MaybeObject* Runtime_GetGlobalReceiver(Arguments args) {
   // Returns a real global receiver, not one of builtins object.
   Context* global_context = Top::context()->global()->global_context();
   return global_context->global()->global_receiver();
 }
 
 
-static Object* Runtime_MaterializeRegExpLiteral(Arguments args) {
+static MaybeObject* Runtime_MaterializeRegExpLiteral(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 4);
   CONVERT_ARG_CHECKED(FixedArray, literals, 0);
   int index = Smi::cast(args[1])->value();
   Handle<String> pattern = args.at<String>(2);
   Handle<String> flags = args.at<String>(3);
 
   // Get the RegExp function from the context in the literals array.
   // This is the RegExp function from the context in which the
   // function was created.  We do not use the RegExp function from the
   // current global context because this might be the RegExp function
   // from another context which we should not have access to.
   Handle<JSFunction> constructor =
       Handle<JSFunction>(
           JSFunction::GlobalContextFromLiterals(*literals)->regexp_function());
   // Compute the regular expression literal.
   bool has_pending_exception;
   Handle<Object> regexp =
       RegExpImpl::CreateRegExpLiteral(constructor, pattern, flags,
                                       &has_pending_exception);
   if (has_pending_exception) {
     ASSERT(Top::has_pending_exception());
     return Failure::Exception();
   }
   literals->set(index, *regexp);
   return *regexp;
 }
 
 
-static Object* Runtime_FunctionGetName(Arguments args) {
+static MaybeObject* Runtime_FunctionGetName(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, f, args[0]);
   return f->shared()->name();
 }
 
 
-static Object* Runtime_FunctionSetName(Arguments args) {
+static MaybeObject* Runtime_FunctionSetName(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(JSFunction, f, args[0]);
   CONVERT_CHECKED(String, name, args[1]);
   f->shared()->set_name(name);
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_FunctionRemovePrototype(Arguments args) {
+static MaybeObject* Runtime_FunctionRemovePrototype(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, f, args[0]);
-  Object* obj = f->RemovePrototype();
-  if (obj->IsFailure()) return obj;
+  Object* obj;
+  { MaybeObject* maybe_obj = f->RemovePrototype();
+    if (!maybe_obj->ToObject(&obj)) return maybe_obj;
+  }
 
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_FunctionGetScript(Arguments args) {
+static MaybeObject* Runtime_FunctionGetScript(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, fun, args[0]);
   Handle<Object> script = Handle<Object>(fun->shared()->script());
   if (!script->IsScript()) return Heap::undefined_value();
 
   return *GetScriptWrapper(Handle<Script>::cast(script));
 }
 
 
-static Object* Runtime_FunctionGetSourceCode(Arguments args) {
+static MaybeObject* Runtime_FunctionGetSourceCode(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, f, args[0]);
   return f->shared()->GetSourceCode();
 }
 
 
-static Object* Runtime_FunctionGetScriptSourcePosition(Arguments args) {
+static MaybeObject* Runtime_FunctionGetScriptSourcePosition(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, fun, args[0]);
   int pos = fun->shared()->start_position();
   return Smi::FromInt(pos);
 }
 
 
-static Object* Runtime_FunctionGetPositionForOffset(Arguments args) {
+static MaybeObject* Runtime_FunctionGetPositionForOffset(Arguments args) {
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(JSFunction, fun, args[0]);
   CONVERT_NUMBER_CHECKED(int, offset, Int32, args[1]);
 
   Code* code = fun->code();
   RUNTIME_ASSERT(0 <= offset && offset < code->Size());
 
   Address pc = code->address() + offset;
   return Smi::FromInt(fun->code()->SourcePosition(pc));
 }
 
 
 
-static Object* Runtime_FunctionSetInstanceClassName(Arguments args) {
+static MaybeObject* Runtime_FunctionSetInstanceClassName(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(JSFunction, fun, args[0]);
   CONVERT_CHECKED(String, name, args[1]);
   fun->SetInstanceClassName(name);
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_FunctionSetLength(Arguments args) {
+static MaybeObject* Runtime_FunctionSetLength(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(JSFunction, fun, args[0]);
   CONVERT_CHECKED(Smi, length, args[1]);
   fun->shared()->set_length(length->value());
   return length;
 }
 
 
-static Object* Runtime_FunctionSetPrototype(Arguments args) {
+static MaybeObject* Runtime_FunctionSetPrototype(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(JSFunction, fun, args[0]);
   ASSERT(fun->should_have_prototype());
-  Object* obj = Accessors::FunctionSetPrototype(fun, args[1], NULL);
-  if (obj->IsFailure()) return obj;
+  Object* obj;
+  { MaybeObject* maybe_obj =
+        Accessors::FunctionSetPrototype(fun, args[1], NULL);
+    if (!maybe_obj->ToObject(&obj)) return maybe_obj;
+  }
   return args[0];  // return TOS
 }
 
 
-static Object* Runtime_FunctionIsAPIFunction(Arguments args) {
+static MaybeObject* Runtime_FunctionIsAPIFunction(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, f, args[0]);
   return f->shared()->IsApiFunction() ? Heap::true_value()
                                       : Heap::false_value();
 }
 
-static Object* Runtime_FunctionIsBuiltin(Arguments args) {
+static MaybeObject* Runtime_FunctionIsBuiltin(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, f, args[0]);
   return f->IsBuiltin() ? Heap::true_value() : Heap::false_value();
 }
 
 
-static Object* Runtime_SetCode(Arguments args) {
+static MaybeObject* Runtime_SetCode(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
 
   CONVERT_ARG_CHECKED(JSFunction, target, 0);
   Handle<Object> code = args.at<Object>(1);
 
   Handle<Context> context(target->context());
 
   if (!code->IsNull()) {
     RUNTIME_ASSERT(code->IsJSFunction());
@@ skipping 36 matching lines @@
     // It's okay to skip the write barrier here because the literals
     // are guaranteed to be in old space.
     target->set_literals(*literals, SKIP_WRITE_BARRIER);
   }
 
   target->set_context(*context);
   return *target;
 }
 
 
-static Object* Runtime_SetExpectedNumberOfProperties(Arguments args) {
+static MaybeObject* Runtime_SetExpectedNumberOfProperties(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
   CONVERT_ARG_CHECKED(JSFunction, function, 0);
   CONVERT_SMI_CHECKED(num, args[1]);
   RUNTIME_ASSERT(num >= 0);
   SetExpectedNofProperties(function, num);
   return Heap::undefined_value();
 }
 
 
-static Object* CharFromCode(Object* char_code) {
+MUST_USE_RESULT static MaybeObject* CharFromCode(Object* char_code) {
   uint32_t code;
   if (char_code->ToArrayIndex(&code)) {
     if (code <= 0xffff) {
       return Heap::LookupSingleCharacterStringFromCode(code);
     }
   }
   return Heap::empty_string();
 }
 
 
-static Object* Runtime_StringCharCodeAt(Arguments args) {
+static MaybeObject* Runtime_StringCharCodeAt(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(String, subject, args[0]);
   Object* index = args[1];
   RUNTIME_ASSERT(index->IsNumber());
 
   uint32_t i = 0;
   if (index->IsSmi()) {
     int value = Smi::cast(index)->value();
     if (value < 0) return Heap::nan_value();
     i = value;
   } else {
     ASSERT(index->IsHeapNumber());
     double value = HeapNumber::cast(index)->value();
     i = static_cast<uint32_t>(DoubleToInteger(value));
   }
 
   // Flatten the string.  If someone wants to get a char at an index
   // in a cons string, it is likely that more indices will be
   // accessed.
-  Object* flat = subject->TryFlatten();
-  if (flat->IsFailure()) return flat;
+  Object* flat;
+  { MaybeObject* maybe_flat = subject->TryFlatten();
+    if (!maybe_flat->ToObject(&flat)) return maybe_flat;
+  }
   subject = String::cast(flat);
 
   if (i >= static_cast<uint32_t>(subject->length())) {
     return Heap::nan_value();
   }
 
   return Smi::FromInt(subject->Get(i));
 }
 
 
-static Object* Runtime_CharFromCode(Arguments args) {
+static MaybeObject* Runtime_CharFromCode(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   return CharFromCode(args[0]);
 }
 
 
 class FixedArrayBuilder {
  public:
   explicit FixedArrayBuilder(int initial_capacity)
       : array_(Factory::NewFixedArrayWithHoles(initial_capacity)),
@@ skipping 468 matching lines @@
         builder->AddString(replacement_substrings_[part.data]);
         break;
       default:
         UNREACHABLE();
     }
   }
 }
 
 
 
-static Object* StringReplaceRegExpWithString(String* subject,
-                                             JSRegExp* regexp,
-                                             String* replacement,
-                                             JSArray* last_match_info) {
+MUST_USE_RESULT static MaybeObject* StringReplaceRegExpWithString(
+    String* subject,
+    JSRegExp* regexp,
+    String* replacement,
+    JSArray* last_match_info) {
   ASSERT(subject->IsFlat());
   ASSERT(replacement->IsFlat());
 
   HandleScope handles;
 
   int length = subject->length();
   Handle<String> subject_handle(subject);
   Handle<JSRegExp> regexp_handle(regexp);
   Handle<String> replacement_handle(replacement);
   Handle<JSArray> last_match_info_handle(last_match_info);
@@ skipping 84 matching lines @@
 
   if (prev < length) {
     builder.AddSubjectSlice(prev, length);
   }
 
   return *(builder.ToString());
 }
 
 
 template <typename ResultSeqString>
-static Object* StringReplaceRegExpWithEmptyString(String* subject,
-                                                  JSRegExp* regexp,
-                                                  JSArray* last_match_info) {
+MUST_USE_RESULT static MaybeObject* StringReplaceRegExpWithEmptyString(
+    String* subject,
+    JSRegExp* regexp,
+    JSArray* last_match_info) {
   ASSERT(subject->IsFlat());
 
   HandleScope handles;
 
   Handle<String> subject_handle(subject);
   Handle<JSRegExp> regexp_handle(regexp);
   Handle<JSArray> last_match_info_handle(last_match_info);
   Handle<Object> match = RegExpImpl::Exec(regexp_handle,
                                           subject_handle,
                                           0,
@@ skipping 104 matching lines @@
   answer->set_length(position);
   if (delta == 0) return *answer;
 
   Address end_of_string = answer->address() + string_size;
   Heap::CreateFillerObjectAt(end_of_string, delta);
 
   return *answer;
 }
 
 
-static Object* Runtime_StringReplaceRegExpWithString(Arguments args) {
+static MaybeObject* Runtime_StringReplaceRegExpWithString(Arguments args) {
   ASSERT(args.length() == 4);
 
   CONVERT_CHECKED(String, subject, args[0]);
   if (!subject->IsFlat()) {
-    Object* flat_subject = subject->TryFlatten();
-    if (flat_subject->IsFailure()) {
-      return flat_subject;
+    Object* flat_subject;
+    { MaybeObject* maybe_flat_subject = subject->TryFlatten();
+      if (!maybe_flat_subject->ToObject(&flat_subject)) {
+        return maybe_flat_subject;
+      }
     }
     subject = String::cast(flat_subject);
   }
 
   CONVERT_CHECKED(String, replacement, args[2]);
   if (!replacement->IsFlat()) {
-    Object* flat_replacement = replacement->TryFlatten();
-    if (flat_replacement->IsFailure()) {
-      return flat_replacement;
+    Object* flat_replacement;
+    { MaybeObject* maybe_flat_replacement = replacement->TryFlatten();
+      if (!maybe_flat_replacement->ToObject(&flat_replacement)) {
+        return maybe_flat_replacement;
+      }
     }
     replacement = String::cast(flat_replacement);
   }
 
   CONVERT_CHECKED(JSRegExp, regexp, args[1]);
   CONVERT_CHECKED(JSArray, last_match_info, args[3]);
 
   ASSERT(last_match_info->HasFastElements());
 
   if (replacement->length() == 0) {
@@ skipping 47 matching lines @@
     return SearchString(seq_sub->ToUC16Vector(), pat_vector, start_index);
   }
   Vector<const uc16> pat_vector = seq_pat->ToUC16Vector();
   if (seq_sub->IsAsciiRepresentation()) {
     return SearchString(seq_sub->ToAsciiVector(), pat_vector, start_index);
   }
   return SearchString(seq_sub->ToUC16Vector(), pat_vector, start_index);
 }
 
 
-static Object* Runtime_StringIndexOf(Arguments args) {
+static MaybeObject* Runtime_StringIndexOf(Arguments args) {
   HandleScope scope;  // create a new handle scope
   ASSERT(args.length() == 3);
 
   CONVERT_ARG_CHECKED(String, sub, 0);
   CONVERT_ARG_CHECKED(String, pat, 1);
 
   Object* index = args[2];
   uint32_t start_index;
   if (!index->ToArrayIndex(&start_index)) return Smi::FromInt(-1);
 
@@ skipping 30 matching lines @@
       }
       j++;
     }
     if (j == pattern_length) {
       return i;
     }
   }
   return -1;
 }
 
-static Object* Runtime_StringLastIndexOf(Arguments args) {
+static MaybeObject* Runtime_StringLastIndexOf(Arguments args) {
   HandleScope scope;  // create a new handle scope
   ASSERT(args.length() == 3);
 
   CONVERT_ARG_CHECKED(String, sub, 0);
   CONVERT_ARG_CHECKED(String, pat, 1);
 
   Object* index = args[2];
   uint32_t start_index;
   if (!index->ToArrayIndex(&start_index)) return Smi::FromInt(-1);
 
@@ skipping 36 matching lines @@
       position = StringMatchBackwards(sub->ToUC16Vector(),
                                       pat_vector,
                                       start_index);
     }
   }
 
   return Smi::FromInt(position);
 }
 
 
-static Object* Runtime_StringLocaleCompare(Arguments args) {
+static MaybeObject* Runtime_StringLocaleCompare(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(String, str1, args[0]);
   CONVERT_CHECKED(String, str2, args[1]);
 
   if (str1 == str2) return Smi::FromInt(0);  // Equal.
   int str1_length = str1->length();
   int str2_length = str2->length();
 
@@ skipping 25 matching lines @@
   for (int i = 0; i < end; i++) {
     uint16_t char1 = buf1.GetNext();
     uint16_t char2 = buf2.GetNext();
     if (char1 != char2) return Smi::FromInt(char1 - char2);
   }
 
   return Smi::FromInt(str1_length - str2_length);
 }
 
 
-static Object* Runtime_SubString(Arguments args) {
+static MaybeObject* Runtime_SubString(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 3);
 
   CONVERT_CHECKED(String, value, args[0]);
   Object* from = args[1];
   Object* to = args[2];
   int start, end;
   // We have a fast integer-only case here to avoid a conversion to double in
   // the common case where from and to are Smis.
   if (from->IsSmi() && to->IsSmi()) {
     start = Smi::cast(from)->value();
     end = Smi::cast(to)->value();
   } else {
     CONVERT_DOUBLE_CHECKED(from_number, from);
     CONVERT_DOUBLE_CHECKED(to_number, to);
     start = FastD2I(from_number);
     end = FastD2I(to_number);
   }
   RUNTIME_ASSERT(end >= start);
   RUNTIME_ASSERT(start >= 0);
   RUNTIME_ASSERT(end <= value->length());
   Counters::sub_string_runtime.Increment();
   return value->SubString(start, end);
 }
 
 
-static Object* Runtime_StringMatch(Arguments args) {
+static MaybeObject* Runtime_StringMatch(Arguments args) {
   ASSERT_EQ(3, args.length());
 
   CONVERT_ARG_CHECKED(String, subject, 0);
   CONVERT_ARG_CHECKED(JSRegExp, regexp, 1);
   CONVERT_ARG_CHECKED(JSArray, regexp_info, 2);
   HandleScope handles;
 
   Handle<Object> match = RegExpImpl::Exec(regexp, subject, 0, regexp_info);
 
   if (match.is_null()) {
@@ skipping 334 matching lines @@
         RegExpImpl::SetCapture(elements, i, prev_register_vector[i]);
       }
       return RegExpImpl::RE_SUCCESS;
     }
   }
   // No matches at all, return failure or exception result directly.
   return result;
 }
 
 
-static Object* Runtime_RegExpExecMultiple(Arguments args) {
+static MaybeObject* Runtime_RegExpExecMultiple(Arguments args) {
   ASSERT(args.length() == 4);
   HandleScope handles;
 
   CONVERT_ARG_CHECKED(String, subject, 1);
   if (!subject->IsFlat()) { FlattenString(subject); }
   CONVERT_ARG_CHECKED(JSRegExp, regexp, 0);
   CONVERT_ARG_CHECKED(JSArray, last_match_info, 2);
   CONVERT_ARG_CHECKED(JSArray, result_array, 3);
 
   ASSERT(last_match_info->HasFastElements());
@@ skipping 28 matching lines @@
   } else {
     result = SearchRegExpMultiple(subject, regexp, last_match_info, &builder);
   }
   if (result == RegExpImpl::RE_SUCCESS) return *builder.ToJSArray(result_array);
   if (result == RegExpImpl::RE_FAILURE) return Heap::null_value();
   ASSERT_EQ(result, RegExpImpl::RE_EXCEPTION);
   return Failure::Exception();
 }
 
 
-static Object* Runtime_NumberToRadixString(Arguments args) {
+static MaybeObject* Runtime_NumberToRadixString(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   // Fast case where the result is a one character string.
   if (args[0]->IsSmi() && args[1]->IsSmi()) {
     int value = Smi::cast(args[0])->value();
     int radix = Smi::cast(args[1])->value();
     if (value >= 0 && value < radix) {
       RUNTIME_ASSERT(radix <= 36);
       // Character array used for conversion.
@@ skipping 10 matching lines @@
   if (isinf(value)) {
     if (value < 0) {
       return Heap::AllocateStringFromAscii(CStrVector("-Infinity"));
     }
     return Heap::AllocateStringFromAscii(CStrVector("Infinity"));
   }
   CONVERT_DOUBLE_CHECKED(radix_number, args[1]);
   int radix = FastD2I(radix_number);
   RUNTIME_ASSERT(2 <= radix && radix <= 36);
   char* str = DoubleToRadixCString(value, radix);
-  Object* result = Heap::AllocateStringFromAscii(CStrVector(str));
+  MaybeObject* result = Heap::AllocateStringFromAscii(CStrVector(str));
   DeleteArray(str);
   return result;
 }
 
 
-static Object* Runtime_NumberToFixed(Arguments args) {
+static MaybeObject* Runtime_NumberToFixed(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(value, args[0]);
   if (isnan(value)) {
     return Heap::AllocateStringFromAscii(CStrVector("NaN"));
   }
   if (isinf(value)) {
     if (value < 0) {
       return Heap::AllocateStringFromAscii(CStrVector("-Infinity"));
     }
     return Heap::AllocateStringFromAscii(CStrVector("Infinity"));
   }
   CONVERT_DOUBLE_CHECKED(f_number, args[1]);
   int f = FastD2I(f_number);
   RUNTIME_ASSERT(f >= 0);
   char* str = DoubleToFixedCString(value, f);
-  Object* res = Heap::AllocateStringFromAscii(CStrVector(str));
+  MaybeObject* result = Heap::AllocateStringFromAscii(CStrVector(str));
   DeleteArray(str);
-  return res;
+  return result;
 }
 
 
-static Object* Runtime_NumberToExponential(Arguments args) {
+static MaybeObject* Runtime_NumberToExponential(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(value, args[0]);
   if (isnan(value)) {
     return Heap::AllocateStringFromAscii(CStrVector("NaN"));
   }
   if (isinf(value)) {
     if (value < 0) {
       return Heap::AllocateStringFromAscii(CStrVector("-Infinity"));
     }
     return Heap::AllocateStringFromAscii(CStrVector("Infinity"));
   }
   CONVERT_DOUBLE_CHECKED(f_number, args[1]);
   int f = FastD2I(f_number);
   RUNTIME_ASSERT(f >= -1 && f <= 20);
   char* str = DoubleToExponentialCString(value, f);
-  Object* res = Heap::AllocateStringFromAscii(CStrVector(str));
+  MaybeObject* result = Heap::AllocateStringFromAscii(CStrVector(str));
   DeleteArray(str);
-  return res;
+  return result;
 }
 
 
-static Object* Runtime_NumberToPrecision(Arguments args) {
+static MaybeObject* Runtime_NumberToPrecision(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(value, args[0]);
   if (isnan(value)) {
     return Heap::AllocateStringFromAscii(CStrVector("NaN"));
   }
   if (isinf(value)) {
     if (value < 0) {
       return Heap::AllocateStringFromAscii(CStrVector("-Infinity"));
     }
     return Heap::AllocateStringFromAscii(CStrVector("Infinity"));
   }
   CONVERT_DOUBLE_CHECKED(f_number, args[1]);
   int f = FastD2I(f_number);
   RUNTIME_ASSERT(f >= 1 && f <= 21);
   char* str = DoubleToPrecisionCString(value, f);
-  Object* res = Heap::AllocateStringFromAscii(CStrVector(str));
+  MaybeObject* result = Heap::AllocateStringFromAscii(CStrVector(str));
   DeleteArray(str);
-  return res;
+  return result;
 }
 
 
 // Returns a single character string where first character equals
 // string->Get(index).
 static Handle<Object> GetCharAt(Handle<String> string, uint32_t index) {
   if (index < static_cast<uint32_t>(string->length())) {
     string->TryFlatten();
     return LookupSingleCharacterStringFromCode(
         string->Get(index));
   }
   return Execution::CharAt(string, index);
 }
 
 
-Object* Runtime::GetElementOrCharAt(Handle<Object> object, uint32_t index) {
+MaybeObject* Runtime::GetElementOrCharAt(Handle<Object> object,
+                                         uint32_t index) {
   // Handle [] indexing on Strings
   if (object->IsString()) {
     Handle<Object> result = GetCharAt(Handle<String>::cast(object), index);
     if (!result->IsUndefined()) return *result;
   }
 
   // Handle [] indexing on String objects
   if (object->IsStringObjectWithCharacterAt(index)) {
     Handle<JSValue> js_value = Handle<JSValue>::cast(object);
     Handle<Object> result =
         GetCharAt(Handle<String>(String::cast(js_value->value())), index);
     if (!result->IsUndefined()) return *result;
   }
 
   if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
     Handle<Object> prototype = GetPrototype(object);
     return prototype->GetElement(index);
   }
 
   return GetElement(object, index);
 }
 
 
-Object* Runtime::GetElement(Handle<Object> object, uint32_t index) {
+MaybeObject* Runtime::GetElement(Handle<Object> object, uint32_t index) {
   return object->GetElement(index);
 }
 
 
-Object* Runtime::GetObjectProperty(Handle<Object> object, Handle<Object> key) {
+MaybeObject* Runtime::GetObjectProperty(Handle<Object> object,
+                                        Handle<Object> key) {
   HandleScope scope;
 
   if (object->IsUndefined() || object->IsNull()) {
     Handle<Object> args[2] = { key, object };
     Handle<Object> error =
         Factory::NewTypeError("non_object_property_load",
                               HandleVector(args, 2));
     return Top::Throw(*error);
   }
 
@@ skipping 19 matching lines @@
   // the element if so.
   if (name->AsArrayIndex(&index)) {
     return GetElementOrCharAt(object, index);
   } else {
     PropertyAttributes attr;
     return object->GetProperty(*name, &attr);
   }
 }
 
 
-static Object* Runtime_GetProperty(Arguments args) {
+static MaybeObject* Runtime_GetProperty(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   Handle<Object> object = args.at<Object>(0);
   Handle<Object> key = args.at<Object>(1);
 
   return Runtime::GetObjectProperty(object, key);
 }
 
 
 // KeyedStringGetProperty is called from KeyedLoadIC::GenerateGeneric.
-static Object* Runtime_KeyedGetProperty(Arguments args) {
+static MaybeObject* Runtime_KeyedGetProperty(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   // Fast cases for getting named properties of the receiver JSObject
   // itself.
   //
   // The global proxy objects has to be excluded since LocalLookup on
   // the global proxy object can return a valid result even though the
   // global proxy object never has properties.  This is the case
   // because the global proxy object forwards everything to its hidden
@@ skipping 44 matching lines @@
     Handle<Object> result = GetCharAt(str, index);
     return *result;
   }
 
   // Fall back to GetObjectProperty.
   return Runtime::GetObjectProperty(args.at<Object>(0),
                                     args.at<Object>(1));
 }
 
 
-static Object* Runtime_DefineOrRedefineAccessorProperty(Arguments args) {
+static MaybeObject* Runtime_DefineOrRedefineAccessorProperty(Arguments args) {
   ASSERT(args.length() == 5);
   HandleScope scope;
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
   CONVERT_CHECKED(String, name, args[1]);
   CONVERT_CHECKED(Smi, flag_setter, args[2]);
   CONVERT_CHECKED(JSFunction, fun, args[3]);
   CONVERT_CHECKED(Smi, flag_attr, args[4]);
   int unchecked = flag_attr->value();
   RUNTIME_ASSERT((unchecked & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) == 0);
   RUNTIME_ASSERT(!obj->IsNull());
   LookupResult result;
   obj->LocalLookupRealNamedProperty(name, &result);
 
   PropertyAttributes attr = static_cast<PropertyAttributes>(unchecked);
   // If an existing property is either FIELD, NORMAL or CONSTANT_FUNCTION
   // delete it to avoid running into trouble in DefineAccessor, which
   // handles this incorrectly if the property is readonly (does nothing)
   if (result.IsProperty() &&
       (result.type() == FIELD || result.type() == NORMAL
        || result.type() == CONSTANT_FUNCTION)) {
-    Object* ok = obj->DeleteProperty(name, JSObject::NORMAL_DELETION);
-    if (ok->IsFailure()) return ok;
+    Object* ok;
+    { MaybeObject* maybe_ok =
+          obj->DeleteProperty(name, JSObject::NORMAL_DELETION);
+      if (!maybe_ok->ToObject(&ok)) return maybe_ok;
+    }
   }
   return obj->DefineAccessor(name, flag_setter->value() == 0, fun, attr);
 }
 
-static Object* Runtime_DefineOrRedefineDataProperty(Arguments args) {
+static MaybeObject* Runtime_DefineOrRedefineDataProperty(Arguments args) {
   ASSERT(args.length() == 4);
   HandleScope scope;
   CONVERT_ARG_CHECKED(JSObject, js_object, 0);
   CONVERT_ARG_CHECKED(String, name, 1);
   Handle<Object> obj_value = args.at<Object>(2);
 
   CONVERT_CHECKED(Smi, flag, args[3]);
   int unchecked = flag->value();
   RUNTIME_ASSERT((unchecked & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) == 0);
 
   PropertyAttributes attr = static_cast<PropertyAttributes>(unchecked);
 
   // Check if this is an element.
   uint32_t index;
   bool is_element = name->AsArrayIndex(&index);
 
   // Special case for elements if any of the flags are true.
   // If elements are in fast case we always implicitly assume that:
   // DONT_DELETE: false, DONT_ENUM: false, READ_ONLY: false.
   if (((unchecked & (DONT_DELETE | DONT_ENUM | READ_ONLY)) != 0) &&
       is_element) {
     // Normalize the elements to enable attributes on the property.
-    js_object->NormalizeElements();
-    NumberDictionary* dictionary = js_object->element_dictionary();
+    NormalizeElements(js_object);
+    Handle<NumberDictionary> dictionary(js_object->element_dictionary());
     // Make sure that we never go back to fast case.
     dictionary->set_requires_slow_elements();
     PropertyDetails details = PropertyDetails(attr, NORMAL);
-    dictionary->Set(index, *obj_value, details);
+    NumberDictionarySet(dictionary, index, obj_value, details);
   }
 
   LookupResult result;
   js_object->LocalLookupRealNamedProperty(*name, &result);
 
   // Take special care when attributes are different and there is already
   // a property. For simplicity we normalize the property which enables us
   // to not worry about changing the instance_descriptor and creating a new
   // map. The current version of SetObjectProperty does not handle attributes
   // correctly in the case where a property is a field and is reset with
   // new attributes.
   if (result.IsProperty() && attr != result.GetAttributes()) {
     // New attributes - normalize to avoid writing to instance descriptor
-    js_object->NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
+    NormalizeProperties(js_object, CLEAR_INOBJECT_PROPERTIES, 0);
     // Use IgnoreAttributes version since a readonly property may be
     // overridden and SetProperty does not allow this.
     return js_object->IgnoreAttributesAndSetLocalProperty(*name,
                                                           *obj_value,
                                                           attr);
   }
 
   return Runtime::SetObjectProperty(js_object, name, obj_value, attr);
 }
 
 
-Object* Runtime::SetObjectProperty(Handle<Object> object,
-                                   Handle<Object> key,
-                                   Handle<Object> value,
-                                   PropertyAttributes attr) {
+MaybeObject* Runtime::SetObjectProperty(Handle<Object> object,
+                                        Handle<Object> key,
+                                        Handle<Object> value,
+                                        PropertyAttributes attr) {
   HandleScope scope;
 
   if (object->IsUndefined() || object->IsNull()) {
     Handle<Object> args[2] = { key, object };
     Handle<Object> error =
         Factory::NewTypeError("non_object_property_store",
                               HandleVector(args, 2));
     return Top::Throw(*error);
   }
 
@@ skipping 41 matching lines @@
   Handle<String> name = Handle<String>::cast(converted);
 
   if (name->AsArrayIndex(&index)) {
     return js_object->SetElement(index, *value);
   } else {
     return js_object->SetProperty(*name, *value, attr);
   }
 }
 
 
-Object* Runtime::ForceSetObjectProperty(Handle<JSObject> js_object,
-                                        Handle<Object> key,
-                                        Handle<Object> value,
-                                        PropertyAttributes attr) {
+MaybeObject* Runtime::ForceSetObjectProperty(Handle<JSObject> js_object,
+                                             Handle<Object> key,
+                                             Handle<Object> value,
+                                             PropertyAttributes attr) {
   HandleScope scope;
 
   // Check if the given key is an array index.
   uint32_t index;
   if (key->ToArrayIndex(&index)) {
     // In Firefox/SpiderMonkey, Safari and Opera you can access the characters
     // of a string using [] notation.  We need to support this too in
     // JavaScript.
     // In the case of a String object we just need to redirect the assignment to
     // the underlying string if the index is in range.  Since the underlying
@@ skipping 25 matching lines @@
   Handle<String> name = Handle<String>::cast(converted);
 
   if (name->AsArrayIndex(&index)) {
     return js_object->SetElement(index, *value);
   } else {
     return js_object->IgnoreAttributesAndSetLocalProperty(*name, *value, attr);
   }
 }
 
 
-Object* Runtime::ForceDeleteObjectProperty(Handle<JSObject> js_object,
-                                           Handle<Object> key) {
+MaybeObject* Runtime::ForceDeleteObjectProperty(Handle<JSObject> js_object,
+                                                Handle<Object> key) {
   HandleScope scope;
 
   // Check if the given key is an array index.
   uint32_t index;
   if (key->ToArrayIndex(&index)) {
     // In Firefox/SpiderMonkey, Safari and Opera you can access the
     // characters of a string using [] notation.  In the case of a
     // String object we just need to redirect the deletion to the
     // underlying string if the index is in range.  Since the
     // underlying string does nothing with the deletion, we can ignore
@@ skipping 14 matching lines @@
     Handle<Object> converted = Execution::ToString(key, &has_pending_exception);
     if (has_pending_exception) return Failure::Exception();
     key_string = Handle<String>::cast(converted);
   }
 
   key_string->TryFlatten();
   return js_object->DeleteProperty(*key_string, JSObject::FORCE_DELETION);
 }
 
 
-static Object* Runtime_SetProperty(Arguments args) {
+static MaybeObject* Runtime_SetProperty(Arguments args) {
   NoHandleAllocation ha;
   RUNTIME_ASSERT(args.length() == 3 || args.length() == 4);
 
   Handle<Object> object = args.at<Object>(0);
   Handle<Object> key = args.at<Object>(1);
   Handle<Object> value = args.at<Object>(2);
 
   // Compute attributes.
   PropertyAttributes attributes = NONE;
   if (args.length() == 4) {
     CONVERT_CHECKED(Smi, value_obj, args[3]);
     int unchecked_value = value_obj->value();
     // Only attribute bits should be set.
     RUNTIME_ASSERT(
         (unchecked_value & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) == 0);
     attributes = static_cast<PropertyAttributes>(unchecked_value);
   }
   return Runtime::SetObjectProperty(object, key, value, attributes);
 }
 
 
 // Set a local property, even if it is READ_ONLY.  If the property does not
 // exist, it will be added with attributes NONE.
-static Object* Runtime_IgnoreAttributesAndSetProperty(Arguments args) {
+static MaybeObject* Runtime_IgnoreAttributesAndSetProperty(Arguments args) {
   NoHandleAllocation ha;
   RUNTIME_ASSERT(args.length() == 3 || args.length() == 4);
   CONVERT_CHECKED(JSObject, object, args[0]);
   CONVERT_CHECKED(String, name, args[1]);
   // Compute attributes.
   PropertyAttributes attributes = NONE;
   if (args.length() == 4) {
     CONVERT_CHECKED(Smi, value_obj, args[3]);
     int unchecked_value = value_obj->value();
     // Only attribute bits should be set.
     RUNTIME_ASSERT(
         (unchecked_value & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) == 0);
     attributes = static_cast<PropertyAttributes>(unchecked_value);
   }
 
   return object->
       IgnoreAttributesAndSetLocalProperty(name, args[2], attributes);
 }
 
 
-static Object* Runtime_DeleteProperty(Arguments args) {
+static MaybeObject* Runtime_DeleteProperty(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(JSObject, object, args[0]);
   CONVERT_CHECKED(String, key, args[1]);
   return object->DeleteProperty(key, JSObject::NORMAL_DELETION);
 }
 
 
 static Object* HasLocalPropertyImplementation(Handle<JSObject> object,
                                               Handle<String> key) {
   if (object->HasLocalProperty(*key)) return Heap::true_value();
   // Handle hidden prototypes.  If there's a hidden prototype above this thing
   // then we have to check it for properties, because they are supposed to
   // look like they are on this object.
   Handle<Object> proto(object->GetPrototype());
   if (proto->IsJSObject() &&
       Handle<JSObject>::cast(proto)->map()->is_hidden_prototype()) {
     return HasLocalPropertyImplementation(Handle<JSObject>::cast(proto), key);
   }
   return Heap::false_value();
 }
 
 
-static Object* Runtime_HasLocalProperty(Arguments args) {
+static MaybeObject* Runtime_HasLocalProperty(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(String, key, args[1]);
 
   Object* obj = args[0];
   // Only JS objects can have properties.
   if (obj->IsJSObject()) {
     JSObject* object = JSObject::cast(obj);
     // Fast case - no interceptors.
     if (object->HasRealNamedProperty(key)) return Heap::true_value();
     // Slow case.  Either it's not there or we have an interceptor.  We should
     // have handles for this kind of deal.
     HandleScope scope;
     return HasLocalPropertyImplementation(Handle<JSObject>(object),
                                           Handle<String>(key));
   } else if (obj->IsString()) {
     // Well, there is one exception:  Handle [] on strings.
     uint32_t index;
     if (key->AsArrayIndex(&index)) {
       String* string = String::cast(obj);
       if (index < static_cast<uint32_t>(string->length()))
         return Heap::true_value();
     }
   }
   return Heap::false_value();
 }
 
 
-static Object* Runtime_HasProperty(Arguments args) {
+static MaybeObject* Runtime_HasProperty(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 2);
 
   // Only JS objects can have properties.
   if (args[0]->IsJSObject()) {
     JSObject* object = JSObject::cast(args[0]);
     CONVERT_CHECKED(String, key, args[1]);
     if (object->HasProperty(key)) return Heap::true_value();
   }
   return Heap::false_value();
 }
 
 
-static Object* Runtime_HasElement(Arguments args) {
+static MaybeObject* Runtime_HasElement(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 2);
 
   // Only JS objects can have elements.
   if (args[0]->IsJSObject()) {
     JSObject* object = JSObject::cast(args[0]);
     CONVERT_CHECKED(Smi, index_obj, args[1]);
     uint32_t index = index_obj->value();
     if (object->HasElement(index)) return Heap::true_value();
   }
   return Heap::false_value();
 }
 
 
-static Object* Runtime_IsPropertyEnumerable(Arguments args) {
+static MaybeObject* Runtime_IsPropertyEnumerable(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(JSObject, object, args[0]);
   CONVERT_CHECKED(String, key, args[1]);
 
   uint32_t index;
   if (key->AsArrayIndex(&index)) {
     return Heap::ToBoolean(object->HasElement(index));
   }
 
   PropertyAttributes att = object->GetLocalPropertyAttribute(key);
   return Heap::ToBoolean(att != ABSENT && (att & DONT_ENUM) == 0);
 }
 
 
-static Object* Runtime_GetPropertyNames(Arguments args) {
+static MaybeObject* Runtime_GetPropertyNames(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   CONVERT_ARG_CHECKED(JSObject, object, 0);
   return *GetKeysFor(object);
 }
 
 
 // Returns either a FixedArray as Runtime_GetPropertyNames,
 // or, if the given object has an enum cache that contains
 // all enumerable properties of the object and its prototypes
 // have none, the map of the object. This is used to speed up
 // the check for deletions during a for-in.
-static Object* Runtime_GetPropertyNamesFast(Arguments args) {
+static MaybeObject* Runtime_GetPropertyNamesFast(Arguments args) {
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSObject, raw_object, args[0]);
 
   if (raw_object->IsSimpleEnum()) return raw_object->map();
 
   HandleScope scope;
   Handle<JSObject> object(raw_object);
   Handle<FixedArray> content = GetKeysInFixedArrayFor(object,
                                                       INCLUDE_PROTOS);
@@ skipping 15 matching lines @@
          JSObject::cast(proto)->map()->is_hidden_prototype()) {
     count++;
     proto = JSObject::cast(proto)->GetPrototype();
   }
   return count;
 }
 
 
 // Return the names of the local named properties.
 // args[0]: object
-static Object* Runtime_GetLocalPropertyNames(Arguments args) {
+static MaybeObject* Runtime_GetLocalPropertyNames(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   if (!args[0]->IsJSObject()) {
     return Heap::undefined_value();
   }
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
 
   // Skip the global proxy as it has no properties and always delegates to the
   // real global object.
   if (obj->IsJSGlobalProxy()) {
@@ skipping 62 matching lines @@
       names->set(dest_pos++, name);
     }
   }
 
   return *Factory::NewJSArrayWithElements(names);
 }
 
 
 // Return the names of the local indexed properties.
 // args[0]: object
-static Object* Runtime_GetLocalElementNames(Arguments args) {
+static MaybeObject* Runtime_GetLocalElementNames(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   if (!args[0]->IsJSObject()) {
     return Heap::undefined_value();
   }
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
 
   int n = obj->NumberOfLocalElements(static_cast<PropertyAttributes>(NONE));
   Handle<FixedArray> names = Factory::NewFixedArray(n);
   obj->GetLocalElementKeys(*names, static_cast<PropertyAttributes>(NONE));
   return *Factory::NewJSArrayWithElements(names);
 }
 
 
 // Return information on whether an object has a named or indexed interceptor.
 // args[0]: object
-static Object* Runtime_GetInterceptorInfo(Arguments args) {
+static MaybeObject* Runtime_GetInterceptorInfo(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   if (!args[0]->IsJSObject()) {
     return Smi::FromInt(0);
   }
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
 
   int result = 0;
   if (obj->HasNamedInterceptor()) result |= 2;
   if (obj->HasIndexedInterceptor()) result |= 1;
 
   return Smi::FromInt(result);
 }
 
 
 // Return property names from named interceptor.
 // args[0]: object
-static Object* Runtime_GetNamedInterceptorPropertyNames(Arguments args) {
+static MaybeObject* Runtime_GetNamedInterceptorPropertyNames(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
 
   if (obj->HasNamedInterceptor()) {
     v8::Handle<v8::Array> result = GetKeysForNamedInterceptor(obj, obj);
     if (!result.IsEmpty()) return *v8::Utils::OpenHandle(*result);
   }
   return Heap::undefined_value();
 }
 
 
 // Return element names from indexed interceptor.
 // args[0]: object
-static Object* Runtime_GetIndexedInterceptorElementNames(Arguments args) {
+static MaybeObject* Runtime_GetIndexedInterceptorElementNames(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
 
   if (obj->HasIndexedInterceptor()) {
     v8::Handle<v8::Array> result = GetKeysForIndexedInterceptor(obj, obj);
     if (!result.IsEmpty()) return *v8::Utils::OpenHandle(*result);
   }
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_LocalKeys(Arguments args) {
+static MaybeObject* Runtime_LocalKeys(Arguments args) {
   ASSERT_EQ(args.length(), 1);
   CONVERT_CHECKED(JSObject, raw_object, args[0]);
   HandleScope scope;
   Handle<JSObject> object(raw_object);
   Handle<FixedArray> contents = GetKeysInFixedArrayFor(object,
                                                        LOCAL_ONLY);
   // Some fast paths through GetKeysInFixedArrayFor reuse a cached
   // property array and since the result is mutable we have to create
   // a fresh clone on each invocation.
   int length = contents->length();
   Handle<FixedArray> copy = Factory::NewFixedArray(length);
   for (int i = 0; i < length; i++) {
     Object* entry = contents->get(i);
     if (entry->IsString()) {
       copy->set(i, entry);
     } else {
       ASSERT(entry->IsNumber());
       HandleScope scope;
       Handle<Object> entry_handle(entry);
       Handle<Object> entry_str = Factory::NumberToString(entry_handle);
       copy->set(i, *entry_str);
     }
   }
   return *Factory::NewJSArrayWithElements(copy);
 }
 
 
-static Object* Runtime_GetArgumentsProperty(Arguments args) {
+static MaybeObject* Runtime_GetArgumentsProperty(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   // Compute the frame holding the arguments.
   JavaScriptFrameIterator it;
   it.AdvanceToArgumentsFrame();
   JavaScriptFrame* frame = it.frame();
 
   // Get the actual number of provided arguments.
   const uint32_t n = frame->GetProvidedParametersCount();
@@ skipping 24 matching lines @@
 
   // Handle special arguments properties.
   if (key->Equals(Heap::length_symbol())) return Smi::FromInt(n);
   if (key->Equals(Heap::callee_symbol())) return frame->function();
 
   // Lookup in the initial Object.prototype object.
   return Top::initial_object_prototype()->GetProperty(*key);
 }
 
 
-static Object* Runtime_ToFastProperties(Arguments args) {
+static MaybeObject* Runtime_ToFastProperties(Arguments args) {
   HandleScope scope;
 
   ASSERT(args.length() == 1);
   Handle<Object> object = args.at<Object>(0);
   if (object->IsJSObject()) {
     Handle<JSObject> js_object = Handle<JSObject>::cast(object);
     if (!js_object->HasFastProperties() && !js_object->IsGlobalObject()) {
-      js_object->TransformToFastProperties(0);
+      MaybeObject* ok = js_object->TransformToFastProperties(0);
+      if (ok->IsRetryAfterGC()) return ok;
     }
   }
   return *object;
 }
 
 
-static Object* Runtime_ToSlowProperties(Arguments args) {
+static MaybeObject* Runtime_ToSlowProperties(Arguments args) {
   HandleScope scope;
 
   ASSERT(args.length() == 1);
   Handle<Object> object = args.at<Object>(0);
   if (object->IsJSObject()) {
     Handle<JSObject> js_object = Handle<JSObject>::cast(object);
-    js_object->NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
+    NormalizeProperties(js_object, CLEAR_INOBJECT_PROPERTIES, 0);
   }
   return *object;
 }
 
 
-static Object* Runtime_ToBool(Arguments args) {
+static MaybeObject* Runtime_ToBool(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   return args[0]->ToBoolean();
 }
 
 
 // Returns the type string of a value; see ECMA-262, 11.4.3 (p 47).
 // Possible optimizations: put the type string into the oddballs.
-static Object* Runtime_Typeof(Arguments args) {
+static MaybeObject* Runtime_Typeof(Arguments args) {
   NoHandleAllocation ha;
 
   Object* obj = args[0];
   if (obj->IsNumber()) return Heap::number_symbol();
   HeapObject* heap_obj = HeapObject::cast(obj);
 
   // typeof an undetectable object is 'undefined'
   if (heap_obj->map()->is_undetectable()) return Heap::undefined_symbol();
 
   InstanceType instance_type = heap_obj->map()->instance_type();
@@ skipping 36 matching lines @@
   int d = s[from] - '0';
 
   for (int i = from + 1; i < to; i++) {
     d = 10 * d + (s[i] - '0');
   }
 
   return d;
 }
 
 
-static Object* Runtime_StringToNumber(Arguments args) {
+static MaybeObject* Runtime_StringToNumber(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(String, subject, args[0]);
   subject->TryFlatten();
 
   // Fast case: short integer or some sorts of junk values.
   int len = subject->length();
   if (subject->IsSeqAsciiString()) {
     if (len == 0) return Smi::FromInt(0);
 
@@ skipping 33 matching lines @@
       }
       return Smi::FromInt(d);
     }
   }
 
   // Slower case.
   return Heap::NumberFromDouble(StringToDouble(subject, ALLOW_HEX));
 }
 
 
-static Object* Runtime_StringFromCharCodeArray(Arguments args) {
+static MaybeObject* Runtime_StringFromCharCodeArray(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSArray, codes, args[0]);
   int length = Smi::cast(codes->length())->value();
 
   // Check if the string can be ASCII.
   int i;
   for (i = 0; i < length; i++) {
-    Object* element = codes->GetElement(i);
+    Object* element;
+    { MaybeObject* maybe_element = codes->GetElement(i);
+      // We probably can't get an exception here, but just in order to enforce
+      // the checking of inputs in the runtime calls we check here.
+      if (!maybe_element->ToObject(&element)) return maybe_element;
+    }
     CONVERT_NUMBER_CHECKED(int, chr, Int32, element);
     if ((chr & 0xffff) > String::kMaxAsciiCharCode)
       break;
   }
 
-  Object* object = NULL;
+  MaybeObject* maybe_object = NULL;
   if (i == length) {  // The string is ASCII.
-    object = Heap::AllocateRawAsciiString(length);
+    maybe_object = Heap::AllocateRawAsciiString(length);
   } else {  // The string is not ASCII.
-    object = Heap::AllocateRawTwoByteString(length);
+    maybe_object = Heap::AllocateRawTwoByteString(length);
   }
 
-  if (object->IsFailure()) return object;
+  Object* object = NULL;
+  if (!maybe_object->ToObject(&object)) return maybe_object;
   String* result = String::cast(object);
   for (int i = 0; i < length; i++) {
-    Object* element = codes->GetElement(i);
+    Object* element;
+    { MaybeObject* maybe_element = codes->GetElement(i);
+      if (!maybe_element->ToObject(&element)) return maybe_element;
+    }
     CONVERT_NUMBER_CHECKED(int, chr, Int32, element);
     result->Set(i, chr & 0xffff);
   }
   return result;
 }
 
 
 // kNotEscaped is generated by the following:
 //
 // #!/bin/perl
@@ skipping 24 matching lines @@
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
   };
   return kNotEscaped[character] != 0;
 }
 
 
-static Object* Runtime_URIEscape(Arguments args) {
+static MaybeObject* Runtime_URIEscape(Arguments args) {
   const char hex_chars[] = "0123456789ABCDEF";
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(String, source, args[0]);
 
   source->TryFlatten();
 
   int escaped_length = 0;
   int length = source->length();
   {
@@ skipping 13 matching lines @@
       if (escaped_length > String::kMaxLength) {
         Top::context()->mark_out_of_memory();
         return Failure::OutOfMemoryException();
       }
     }
   }
   // No length change implies no change.  Return original string if no change.
   if (escaped_length == length) {
     return source;
   }
-  Object* o = Heap::AllocateRawAsciiString(escaped_length);
-  if (o->IsFailure()) return o;
+  Object* o;
+  { MaybeObject* maybe_o = Heap::AllocateRawAsciiString(escaped_length);
+    if (!maybe_o->ToObject(&o)) return maybe_o;
+  }
   String* destination = String::cast(o);
   int dest_position = 0;
 
   Access<StringInputBuffer> buffer(&runtime_string_input_buffer);
   buffer->Rewind();
   while (buffer->has_more()) {
     uint16_t chr = buffer->GetNext();
     if (chr >= 256) {
       destination->Set(dest_position, '%');
       destination->Set(dest_position+1, 'u');
@@ skipping 58 matching lines @@
                         source->Get(i + 2))) != -1) {
     *step = 3;
     return lo;
   } else {
     *step = 1;
     return character;
   }
 }
 
 
-static Object* Runtime_URIUnescape(Arguments args) {
+static MaybeObject* Runtime_URIUnescape(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(String, source, args[0]);
 
   source->TryFlatten();
 
   bool ascii = true;
   int length = source->length();
 
   int unescaped_length = 0;
   for (int i = 0; i < length; unescaped_length++) {
     int step;
     if (Unescape(source, i, length, &step) > String::kMaxAsciiCharCode) {
       ascii = false;
     }
     i += step;
   }
 
   // No length change implies no change.  Return original string if no change.
   if (unescaped_length == length)
     return source;
 
-  Object* o = ascii ?
-              Heap::AllocateRawAsciiString(unescaped_length) :
-              Heap::AllocateRawTwoByteString(unescaped_length);
-  if (o->IsFailure()) return o;
+  Object* o;
+  { MaybeObject* maybe_o = ascii ?
+                           Heap::AllocateRawAsciiString(unescaped_length) :
+                           Heap::AllocateRawTwoByteString(unescaped_length);
+    if (!maybe_o->ToObject(&o)) return maybe_o;
+  }
   String* destination = String::cast(o);
 
   int dest_position = 0;
   for (int i = 0; i < length; dest_position++) {
     int step;
     destination->Set(dest_position, Unescape(source, i, length, &step));
     i += step;
   }
   return destination;
 }
 
 
-static Object* Runtime_StringParseInt(Arguments args) {
+static MaybeObject* Runtime_StringParseInt(Arguments args) {
   NoHandleAllocation ha;
 
   CONVERT_CHECKED(String, s, args[0]);
   CONVERT_SMI_CHECKED(radix, args[1]);
 
   s->TryFlatten();
 
   RUNTIME_ASSERT(radix == 0 || (2 <= radix && radix <= 36));
   double value = StringToInt(s, radix);
   return Heap::NumberFromDouble(value);
 }
 
 
-static Object* Runtime_StringParseFloat(Arguments args) {
+static MaybeObject* Runtime_StringParseFloat(Arguments args) {
   NoHandleAllocation ha;
   CONVERT_CHECKED(String, str, args[0]);
 
   // ECMA-262 section 15.1.2.3, empty string is NaN
   double value = StringToDouble(str, ALLOW_TRAILING_JUNK, OS::nan_value());
 
   // Create a number object from the value.
   return Heap::NumberFromDouble(value);
 }
 
 
 static unibrow::Mapping<unibrow::ToUppercase, 128> to_upper_mapping;
 static unibrow::Mapping<unibrow::ToLowercase, 128> to_lower_mapping;
 
 
 template <class Converter>
-static Object* ConvertCaseHelper(String* s,
-                                 int length,
-                                 int input_string_length,
-                                 unibrow::Mapping<Converter, 128>* mapping) {
+MUST_USE_RESULT static MaybeObject* ConvertCaseHelper(
+    String* s,
+    int length,
+    int input_string_length,
+    unibrow::Mapping<Converter, 128>* mapping) {
   // We try this twice, once with the assumption that the result is no longer
   // than the input and, if that assumption breaks, again with the exact
   // length.  This may not be pretty, but it is nicer than what was here before
   // and I hereby claim my vaffel-is.
   //
   // Allocate the resulting string.
   //
   // NOTE: This assumes that the upper/lower case of an ascii
   // character is also ascii.  This is currently the case, but it
   // might break in the future if we implement more context and locale
   // dependent upper/lower conversions.
-  Object* o = s->IsAsciiRepresentation()
-      ? Heap::AllocateRawAsciiString(length)
-      : Heap::AllocateRawTwoByteString(length);
-  if (o->IsFailure()) return o;
+  Object* o;
+  { MaybeObject* maybe_o = s->IsAsciiRepresentation()
+                   ? Heap::AllocateRawAsciiString(length)
+                   : Heap::AllocateRawTwoByteString(length);
+    if (!maybe_o->ToObject(&o)) return maybe_o;
+  }
   String* result = String::cast(o);
   bool has_changed_character = false;
 
   // Convert all characters to upper case, assuming that they will fit
   // in the buffer
   Access<StringInputBuffer> buffer(&runtime_string_input_buffer);
   buffer->Reset(s);
   unibrow::uchar chars[Converter::kMaxWidth];
   // We can assume that the string is not empty
   uc32 current = buffer->GetNext();
@@ skipping 61 matching lines @@
     // we simple return the result and let the converted string
     // become garbage; there is no reason to keep two identical strings
     // alive.
     return s;
   }
 }
 
 
 namespace {
 
+static const uintptr_t kOneInEveryByte = kUintptrAllBitsSet / 0xFF;
+
+
+// Given a word and two range boundaries returns a word with high bit
+// set in every byte iff the corresponding input byte was strictly in
+// the range (m, n). All the other bits in the result are cleared.
+// This function is only useful when it can be inlined and the
+// boundaries are statically known.
+// Requires: all bytes in the input word and the boundaries must be
+// ascii (less than 0x7F).
+static inline uintptr_t AsciiRangeMask(uintptr_t w, char m, char n) {
+  // Every byte in an ascii string is less than or equal to 0x7F.
+  ASSERT((w & (kOneInEveryByte * 0x7F)) == w);
+  // Use strict inequalities since in edge cases the function could be
+  // further simplified.
+  ASSERT(0 < m && m < n && n < 0x7F);
+  // Has high bit set in every w byte less than n.
+  uintptr_t tmp1 = kOneInEveryByte * (0x7F + n) - w;
+  // Has high bit set in every w byte greater than m.
+  uintptr_t tmp2 = w + kOneInEveryByte * (0x7F - m);
+  return (tmp1 & tmp2 & (kOneInEveryByte * 0x80));
+}
+
+
+enum AsciiCaseConversion {
+  ASCII_TO_LOWER,
+  ASCII_TO_UPPER
+};
+
+
+template <AsciiCaseConversion dir>
+struct FastAsciiConverter {
+  static bool Convert(char* dst, char* src, int length) {
+#ifdef DEBUG
+    char* saved_dst = dst;
+    char* saved_src = src;
+#endif
+    // We rely on the distance between upper and lower case letters
+    // being a known power of 2.
+    ASSERT('a' - 'A' == (1 << 5));
+    // Boundaries for the range of input characters than require conversion.
+    const char lo = (dir == ASCII_TO_LOWER) ? 'A' - 1 : 'a' - 1;
+    const char hi = (dir == ASCII_TO_LOWER) ? 'Z' + 1 : 'z' + 1;
+    bool changed = false;
+    char* const limit = src + length;
+#ifdef V8_HOST_CAN_READ_UNALIGNED
+    // Process the prefix of the input that requires no conversion one
+    // (machine) word at a time.
+    while (src <= limit - sizeof(uintptr_t)) {
+      uintptr_t w = *reinterpret_cast<uintptr_t*>(src);
+      if (AsciiRangeMask(w, lo, hi) != 0) {
+        changed = true;
+        break;
+      }
+      *reinterpret_cast<uintptr_t*>(dst) = w;
+      src += sizeof(uintptr_t);
+      dst += sizeof(uintptr_t);
+    }
+    // Process the remainder of the input performing conversion when
+    // required one word at a time.
+    while (src <= limit - sizeof(uintptr_t)) {
+      uintptr_t w = *reinterpret_cast<uintptr_t*>(src);
+      uintptr_t m = AsciiRangeMask(w, lo, hi);
+      // The mask has high (7th) bit set in every byte that needs
+      // conversion and we know that the distance between cases is
+      // 1 << 5.
+      *reinterpret_cast<uintptr_t*>(dst) = w ^ (m >> 2);
+      src += sizeof(uintptr_t);
+      dst += sizeof(uintptr_t);
+    }
+#endif
+    // Process the last few bytes of the input (or the whole input if
+    // unaligned access is not supported).
+    while (src < limit) {
+      char c = *src;
+      if (lo < c && c < hi) {
+        c ^= (1 << 5);
+        changed = true;
+      }
+      *dst = c;
+      ++src;
+      ++dst;
+    }
+#ifdef DEBUG
+    CheckConvert(saved_dst, saved_src, length, changed);
+#endif
+    return changed;
+  }
+
+#ifdef DEBUG
+  static void CheckConvert(char* dst, char* src, int length, bool changed) {
+    bool expected_changed = false;
+    for (int i = 0; i < length; i++) {
+      if (dst[i] == src[i]) continue;
+      expected_changed = true;
+      if (dir == ASCII_TO_LOWER) {
+        ASSERT('A' <= src[i] && src[i] <= 'Z');
+        ASSERT(dst[i] == src[i] + ('a' - 'A'));
+      } else {
+        ASSERT(dir == ASCII_TO_UPPER);
+        ASSERT('a' <= src[i] && src[i] <= 'z');
+        ASSERT(dst[i] == src[i] - ('a' - 'A'));
+      }
+    }
+    ASSERT(expected_changed == changed);
+  }
+#endif
+};
+
+
 struct ToLowerTraits {
   typedef unibrow::ToLowercase UnibrowConverter;
 
-  static bool ConvertAscii(char* dst, char* src, int length) {
-    bool changed = false;
-    for (int i = 0; i < length; ++i) {
-      char c = src[i];
-      if ('A' <= c && c <= 'Z') {
-        c += ('a' - 'A');
-        changed = true;
-      }
-      dst[i] = c;
-    }
-    return changed;
-  }
+  typedef FastAsciiConverter<ASCII_TO_LOWER> AsciiConverter;
 };
 
 
 struct ToUpperTraits {
   typedef unibrow::ToUppercase UnibrowConverter;
 
-  static bool ConvertAscii(char* dst, char* src, int length) {
-    bool changed = false;
-    for (int i = 0; i < length; ++i) {
-      char c = src[i];
-      if ('a' <= c && c <= 'z') {
-        c -= ('a' - 'A');
-        changed = true;
-      }
-      dst[i] = c;
-    }
-    return changed;
-  }
+  typedef FastAsciiConverter<ASCII_TO_UPPER> AsciiConverter;
 };
 
 }  // namespace
 
 
 template <typename ConvertTraits>
-static Object* ConvertCase(
+MUST_USE_RESULT static MaybeObject* ConvertCase(
     Arguments args,
     unibrow::Mapping<typename ConvertTraits::UnibrowConverter, 128>* mapping) {
   NoHandleAllocation ha;
   CONVERT_CHECKED(String, s, args[0]);
   s = s->TryFlattenGetString();
 
   const int length = s->length();
   // Assume that the string is not empty; we need this assumption later
   if (length == 0) return s;
 
   // Simpler handling of ascii strings.
   //
   // NOTE: This assumes that the upper/lower case of an ascii
   // character is also ascii.  This is currently the case, but it
   // might break in the future if we implement more context and locale
   // dependent upper/lower conversions.
   if (s->IsSeqAsciiString()) {
-    Object* o = Heap::AllocateRawAsciiString(length);
-    if (o->IsFailure()) return o;
+    Object* o;
+    { MaybeObject* maybe_o = Heap::AllocateRawAsciiString(length);
+      if (!maybe_o->ToObject(&o)) return maybe_o;
+    }
     SeqAsciiString* result = SeqAsciiString::cast(o);
-    bool has_changed_character = ConvertTraits::ConvertAscii(
+    bool has_changed_character = ConvertTraits::AsciiConverter::Convert(
         result->GetChars(), SeqAsciiString::cast(s)->GetChars(), length);
     return has_changed_character ? result : s;
   }
 
-  Object* answer = ConvertCaseHelper(s, length, length, mapping);
+  Object* answer;
+  { MaybeObject* maybe_answer = ConvertCaseHelper(s, length, length, mapping);
+    if (!maybe_answer->ToObject(&answer)) return maybe_answer;
+  }
   if (answer->IsSmi()) {
     // Retry with correct length.
-    answer = ConvertCaseHelper(s, Smi::cast(answer)->value(), length, mapping);
+    { MaybeObject* maybe_answer =
+          ConvertCaseHelper(s, Smi::cast(answer)->value(), length, mapping);
+      if (!maybe_answer->ToObject(&answer)) return maybe_answer;
+    }
   }
-  return answer;  // This may be a failure.
+  return answer;
 }
 
 
-static Object* Runtime_StringToLowerCase(Arguments args) {
+static MaybeObject* Runtime_StringToLowerCase(Arguments args) {
   return ConvertCase<ToLowerTraits>(args, &to_lower_mapping);
 }
 
 
-static Object* Runtime_StringToUpperCase(Arguments args) {
+static MaybeObject* Runtime_StringToUpperCase(Arguments args) {
   return ConvertCase<ToUpperTraits>(args, &to_upper_mapping);
 }
 
 
 static inline bool IsTrimWhiteSpace(unibrow::uchar c) {
   return unibrow::WhiteSpace::Is(c) || c == 0x200b;
 }
 
 
-static Object* Runtime_StringTrim(Arguments args) {
+static MaybeObject* Runtime_StringTrim(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 3);
 
   CONVERT_CHECKED(String, s, args[0]);
   CONVERT_BOOLEAN_CHECKED(trimLeft, args[1]);
   CONVERT_BOOLEAN_CHECKED(trimRight, args[2]);
 
   s->TryFlatten();
   int length = s->length();
 
@@ skipping 28 matching lines @@
   while (limit > 0) {
     index = search.Search(subject, index);
     if (index < 0) return;
     indices->Add(index);
     index += pattern_length;
     limit--;
   }
 }
 
 
-static Object* Runtime_StringSplit(Arguments args) {
+static MaybeObject* Runtime_StringSplit(Arguments args) {
   ASSERT(args.length() == 3);
   HandleScope handle_scope;
   CONVERT_ARG_CHECKED(String, subject, 0);
   CONVERT_ARG_CHECKED(String, pattern, 1);
   CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[2]);
 
   int subject_length = subject->length();
   int pattern_length = pattern->length();
   RUNTIME_ASSERT(pattern_length > 0);
 
@@ skipping 105 matching lines @@
     ASSERT(element == Smi::FromInt(0) ||
            (element->IsString() && String::cast(element)->LooksValid()));
   }
 #endif
   return i;
 }
 
 
 // Converts a String to JSArray.
 // For example, "foo" => ["f", "o", "o"].
-static Object* Runtime_StringToArray(Arguments args) {
+static MaybeObject* Runtime_StringToArray(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   CONVERT_ARG_CHECKED(String, s, 0);
 
   s->TryFlatten();
   const int length = s->length();
 
   Handle<FixedArray> elements;
   if (s->IsFlat() && s->IsAsciiRepresentation()) {
-    Object* obj = Heap::AllocateUninitializedFixedArray(length);
-    if (obj->IsFailure()) return obj;
+    Object* obj;
+    { MaybeObject* maybe_obj = Heap::AllocateUninitializedFixedArray(length);
+      if (!maybe_obj->ToObject(&obj)) return maybe_obj;
+    }
     elements = Handle<FixedArray>(FixedArray::cast(obj));
 
     Vector<const char> chars = s->ToAsciiVector();
     // Note, this will initialize all elements (not only the prefix)
     // to prevent GC from seeing partially initialized array.
     int num_copied_from_cache = CopyCachedAsciiCharsToArray(chars.start(),
                                                             *elements,
                                                             length);
 
     for (int i = num_copied_from_cache; i < length; ++i) {
@@ skipping 11 matching lines @@
 #ifdef DEBUG
   for (int i = 0; i < length; ++i) {
     ASSERT(String::cast(elements->get(i))->length() == 1);
   }
 #endif
 
   return *Factory::NewJSArrayWithElements(elements);
 }
 
 
-static Object* Runtime_NewStringWrapper(Arguments args) {
+static MaybeObject* Runtime_NewStringWrapper(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(String, value, args[0]);
   return value->ToObject();
 }
 
 
 bool Runtime::IsUpperCaseChar(uint16_t ch) {
   unibrow::uchar chars[unibrow::ToUppercase::kMaxWidth];
   int char_length = to_upper_mapping.get(ch, 0, chars);
   return char_length == 0;
 }
 
 
-static Object* Runtime_NumberToString(Arguments args) {
+static MaybeObject* Runtime_NumberToString(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   Object* number = args[0];
   RUNTIME_ASSERT(number->IsNumber());
 
   return Heap::NumberToString(number);
 }
 
 
-static Object* Runtime_NumberToStringSkipCache(Arguments args) {
+static MaybeObject* Runtime_NumberToStringSkipCache(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   Object* number = args[0];
   RUNTIME_ASSERT(number->IsNumber());
 
   return Heap::NumberToString(number, false);
 }
 
 
-static Object* Runtime_NumberToInteger(Arguments args) {
+static MaybeObject* Runtime_NumberToInteger(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_DOUBLE_CHECKED(number, args[0]);
 
   // We do not include 0 so that we don't have to treat +0 / -0 cases.
   if (number > 0 && number <= Smi::kMaxValue) {
     return Smi::FromInt(static_cast<int>(number));
   }
   return Heap::NumberFromDouble(DoubleToInteger(number));
 }
 
 
-static Object* Runtime_NumberToIntegerMapMinusZero(Arguments args) {
+static MaybeObject* Runtime_NumberToIntegerMapMinusZero(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_DOUBLE_CHECKED(number, args[0]);
 
   // We do not include 0 so that we don't have to treat +0 / -0 cases.
   if (number > 0 && number <= Smi::kMaxValue) {
     return Smi::FromInt(static_cast<int>(number));
   }
 
   double double_value = DoubleToInteger(number);
   // Map both -0 and +0 to +0.
   if (double_value == 0) double_value = 0;
 
   return Heap::NumberFromDouble(double_value);
 }
 
 
-static Object* Runtime_NumberToJSUint32(Arguments args) {
+static MaybeObject* Runtime_NumberToJSUint32(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_NUMBER_CHECKED(int32_t, number, Uint32, args[0]);
   return Heap::NumberFromUint32(number);
 }
 
 
-static Object* Runtime_NumberToJSInt32(Arguments args) {
+static MaybeObject* Runtime_NumberToJSInt32(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_DOUBLE_CHECKED(number, args[0]);
 
   // We do not include 0 so that we don't have to treat +0 / -0 cases.
   if (number > 0 && number <= Smi::kMaxValue) {
     return Smi::FromInt(static_cast<int>(number));
   }
   return Heap::NumberFromInt32(DoubleToInt32(number));
 }
 
 
 // Converts a Number to a Smi, if possible. Returns NaN if the number is not
 // a small integer.
-static Object* Runtime_NumberToSmi(Arguments args) {
+static MaybeObject* Runtime_NumberToSmi(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   Object* obj = args[0];
   if (obj->IsSmi()) {
     return obj;
   }
   if (obj->IsHeapNumber()) {
     double value = HeapNumber::cast(obj)->value();
     int int_value = FastD2I(value);
     if (value == FastI2D(int_value) && Smi::IsValid(int_value)) {
       return Smi::FromInt(int_value);
     }
   }
   return Heap::nan_value();
 }
 
 
-static Object* Runtime_NumberAdd(Arguments args) {
+static MaybeObject* Runtime_NumberAdd(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
   return Heap::NumberFromDouble(x + y);
 }
 
 
-static Object* Runtime_NumberSub(Arguments args) {
+static MaybeObject* Runtime_NumberSub(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
   return Heap::NumberFromDouble(x - y);
 }
 
 
-static Object* Runtime_NumberMul(Arguments args) {
+static MaybeObject* Runtime_NumberMul(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
   return Heap::NumberFromDouble(x * y);
 }
 
 
-static Object* Runtime_NumberUnaryMinus(Arguments args) {
+static MaybeObject* Runtime_NumberUnaryMinus(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return Heap::NumberFromDouble(-x);
 }
 
 
-static Object* Runtime_NumberAlloc(Arguments args) {
+static MaybeObject* Runtime_NumberAlloc(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 0);
 
   return Heap::NumberFromDouble(9876543210.0);
 }
 
 
-static Object* Runtime_NumberDiv(Arguments args) {
+static MaybeObject* Runtime_NumberDiv(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
   return Heap::NumberFromDouble(x / y);
 }
 
 
-static Object* Runtime_NumberMod(Arguments args) {
+static MaybeObject* Runtime_NumberMod(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
 
   x = modulo(x, y);
   // NumberFromDouble may return a Smi instead of a Number object
   return Heap::NumberFromDouble(x);
 }
 
 
-static Object* Runtime_StringAdd(Arguments args) {
+static MaybeObject* Runtime_StringAdd(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(String, str1, args[0]);
   CONVERT_CHECKED(String, str2, args[1]);
   Counters::string_add_runtime.Increment();
   return Heap::AllocateConsString(str1, str2);
 }
 
 
 template <typename sinkchar>
@@ skipping 28 matching lines @@
     } else {
       String* string = String::cast(element);
       int element_length = string->length();
       String::WriteToFlat(string, sink + position, 0, element_length);
       position += element_length;
     }
   }
 }
 
 
-static Object* Runtime_StringBuilderConcat(Arguments args) {
+static MaybeObject* Runtime_StringBuilderConcat(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 3);
   CONVERT_CHECKED(JSArray, array, args[0]);
   if (!args[1]->IsSmi()) {
     Top::context()->mark_out_of_memory();
     return Failure::OutOfMemoryException();
   }
   int array_length = Smi::cast(args[1])->value();
   CONVERT_CHECKED(String, special, args[2]);
 
@@ skipping 67 matching lines @@
       Top::context()->mark_out_of_memory();
       return Failure::OutOfMemoryException();
     }
     position += increment;
   }
 
   int length = position;
   Object* object;
 
   if (ascii) {
-    object = Heap::AllocateRawAsciiString(length);
-    if (object->IsFailure()) return object;
+    { MaybeObject* maybe_object = Heap::AllocateRawAsciiString(length);
+      if (!maybe_object->ToObject(&object)) return maybe_object;
+    }
     SeqAsciiString* answer = SeqAsciiString::cast(object);
     StringBuilderConcatHelper(special,
                               answer->GetChars(),
                               fixed_array,
                               array_length);
     return answer;
   } else {
-    object = Heap::AllocateRawTwoByteString(length);
-    if (object->IsFailure()) return object;
+    { MaybeObject* maybe_object = Heap::AllocateRawTwoByteString(length);
+      if (!maybe_object->ToObject(&object)) return maybe_object;
+    }
     SeqTwoByteString* answer = SeqTwoByteString::cast(object);
     StringBuilderConcatHelper(special,
                               answer->GetChars(),
                               fixed_array,
                               array_length);
     return answer;
   }
 }
 
 
-static Object* Runtime_NumberOr(Arguments args) {
+static MaybeObject* Runtime_NumberOr(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_NUMBER_CHECKED(int32_t, x, Int32, args[0]);
   CONVERT_NUMBER_CHECKED(int32_t, y, Int32, args[1]);
   return Heap::NumberFromInt32(x | y);
 }
 
 
-static Object* Runtime_NumberAnd(Arguments args) {
+static MaybeObject* Runtime_NumberAnd(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_NUMBER_CHECKED(int32_t, x, Int32, args[0]);
   CONVERT_NUMBER_CHECKED(int32_t, y, Int32, args[1]);
   return Heap::NumberFromInt32(x & y);
 }
 
 
-static Object* Runtime_NumberXor(Arguments args) {
+static MaybeObject* Runtime_NumberXor(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_NUMBER_CHECKED(int32_t, x, Int32, args[0]);
   CONVERT_NUMBER_CHECKED(int32_t, y, Int32, args[1]);
   return Heap::NumberFromInt32(x ^ y);
 }
 
 
-static Object* Runtime_NumberNot(Arguments args) {
+static MaybeObject* Runtime_NumberNot(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_NUMBER_CHECKED(int32_t, x, Int32, args[0]);
   return Heap::NumberFromInt32(~x);
 }
 
 
-static Object* Runtime_NumberShl(Arguments args) {
+static MaybeObject* Runtime_NumberShl(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_NUMBER_CHECKED(int32_t, x, Int32, args[0]);
   CONVERT_NUMBER_CHECKED(int32_t, y, Int32, args[1]);
   return Heap::NumberFromInt32(x << (y & 0x1f));
 }
 
 
-static Object* Runtime_NumberShr(Arguments args) {
+static MaybeObject* Runtime_NumberShr(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_NUMBER_CHECKED(uint32_t, x, Uint32, args[0]);
   CONVERT_NUMBER_CHECKED(int32_t, y, Int32, args[1]);
   return Heap::NumberFromUint32(x >> (y & 0x1f));
 }
 
 
-static Object* Runtime_NumberSar(Arguments args) {
+static MaybeObject* Runtime_NumberSar(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_NUMBER_CHECKED(int32_t, x, Int32, args[0]);
   CONVERT_NUMBER_CHECKED(int32_t, y, Int32, args[1]);
   return Heap::NumberFromInt32(ArithmeticShiftRight(x, y & 0x1f));
 }
 
 
-static Object* Runtime_NumberEquals(Arguments args) {
+static MaybeObject* Runtime_NumberEquals(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
   if (isnan(x)) return Smi::FromInt(NOT_EQUAL);
   if (isnan(y)) return Smi::FromInt(NOT_EQUAL);
   if (x == y) return Smi::FromInt(EQUAL);
   Object* result;
   if ((fpclassify(x) == FP_ZERO) && (fpclassify(y) == FP_ZERO)) {
     result = Smi::FromInt(EQUAL);
   } else {
     result = Smi::FromInt(NOT_EQUAL);
   }
   return result;
 }
 
 
-static Object* Runtime_StringEquals(Arguments args) {
+static MaybeObject* Runtime_StringEquals(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(String, x, args[0]);
   CONVERT_CHECKED(String, y, args[1]);
 
   bool not_equal = !x->Equals(y);
   // This is slightly convoluted because the value that signifies
   // equality is 0 and inequality is 1 so we have to negate the result
   // from String::Equals.
   ASSERT(not_equal == 0 || not_equal == 1);
   STATIC_CHECK(EQUAL == 0);
   STATIC_CHECK(NOT_EQUAL == 1);
   return Smi::FromInt(not_equal);
 }
 
 
-static Object* Runtime_NumberCompare(Arguments args) {
+static MaybeObject* Runtime_NumberCompare(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 3);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
   if (isnan(x) || isnan(y)) return args[2];
   if (x == y) return Smi::FromInt(EQUAL);
   if (isless(x, y)) return Smi::FromInt(LESS);
   return Smi::FromInt(GREATER);
 }
 
 
 // Compare two Smis as if they were converted to strings and then
 // compared lexicographically.
-static Object* Runtime_SmiLexicographicCompare(Arguments args) {
+static MaybeObject* Runtime_SmiLexicographicCompare(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   // Arrays for the individual characters of the two Smis.  Smis are
   // 31 bit integers and 10 decimal digits are therefore enough.
   static int x_elms[10];
   static int y_elms[10];
 
   // Extract the integer values from the Smis.
   CONVERT_CHECKED(Smi, x, args[0]);
@@ skipping 97 matching lines @@
   if (r == 0) {
     result = equal_prefix_result;
   } else {
     result = (r < 0) ? Smi::FromInt(LESS) : Smi::FromInt(GREATER);
   }
   ASSERT(result == StringInputBufferCompare(x, y));
   return result;
 }
 
 
-static Object* Runtime_StringCompare(Arguments args) {
+static MaybeObject* Runtime_StringCompare(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(String, x, args[0]);
   CONVERT_CHECKED(String, y, args[1]);
 
   Counters::string_compare_runtime.Increment();
 
   // A few fast case tests before we flatten.
   if (x == y) return Smi::FromInt(EQUAL);
   if (y->length() == 0) {
     if (x->length() == 0) return Smi::FromInt(EQUAL);
     return Smi::FromInt(GREATER);
   } else if (x->length() == 0) {
     return Smi::FromInt(LESS);
   }
 
   int d = x->Get(0) - y->Get(0);
   if (d < 0) return Smi::FromInt(LESS);
   else if (d > 0) return Smi::FromInt(GREATER);
 
-  Object* obj = Heap::PrepareForCompare(x);
-  if (obj->IsFailure()) return obj;
-  obj = Heap::PrepareForCompare(y);
-  if (obj->IsFailure()) return obj;
+  Object* obj;
+  { MaybeObject* maybe_obj = Heap::PrepareForCompare(x);
+    if (!maybe_obj->ToObject(&obj)) return maybe_obj;
+  }
+  { MaybeObject* maybe_obj = Heap::PrepareForCompare(y);
+    if (!maybe_obj->ToObject(&obj)) return maybe_obj;
+  }
 
   return (x->IsFlat() && y->IsFlat()) ? FlatStringCompare(x, y)
                                       : StringInputBufferCompare(x, y);
 }
 
 
-static Object* Runtime_Math_acos(Arguments args) {
+static MaybeObject* Runtime_Math_acos(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_acos.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return TranscendentalCache::Get(TranscendentalCache::ACOS, x);
 }
 
 
-static Object* Runtime_Math_asin(Arguments args) {
+static MaybeObject* Runtime_Math_asin(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_asin.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return TranscendentalCache::Get(TranscendentalCache::ASIN, x);
 }
 
 
-static Object* Runtime_Math_atan(Arguments args) {
+static MaybeObject* Runtime_Math_atan(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_atan.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return TranscendentalCache::Get(TranscendentalCache::ATAN, x);
 }
 
 
-static Object* Runtime_Math_atan2(Arguments args) {
+static MaybeObject* Runtime_Math_atan2(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
   Counters::math_atan2.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
   double result;
   if (isinf(x) && isinf(y)) {
     // Make sure that the result in case of two infinite arguments
     // is a multiple of Pi / 4. The sign of the result is determined
     // by the first argument (x) and the sign of the second argument
     // determines the multiplier: one or three.
     static double kPiDividedBy4 = 0.78539816339744830962;
     int multiplier = (x < 0) ? -1 : 1;
     if (y < 0) multiplier *= 3;
     result = multiplier * kPiDividedBy4;
   } else {
     result = atan2(x, y);
   }
   return Heap::AllocateHeapNumber(result);
 }
 
 
-static Object* Runtime_Math_ceil(Arguments args) {
+static MaybeObject* Runtime_Math_ceil(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_ceil.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return Heap::NumberFromDouble(ceiling(x));
 }
 
 
-static Object* Runtime_Math_cos(Arguments args) {
+static MaybeObject* Runtime_Math_cos(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_cos.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return TranscendentalCache::Get(TranscendentalCache::COS, x);
 }
 
 
-static Object* Runtime_Math_exp(Arguments args) {
+static MaybeObject* Runtime_Math_exp(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_exp.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return TranscendentalCache::Get(TranscendentalCache::EXP, x);
 }
 
 
-static Object* Runtime_Math_floor(Arguments args) {
+static MaybeObject* Runtime_Math_floor(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_floor.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return Heap::NumberFromDouble(floor(x));
 }
 
 
-static Object* Runtime_Math_log(Arguments args) {
+static MaybeObject* Runtime_Math_log(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_log.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return TranscendentalCache::Get(TranscendentalCache::LOG, x);
 }
 
 
 // Helper function to compute x^y, where y is known to be an
@@ skipping 20 matching lines @@
             : result;
       } else {
         return p;
       }
     }
     m *= m;
   }
 }
 
 
-static Object* Runtime_Math_pow(Arguments args) {
+static MaybeObject* Runtime_Math_pow(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
   Counters::math_pow.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
 
   // If the second argument is a smi, it is much faster to call the
   // custom powi() function than the generic pow().
   if (args[1]->IsSmi()) {
     int y = Smi::cast(args[1])->value();
@@ skipping 19 matching lines @@
     return Smi::FromInt(1);
   } else if (isnan(y) || ((x == 1 || x == -1) && isinf(y))) {
     return Heap::nan_value();
   } else {
     return Heap::AllocateHeapNumber(pow(x, y));
   }
 }
 
 // Fast version of Math.pow if we know that y is not an integer and
 // y is not -0.5 or 0.5. Used as slowcase from codegen.
-static Object* Runtime_Math_pow_cfunction(Arguments args) {
+static MaybeObject* Runtime_Math_pow_cfunction(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   CONVERT_DOUBLE_CHECKED(y, args[1]);
   if (y == 0) {
       return Smi::FromInt(1);
   } else if (isnan(y) || ((x == 1 || x == -1) && isinf(y))) {
       return Heap::nan_value();
   } else {
       return Heap::AllocateHeapNumber(pow(x, y));
   }
 }
 
 
-static Object* Runtime_RoundNumber(Arguments args) {
+static MaybeObject* Runtime_RoundNumber(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_round.Increment();
 
   if (!args[0]->IsHeapNumber()) {
     // Must be smi. Return the argument unchanged for all the other types
     // to make fuzz-natives test happy.
     return args[0];
   }
 
@@ skipping 15 matching lines @@
     return number;
   }
 
   if (sign && value >= -0.5) return Heap::minus_zero_value();
 
   // Do not call NumberFromDouble() to avoid extra checks.
   return Heap::AllocateHeapNumber(floor(value + 0.5));
 }
 
 
-static Object* Runtime_Math_sin(Arguments args) {
+static MaybeObject* Runtime_Math_sin(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_sin.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return TranscendentalCache::Get(TranscendentalCache::SIN, x);
 }
 
 
-static Object* Runtime_Math_sqrt(Arguments args) {
+static MaybeObject* Runtime_Math_sqrt(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_sqrt.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return Heap::AllocateHeapNumber(sqrt(x));
 }
 
 
-static Object* Runtime_Math_tan(Arguments args) {
+static MaybeObject* Runtime_Math_tan(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   Counters::math_tan.Increment();
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return TranscendentalCache::Get(TranscendentalCache::TAN, x);
 }
 
 
 static int MakeDay(int year, int month, int day) {
@@ skipping 34 matching lines @@
                       base_day;
 
   if (year % 4 || (year % 100 == 0 && year % 400 != 0)) {
     return day_from_year + day_from_month[month] + day - 1;
   }
 
   return day_from_year + day_from_month_leap[month] + day - 1;
 }
 
 
-static Object* Runtime_DateMakeDay(Arguments args) {
+static MaybeObject* Runtime_DateMakeDay(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 3);
 
   CONVERT_SMI_CHECKED(year, args[0]);
   CONVERT_SMI_CHECKED(month, args[1]);
   CONVERT_SMI_CHECKED(date, args[2]);
 
   return Smi::FromInt(MakeDay(year, month, date));
 }
 
@@ skipping 278 matching lines @@
 static inline void DateYMDFromTime(int date,
                                    int& year, int& month, int& day) {
   if (date >= 0 && date < 32 * kDaysIn4Years) {
     DateYMDFromTimeAfter1970(date, year, month, day);
   } else {
     DateYMDFromTimeSlow(date, year, month, day);
   }
 }
 
 
-static Object* Runtime_DateYMDFromTime(Arguments args) {
+static MaybeObject* Runtime_DateYMDFromTime(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_DOUBLE_CHECKED(t, args[0]);
   CONVERT_CHECKED(JSArray, res_array, args[1]);
 
   int year, month, day;
   DateYMDFromTime(static_cast<int>(floor(t / 86400000)), year, month, day);
 
   RUNTIME_ASSERT(res_array->elements()->map() == Heap::fixed_array_map());
   FixedArray* elms = FixedArray::cast(res_array->elements());
   RUNTIME_ASSERT(elms->length() == 3);
 
   elms->set(0, Smi::FromInt(year));
   elms->set(1, Smi::FromInt(month));
   elms->set(2, Smi::FromInt(day));
 
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_NewArgumentsFast(Arguments args) {
+static MaybeObject* Runtime_NewArgumentsFast(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 3);
 
   JSFunction* callee = JSFunction::cast(args[0]);
   Object** parameters = reinterpret_cast<Object**>(args[1]);
   const int length = Smi::cast(args[2])->value();
 
-  Object* result = Heap::AllocateArgumentsObject(callee, length);
-  if (result->IsFailure()) return result;
+  Object* result;
+  { MaybeObject* maybe_result = Heap::AllocateArgumentsObject(callee, length);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
   // Allocate the elements if needed.
   if (length > 0) {
     // Allocate the fixed array.
-    Object* obj = Heap::AllocateRawFixedArray(length);
-    if (obj->IsFailure()) return obj;
+    Object* obj;
+    { MaybeObject* maybe_obj = Heap::AllocateRawFixedArray(length);
+      if (!maybe_obj->ToObject(&obj)) return maybe_obj;
+    }
 
     AssertNoAllocation no_gc;
     FixedArray* array = reinterpret_cast<FixedArray*>(obj);
     array->set_map(Heap::fixed_array_map());
     array->set_length(length);
 
     WriteBarrierMode mode = array->GetWriteBarrierMode(no_gc);
     for (int i = 0; i < length; i++) {
       array->set(i, *--parameters, mode);
     }
     JSObject::cast(result)->set_elements(FixedArray::cast(obj));
   }
   return result;
 }
 
 
-static Object* Runtime_NewClosure(Arguments args) {
+static MaybeObject* Runtime_NewClosure(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
   CONVERT_ARG_CHECKED(Context, context, 0);
   CONVERT_ARG_CHECKED(SharedFunctionInfo, shared, 1);
 
   PretenureFlag pretenure = (context->global_context() == *context)
       ? TENURED       // Allocate global closures in old space.
       : NOT_TENURED;  // Allocate local closures in new space.
   Handle<JSFunction> result =
       Factory::NewFunctionFromSharedFunctionInfo(shared, context, pretenure);
   return *result;
 }
 
-static Object* Runtime_NewObjectFromBound(Arguments args) {
+static MaybeObject* Runtime_NewObjectFromBound(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
   CONVERT_ARG_CHECKED(JSFunction, function, 0);
   CONVERT_ARG_CHECKED(JSArray, params, 1);
 
   RUNTIME_ASSERT(params->HasFastElements());
   FixedArray* fixed = FixedArray::cast(params->elements());
 
   int fixed_length = Smi::cast(params->length())->value();
   SmartPointer<Object**> param_data(NewArray<Object**>(fixed_length));
@@ skipping 13 matching lines @@
 }
 
 
 static void TrySettingInlineConstructStub(Handle<JSFunction> function) {
   Handle<Object> prototype = Factory::null_value();
   if (function->has_instance_prototype()) {
     prototype = Handle<Object>(function->instance_prototype());
   }
   if (function->shared()->CanGenerateInlineConstructor(*prototype)) {
     ConstructStubCompiler compiler;
-    Object* code = compiler.CompileConstructStub(function->shared());
+    MaybeObject* code = compiler.CompileConstructStub(function->shared());
     if (!code->IsFailure()) {
-      function->shared()->set_construct_stub(Code::cast(code));
+      function->shared()->set_construct_stub(
+          Code::cast(code->ToObjectUnchecked()));
     }
   }
 }
 
 
-static Object* Runtime_NewObject(Arguments args) {
+static MaybeObject* Runtime_NewObject(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   Handle<Object> constructor = args.at<Object>(0);
 
   // If the constructor isn't a proper function we throw a type error.
   if (!constructor->IsJSFunction()) {
     Vector< Handle<Object> > arguments = HandleVector(&constructor, 1);
     Handle<Object> type_error =
         Factory::NewTypeError("not_constructor", arguments);
@@ skipping 55 matching lines @@
     TrySettingInlineConstructStub(function);
   }
 
   Counters::constructed_objects.Increment();
   Counters::constructed_objects_runtime.Increment();
 
   return *result;
 }
 
 
-static Object* Runtime_FinalizeInstanceSize(Arguments args) {
+static MaybeObject* Runtime_FinalizeInstanceSize(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   CONVERT_ARG_CHECKED(JSFunction, function, 0);
   function->shared()->CompleteInobjectSlackTracking();
   TrySettingInlineConstructStub(function);
 
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_LazyCompile(Arguments args) {
+static MaybeObject* Runtime_LazyCompile(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   Handle<JSFunction> function = args.at<JSFunction>(0);
 #ifdef DEBUG
   if (FLAG_trace_lazy && !function->shared()->is_compiled()) {
     PrintF("[lazy: ");
     function->shared()->name()->Print();
     PrintF("]\n");
   }
 #endif
 
   // Compile the target function.  Here we compile using CompileLazyInLoop in
   // order to get the optimized version.  This helps code like delta-blue
   // that calls performance-critical routines through constructors.  A
   // constructor call doesn't use a CallIC, it uses a LoadIC followed by a
   // direct call.  Since the in-loop tracking takes place through CallICs
   // this means that things called through constructors are never known to
   // be in loops.  We compile them as if they are in loops here just in case.
   ASSERT(!function->is_compiled());
   if (!CompileLazyInLoop(function, KEEP_EXCEPTION)) {
     return Failure::Exception();
   }
 
   return function->code();
 }
 
 
-static Object* Runtime_GetFunctionDelegate(Arguments args) {
+static MaybeObject* Runtime_GetFunctionDelegate(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   RUNTIME_ASSERT(!args[0]->IsJSFunction());
   return *Execution::GetFunctionDelegate(args.at<Object>(0));
 }
 
 
-static Object* Runtime_GetConstructorDelegate(Arguments args) {
+static MaybeObject* Runtime_GetConstructorDelegate(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   RUNTIME_ASSERT(!args[0]->IsJSFunction());
   return *Execution::GetConstructorDelegate(args.at<Object>(0));
 }
 
 
-static Object* Runtime_NewContext(Arguments args) {
+static MaybeObject* Runtime_NewContext(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, function, args[0]);
   int length = function->shared()->scope_info()->NumberOfContextSlots();
-  Object* result = Heap::AllocateFunctionContext(length, function);
-  if (result->IsFailure()) return result;
+  Object* result;
+  { MaybeObject* maybe_result = Heap::AllocateFunctionContext(length, function);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
 
   Top::set_context(Context::cast(result));
 
   return result;  // non-failure
 }
 
-static Object* PushContextHelper(Object* object, bool is_catch_context) {
+
+MUST_USE_RESULT static MaybeObject* PushContextHelper(Object* object,
+                                                      bool is_catch_context) {
   // Convert the object to a proper JavaScript object.
   Object* js_object = object;
   if (!js_object->IsJSObject()) {
-    js_object = js_object->ToObject();
-    if (js_object->IsFailure()) {
-      if (!Failure::cast(js_object)->IsInternalError()) return js_object;
+    MaybeObject* maybe_js_object = js_object->ToObject();
+    if (!maybe_js_object->ToObject(&js_object)) {
+      if (!Failure::cast(maybe_js_object)->IsInternalError()) {
+        return maybe_js_object;
+      }
       HandleScope scope;
       Handle<Object> handle(object);
       Handle<Object> result =
           Factory::NewTypeError("with_expression", HandleVector(&handle, 1));
       return Top::Throw(*result);
     }
   }
 
-  Object* result =
-      Heap::AllocateWithContext(Top::context(),
-                                JSObject::cast(js_object),
-                                is_catch_context);
-  if (result->IsFailure()) return result;
+  Object* result;
+  { MaybeObject* maybe_result =
+        Heap::AllocateWithContext(Top::context(),
+                                  JSObject::cast(js_object),
+                                  is_catch_context);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
 
   Context* context = Context::cast(result);
   Top::set_context(context);
 
   return result;
 }
 
 
-static Object* Runtime_PushContext(Arguments args) {
+static MaybeObject* Runtime_PushContext(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   return PushContextHelper(args[0], false);
 }
 
 
-static Object* Runtime_PushCatchContext(Arguments args) {
+static MaybeObject* Runtime_PushCatchContext(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
   return PushContextHelper(args[0], true);
 }
 
 
-static Object* Runtime_LookupContext(Arguments args) {
+static MaybeObject* Runtime_LookupContext(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
 
   CONVERT_ARG_CHECKED(Context, context, 0);
   CONVERT_ARG_CHECKED(String, name, 1);
 
   int index;
   PropertyAttributes attributes;
   ContextLookupFlags flags = FOLLOW_CHAINS;
   Handle<Object> holder =
@@ skipping 12 matching lines @@
 // A mechanism to return a pair of Object pointers in registers (if possible).
 // How this is achieved is calling convention-dependent.
 // All currently supported x86 compiles uses calling conventions that are cdecl
 // variants where a 64-bit value is returned in two 32-bit registers
 // (edx:eax on ia32, r1:r0 on ARM).
 // In AMD-64 calling convention a struct of two pointers is returned in rdx:rax.
 // In Win64 calling convention, a struct of two pointers is returned in memory,
 // allocated by the caller, and passed as a pointer in a hidden first parameter.
 #ifdef V8_HOST_ARCH_64_BIT
 struct ObjectPair {
-  Object* x;
-  Object* y;
+  MaybeObject* x;
+  MaybeObject* y;
 };
 
-static inline ObjectPair MakePair(Object* x, Object* y) {
+static inline ObjectPair MakePair(MaybeObject* x, MaybeObject* y) {
   ObjectPair result = {x, y};
   // Pointers x and y returned in rax and rdx, in AMD-x64-abi.
   // In Win64 they are assigned to a hidden first argument.
   return result;
 }
 #else
 typedef uint64_t ObjectPair;
-static inline ObjectPair MakePair(Object* x, Object* y) {
+static inline ObjectPair MakePair(MaybeObject* x, MaybeObject* y) {
   return reinterpret_cast<uint32_t>(x) |
       (reinterpret_cast<ObjectPair>(y) << 32);
 }
 #endif
 
 
-static inline Object* Unhole(Object* x, PropertyAttributes attributes) {
+static inline MaybeObject* Unhole(MaybeObject* x,
+                                  PropertyAttributes attributes) {
   ASSERT(!x->IsTheHole() || (attributes & READ_ONLY) != 0);
   USE(attributes);
   return x->IsTheHole() ? Heap::undefined_value() : x;
 }
 
 
 static JSObject* ComputeReceiverForNonGlobal(JSObject* holder) {
   ASSERT(!holder->IsGlobalObject());
   Context* top = Top::context();
   // Get the context extension function.
@@ skipping 29 matching lines @@
       context->Lookup(name, flags, &index, &attributes);
 
   // If the index is non-negative, the slot has been found in a local
   // variable or a parameter. Read it from the context object or the
   // arguments object.
   if (index >= 0) {
     // If the "property" we were looking for is a local variable or an
     // argument in a context, the receiver is the global object; see
     // ECMA-262, 3rd., 10.1.6 and 10.2.3.
     JSObject* receiver = Top::context()->global()->global_receiver();
-    Object* value = (holder->IsContext())
+    MaybeObject* value = (holder->IsContext())
         ? Context::cast(*holder)->get(index)
         : JSObject::cast(*holder)->GetElement(index);
     return MakePair(Unhole(value, attributes), receiver);
   }
 
   // If the holder is found, we read the property from it.
   if (!holder.is_null() && holder->IsJSObject()) {
     ASSERT(Handle<JSObject>::cast(holder)->HasProperty(*name));
     JSObject* object = JSObject::cast(*holder);
     JSObject* receiver;
     if (object->IsGlobalObject()) {
       receiver = GlobalObject::cast(object)->global_receiver();
     } else if (context->is_exception_holder(*holder)) {
       receiver = Top::context()->global()->global_receiver();
     } else {
       receiver = ComputeReceiverForNonGlobal(object);
     }
     // No need to unhole the value here. This is taken care of by the
     // GetProperty function.
-    Object* value = object->GetProperty(*name);
+    MaybeObject* value = object->GetProperty(*name);
     return MakePair(value, receiver);
   }
 
   if (throw_error) {
     // The property doesn't exist - throw exception.
     Handle<Object> reference_error =
         Factory::NewReferenceError("not_defined", HandleVector(&name, 1));
     return MakePair(Top::Throw(*reference_error), NULL);
   } else {
     // The property doesn't exist - return undefined
     return MakePair(Heap::undefined_value(), Heap::undefined_value());
   }
 }
 
 
 static ObjectPair Runtime_LoadContextSlot(Arguments args) {
   return LoadContextSlotHelper(args, true);
 }
 
 
 static ObjectPair Runtime_LoadContextSlotNoReferenceError(Arguments args) {
   return LoadContextSlotHelper(args, false);
 }
 
 
-static Object* Runtime_StoreContextSlot(Arguments args) {
+static MaybeObject* Runtime_StoreContextSlot(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 3);
 
   Handle<Object> value(args[0]);
   CONVERT_ARG_CHECKED(Context, context, 1);
   CONVERT_ARG_CHECKED(String, name, 2);
 
   int index;
   PropertyAttributes attributes;
   ContextLookupFlags flags = FOLLOW_CHAINS;
   Handle<Object> holder =
       context->Lookup(name, flags, &index, &attributes);
 
   if (index >= 0) {
     if (holder->IsContext()) {
       // Ignore if read_only variable.
       if ((attributes & READ_ONLY) == 0) {
         Handle<Context>::cast(holder)->set(index, *value);
       }
     } else {
       ASSERT((attributes & READ_ONLY) == 0);
-      Object* result =
-          Handle<JSObject>::cast(holder)->SetElement(index, *value);
-      USE(result);
-      ASSERT(!result->IsFailure());
+      Handle<JSObject>::cast(holder)->SetElement(index, *value)->
+          ToObjectUnchecked();
     }
     return *value;
   }
 
   // Slow case: The property is not in a FixedArray context.
   // It is either in an JSObject extension context or it was not found.
   Handle<JSObject> context_ext;
 
   if (!holder.is_null()) {
     // The property exists in the extension context.
@@ skipping 15 matching lines @@
       // handle-based methods such as SetProperty.  We therefore need
       // to convert null handles back to exceptions.
       ASSERT(Top::has_pending_exception());
       return Failure::Exception();
     }
   }
   return *value;
 }
 
 
-static Object* Runtime_Throw(Arguments args) {
+static MaybeObject* Runtime_Throw(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   return Top::Throw(args[0]);
 }
 
 
-static Object* Runtime_ReThrow(Arguments args) {
+static MaybeObject* Runtime_ReThrow(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   return Top::ReThrow(args[0]);
 }
 
 
-static Object* Runtime_PromoteScheduledException(Arguments args) {
+static MaybeObject* Runtime_PromoteScheduledException(Arguments args) {
   ASSERT_EQ(0, args.length());
   return Top::PromoteScheduledException();
 }
 
 
-static Object* Runtime_ThrowReferenceError(Arguments args) {
+static MaybeObject* Runtime_ThrowReferenceError(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   Handle<Object> name(args[0]);
   Handle<Object> reference_error =
     Factory::NewReferenceError("not_defined", HandleVector(&name, 1));
   return Top::Throw(*reference_error);
 }
 
 
-static Object* Runtime_StackOverflow(Arguments args) {
+static MaybeObject* Runtime_StackOverflow(Arguments args) {
   NoHandleAllocation na;
   return Top::StackOverflow();
 }
 
 
-static Object* Runtime_StackGuard(Arguments args) {
+static MaybeObject* Runtime_StackGuard(Arguments args) {
   ASSERT(args.length() == 0);
 
   // First check if this is a real stack overflow.
   if (StackGuard::IsStackOverflow()) {
     return Runtime_StackOverflow(args);
   }
 
   return Execution::HandleStackGuardInterrupt();
 }
 
@@ skipping 77 matching lines @@
 
   } else {
     // function result
     PrintF("} -> ");
     PrintObject(result);
     PrintF("\n");
   }
 }
 
 
-static Object* Runtime_TraceEnter(Arguments args) {
+static MaybeObject* Runtime_TraceEnter(Arguments args) {
   ASSERT(args.length() == 0);
   NoHandleAllocation ha;
   PrintTransition(NULL);
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_TraceExit(Arguments args) {
+static MaybeObject* Runtime_TraceExit(Arguments args) {
   NoHandleAllocation ha;
   PrintTransition(args[0]);
   return args[0];  // return TOS
 }
 
 
-static Object* Runtime_DebugPrint(Arguments args) {
+static MaybeObject* Runtime_DebugPrint(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
 #ifdef DEBUG
   if (args[0]->IsString()) {
     // If we have a string, assume it's a code "marker"
     // and print some interesting cpu debugging info.
     JavaScriptFrameIterator it;
     JavaScriptFrame* frame = it.frame();
     PrintF("fp = %p, sp = %p, caller_sp = %p: ",
@@ skipping 10 matching lines @@
   // ShortPrint is available in release mode. Print is not.
   args[0]->ShortPrint();
 #endif
   PrintF("\n");
   Flush();
 
   return args[0];  // return TOS
 }
 
 
-static Object* Runtime_DebugTrace(Arguments args) {
+static MaybeObject* Runtime_DebugTrace(Arguments args) {
   ASSERT(args.length() == 0);
   NoHandleAllocation ha;
   Top::PrintStack();
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_DateCurrentTime(Arguments args) {
+static MaybeObject* Runtime_DateCurrentTime(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 0);
 
   // According to ECMA-262, section 15.9.1, page 117, the precision of
   // the number in a Date object representing a particular instant in
   // time is milliseconds. Therefore, we floor the result of getting
   // the OS time.
   double millis = floor(OS::TimeCurrentMillis());
   return Heap::NumberFromDouble(millis);
 }
 
 
-static Object* Runtime_DateParseString(Arguments args) {
+static MaybeObject* Runtime_DateParseString(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
 
   CONVERT_ARG_CHECKED(String, str, 0);
   FlattenString(str);
 
   CONVERT_ARG_CHECKED(JSArray, output, 1);
   RUNTIME_ASSERT(output->HasFastElements());
 
   AssertNoAllocation no_allocation;
 
   FixedArray* output_array = FixedArray::cast(output->elements());
   RUNTIME_ASSERT(output_array->length() >= DateParser::OUTPUT_SIZE);
   bool result;
   if (str->IsAsciiRepresentation()) {
     result = DateParser::Parse(str->ToAsciiVector(), output_array);
   } else {
     ASSERT(str->IsTwoByteRepresentation());
     result = DateParser::Parse(str->ToUC16Vector(), output_array);
   }
 
   if (result) {
     return *output;
   } else {
     return Heap::null_value();
   }
 }
 
 
-static Object* Runtime_DateLocalTimezone(Arguments args) {
+static MaybeObject* Runtime_DateLocalTimezone(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   const char* zone = OS::LocalTimezone(x);
   return Heap::AllocateStringFromUtf8(CStrVector(zone));
 }
 
 
-static Object* Runtime_DateLocalTimeOffset(Arguments args) {
+static MaybeObject* Runtime_DateLocalTimeOffset(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 0);
 
   return Heap::NumberFromDouble(OS::LocalTimeOffset());
 }
 
 
-static Object* Runtime_DateDaylightSavingsOffset(Arguments args) {
+static MaybeObject* Runtime_DateDaylightSavingsOffset(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_DOUBLE_CHECKED(x, args[0]);
   return Heap::NumberFromDouble(OS::DaylightSavingsOffset(x));
 }
 
 
-static Object* Runtime_GlobalReceiver(Arguments args) {
+static MaybeObject* Runtime_GlobalReceiver(Arguments args) {
   ASSERT(args.length() == 1);
   Object* global = args[0];
   if (!global->IsJSGlobalObject()) return Heap::null_value();
   return JSGlobalObject::cast(global)->global_receiver();
 }
 
 
-static Object* Runtime_CompileString(Arguments args) {
+static MaybeObject* Runtime_CompileString(Arguments args) {
   HandleScope scope;
   ASSERT_EQ(2, args.length());
   CONVERT_ARG_CHECKED(String, source, 0);
   CONVERT_ARG_CHECKED(Oddball, is_json, 1)
 
   // Compile source string in the global context.
   Handle<Context> context(Top::context()->global_context());
   Compiler::ValidationState validate = (is_json->IsTrue())
     ? Compiler::VALIDATE_JSON : Compiler::DONT_VALIDATE_JSON;
   Handle<SharedFunctionInfo> shared = Compiler::CompileEval(source,
@@ skipping 107 matching lines @@
   // Compare it to the builtin 'GlobalEval' function to make sure.
   if (*callee != Top::global_context()->global_eval_fun() ||
       !args[1]->IsString()) {
     return MakePair(*callee, Top::context()->global()->global_receiver());
   }
 
   return CompileGlobalEval(args.at<String>(1), args.at<Object>(2));
 }
 
 
-static Object* Runtime_SetNewFunctionAttributes(Arguments args) {
+static MaybeObject* Runtime_SetNewFunctionAttributes(Arguments args) {
   // This utility adjusts the property attributes for newly created Function
   // object ("new Function(...)") by changing the map.
   // All it does is changing the prototype property to enumerable
   // as specified in ECMA262, 15.3.5.2.
   HandleScope scope;
   ASSERT(args.length() == 1);
   CONVERT_ARG_CHECKED(JSFunction, func, 0);
   ASSERT(func->map()->instance_type() ==
          Top::function_instance_map()->instance_type());
   ASSERT(func->map()->instance_size() ==
          Top::function_instance_map()->instance_size());
   func->set_map(*Top::function_instance_map());
   return *func;
 }
 
 
-static Object* Runtime_AllocateInNewSpace(Arguments args) {
+static MaybeObject* Runtime_AllocateInNewSpace(Arguments args) {
   // Allocate a block of memory in NewSpace (filled with a filler).
   // Use as fallback for allocation in generated code when NewSpace
   // is full.
   ASSERT(args.length() == 1);
   CONVERT_ARG_CHECKED(Smi, size_smi, 0);
   int size = size_smi->value();
   RUNTIME_ASSERT(IsAligned(size, kPointerSize));
   RUNTIME_ASSERT(size > 0);
   static const int kMinFreeNewSpaceAfterGC =
       Heap::InitialSemiSpaceSize() * 3/4;
   RUNTIME_ASSERT(size <= kMinFreeNewSpaceAfterGC);
-  Object* allocation = Heap::new_space()->AllocateRaw(size);
-  if (!allocation->IsFailure()) {
-    Heap::CreateFillerObjectAt(HeapObject::cast(allocation)->address(), size);
+  Object* allocation;
+  { MaybeObject* maybe_allocation = Heap::new_space()->AllocateRaw(size);
+    if (maybe_allocation->ToObject(&allocation)) {
+      Heap::CreateFillerObjectAt(HeapObject::cast(allocation)->address(), size);
+    }
+    return maybe_allocation;
   }
-  return allocation;
 }
 
 
 // Push an array unto an array of arrays if it is not already in the
 // array.  Returns true if the element was pushed on the stack and
 // false otherwise.
-static Object* Runtime_PushIfAbsent(Arguments args) {
+static MaybeObject* Runtime_PushIfAbsent(Arguments args) {
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(JSArray, array, args[0]);
   CONVERT_CHECKED(JSArray, element, args[1]);
   RUNTIME_ASSERT(array->HasFastElements());
   int length = Smi::cast(array->length())->value();
   FixedArray* elements = FixedArray::cast(array->elements());
   for (int i = 0; i < length; i++) {
     if (elements->get(i) == element) return Heap::false_value();
   }
-  Object* obj = array->SetFastElement(length, element);
-  if (obj->IsFailure()) return obj;
+  Object* obj;
+  { MaybeObject* maybe_obj = array->SetFastElement(length, element);
+    if (!maybe_obj->ToObject(&obj)) return maybe_obj;
+  }
   return Heap::true_value();
 }
 
 
 /**
  * A simple visitor visits every element of Array's.
  * The backend storage can be a fixed array for fast elements case,
  * or a dictionary for sparse array. Since Dictionary is a subtype
  * of FixedArray, the class can be used by both fast and slow cases.
  * The second parameter of the constructor, fast_elements, specifies
@@ skipping 273 matching lines @@
  * concatenated array length is 0.
  * TODO(lrn) Change length behavior to ECMAScript 5 specification (length
  * is one more than the last array index to get a value assigned).
  */
 static uint32_t IterateArguments(Handle<JSArray> arguments,
                                  ArrayConcatVisitor* visitor) {
   uint32_t visited_elements = 0;
   uint32_t num_of_args = static_cast<uint32_t>(arguments->length()->Number());
 
   for (uint32_t i = 0; i < num_of_args; i++) {
-    Handle<Object> obj(arguments->GetElement(i));
-    if (obj->IsJSArray()) {
-      Handle<JSArray> array = Handle<JSArray>::cast(obj);
-      uint32_t len = static_cast<uint32_t>(array->length()->Number());
-      uint32_t nof_elements =
-          IterateArrayAndPrototypeElements(array, visitor);
-      // Total elements of array and its prototype chain can be more than
-      // the array length, but ArrayConcat can only concatenate at most
-      // the array length number of elements. We use the length as an estimate
-      // for the actual number of elements added.
-      uint32_t added_elements = (nof_elements > len) ? len : nof_elements;
-      if (JSArray::kMaxElementCount - visited_elements < added_elements) {
-        visited_elements = JSArray::kMaxElementCount;
+    Object *element;
+    MaybeObject* maybe_element = arguments->GetElement(i);
+    // This if() is not expected to fail, but we have the check in the
+    // interest of hardening the runtime calls.
+    if (maybe_element->ToObject(&element)) {
+      Handle<Object> obj(element);
+      if (obj->IsJSArray()) {
+        Handle<JSArray> array = Handle<JSArray>::cast(obj);
+        uint32_t len = static_cast<uint32_t>(array->length()->Number());
+        uint32_t nof_elements =
+            IterateArrayAndPrototypeElements(array, visitor);
+        // Total elements of array and its prototype chain can be more than
+        // the array length, but ArrayConcat can only concatenate at most
+        // the array length number of elements. We use the length as an estimate
+        // for the actual number of elements added.
+        uint32_t added_elements = (nof_elements > len) ? len : nof_elements;
+        if (JSArray::kMaxElementCount - visited_elements < added_elements) {
+          visited_elements = JSArray::kMaxElementCount;
+        } else {
+          visited_elements += added_elements;
+        }
+        if (visitor) visitor->increase_index_offset(len);
       } else {
-        visited_elements += added_elements;
-      }
-      if (visitor) visitor->increase_index_offset(len);
-    } else {
-      if (visitor) {
-        visitor->visit(0, obj);
-        visitor->increase_index_offset(1);
-      }
-      if (visited_elements < JSArray::kMaxElementCount) {
-        visited_elements++;
+        if (visitor) {
+          visitor->visit(0, obj);
+          visitor->increase_index_offset(1);
+        }
+        if (visited_elements < JSArray::kMaxElementCount) {
+          visited_elements++;
+        }
       }
     }
   }
   return visited_elements;
 }
 
 
 /**
  * Array::concat implementation.
  * See ECMAScript 262, 15.4.4.4.
  * TODO(lrn): Fix non-compliance for very large concatenations and update to
  * following the ECMAScript 5 specification.
  */
-static Object* Runtime_ArrayConcat(Arguments args) {
+static MaybeObject* Runtime_ArrayConcat(Arguments args) {
   ASSERT(args.length() == 1);
   HandleScope handle_scope;
 
   CONVERT_CHECKED(JSArray, arg_arrays, args[0]);
   Handle<JSArray> arguments(arg_arrays);
 
   // Pass 1: estimate the number of elements of the result
   // (it could be more than real numbers if prototype has elements).
   uint32_t result_length = 0;
   uint32_t num_of_args = static_cast<uint32_t>(arguments->length()->Number());
 
   { AssertNoAllocation nogc;
     for (uint32_t i = 0; i < num_of_args; i++) {
-      Object* obj = arguments->GetElement(i);
-      uint32_t length_estimate;
-      if (obj->IsJSArray()) {
-        length_estimate =
-            static_cast<uint32_t>(JSArray::cast(obj)->length()->Number());
-      } else {
-        length_estimate = 1;
+      Object* obj;
+      MaybeObject* maybe_object = arguments->GetElement(i);
+      // This if() is not expected to fail, but we have the check in the
+      // interest of hardening the runtime calls.
+      if (maybe_object->ToObject(&obj)) {
+        uint32_t length_estimate;
+        if (obj->IsJSArray()) {
+          length_estimate =
+              static_cast<uint32_t>(JSArray::cast(obj)->length()->Number());
+        } else {
+          length_estimate = 1;
+        }
+        if (JSObject::kMaxElementCount - result_length < length_estimate) {
+          result_length = JSObject::kMaxElementCount;
+          break;
+        }
+        result_length += length_estimate;
       }
-      if (JSObject::kMaxElementCount - result_length < length_estimate) {
-        result_length = JSObject::kMaxElementCount;
-        break;
-      }
-      result_length += length_estimate;
     }
   }
 
   // Allocate an empty array, will set length and content later.
   Handle<JSArray> result = Factory::NewJSArray(0);
 
   uint32_t estimate_nof_elements = IterateArguments(arguments, NULL);
   // If estimated number of elements is more than half of length, a
   // fixed array (fast case) is more time and space-efficient than a
   // dictionary.
@@ skipping 27 matching lines @@
   result->set_length(*len);
   // Please note the storage might have changed in the visitor.
   result->set_elements(*visitor.storage());
 
   return *result;
 }
 
 
 // This will not allocate (flatten the string), but it may run
 // very slowly for very deeply nested ConsStrings.  For debugging use only.
-static Object* Runtime_GlobalPrint(Arguments args) {
+static MaybeObject* Runtime_GlobalPrint(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(String, string, args[0]);
   StringInputBuffer buffer(string);
   while (buffer.has_more()) {
     uint16_t character = buffer.GetNext();
     PrintF("%c", character);
   }
   return string;
 }
 
 // Moves all own elements of an object, that are below a limit, to positions
 // starting at zero. All undefined values are placed after non-undefined values,
 // and are followed by non-existing element. Does not change the length
 // property.
 // Returns the number of non-undefined elements collected.
-static Object* Runtime_RemoveArrayHoles(Arguments args) {
+static MaybeObject* Runtime_RemoveArrayHoles(Arguments args) {
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(JSObject, object, args[0]);
   CONVERT_NUMBER_CHECKED(uint32_t, limit, Uint32, args[1]);
   return object->PrepareElementsForSort(limit);
 }
 
 
 // Move contents of argument 0 (an array) to argument 1 (an array)
-static Object* Runtime_MoveArrayContents(Arguments args) {
+static MaybeObject* Runtime_MoveArrayContents(Arguments args) {
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(JSArray, from, args[0]);
   CONVERT_CHECKED(JSArray, to, args[1]);
   HeapObject* new_elements = from->elements();
-  Object* new_map;
+  MaybeObject* maybe_new_map;
   if (new_elements->map() == Heap::fixed_array_map() ||
       new_elements->map() == Heap::fixed_cow_array_map()) {
-    new_map = to->map()->GetFastElementsMap();
+    maybe_new_map = to->map()->GetFastElementsMap();
   } else {
-    new_map = to->map()->GetSlowElementsMap();
+    maybe_new_map = to->map()->GetSlowElementsMap();
   }
-  if (new_map->IsFailure()) return new_map;
+  Object* new_map;
+  if (!maybe_new_map->ToObject(&new_map)) return maybe_new_map;
   to->set_map(Map::cast(new_map));
   to->set_elements(new_elements);
   to->set_length(from->length());
-  Object* obj = from->ResetElements();
-  if (obj->IsFailure()) return obj;
+  Object* obj;
+  { MaybeObject* maybe_obj = from->ResetElements();
+    if (!maybe_obj->ToObject(&obj)) return maybe_obj;
+  }
   from->set_length(Smi::FromInt(0));
   return to;
 }
 
 
 // How many elements does this object/array have?
-static Object* Runtime_EstimateNumberOfElements(Arguments args) {
+static MaybeObject* Runtime_EstimateNumberOfElements(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(JSObject, object, args[0]);
   HeapObject* elements = object->elements();
   if (elements->IsDictionary()) {
     return Smi::FromInt(NumberDictionary::cast(elements)->NumberOfElements());
   } else if (object->IsJSArray()) {
     return JSArray::cast(object)->length();
   } else {
     return Smi::FromInt(FixedArray::cast(elements)->length());
   }
 }
 
 
-static Object* Runtime_SwapElements(Arguments args) {
+static MaybeObject* Runtime_SwapElements(Arguments args) {
   HandleScope handle_scope;
 
   ASSERT_EQ(3, args.length());
 
   CONVERT_ARG_CHECKED(JSObject, object, 0);
   Handle<Object> key1 = args.at<Object>(1);
   Handle<Object> key2 = args.at<Object>(2);
 
   uint32_t index1, index2;
   if (!key1->ToArrayIndex(&index1)
@@ skipping 10 matching lines @@
 
   return Heap::undefined_value();
 }
 
 
 // Returns an array that tells you where in the [0, length) interval an array
 // might have elements.  Can either return keys (positive integers) or
 // intervals (pair of a negative integer (-start-1) followed by a
 // positive (length)) or undefined values.
 // Intervals can span over some keys that are not in the object.
-static Object* Runtime_GetArrayKeys(Arguments args) {
+static MaybeObject* Runtime_GetArrayKeys(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   CONVERT_ARG_CHECKED(JSObject, array, 0);
   CONVERT_NUMBER_CHECKED(uint32_t, length, Uint32, args[1]);
   if (array->elements()->IsDictionary()) {
     // Create an array and get all the keys into it, then remove all the
     // keys that are not integers in the range 0 to length-1.
     Handle<FixedArray> keys = GetKeysInFixedArrayFor(array, INCLUDE_PROTOS);
     int keys_length = keys->length();
     for (int i = 0; i < keys_length; i++) {
@@ skipping 19 matching lines @@
     return *Factory::NewJSArrayWithElements(single_interval);
   }
 }
 
 
 // DefineAccessor takes an optional final argument which is the
 // property attributes (eg, DONT_ENUM, DONT_DELETE).  IMPORTANT: due
 // to the way accessors are implemented, it is set for both the getter
 // and setter on the first call to DefineAccessor and ignored on
 // subsequent calls.
-static Object* Runtime_DefineAccessor(Arguments args) {
+static MaybeObject* Runtime_DefineAccessor(Arguments args) {
   RUNTIME_ASSERT(args.length() == 4 || args.length() == 5);
   // Compute attributes.
   PropertyAttributes attributes = NONE;
   if (args.length() == 5) {
     CONVERT_CHECKED(Smi, attrs, args[4]);
     int value = attrs->value();
     // Only attribute bits should be set.
     ASSERT((value & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) == 0);
     attributes = static_cast<PropertyAttributes>(value);
   }
 
   CONVERT_CHECKED(JSObject, obj, args[0]);
   CONVERT_CHECKED(String, name, args[1]);
   CONVERT_CHECKED(Smi, flag, args[2]);
   CONVERT_CHECKED(JSFunction, fun, args[3]);
   return obj->DefineAccessor(name, flag->value() == 0, fun, attributes);
 }
 
 
-static Object* Runtime_LookupAccessor(Arguments args) {
+static MaybeObject* Runtime_LookupAccessor(Arguments args) {
   ASSERT(args.length() == 3);
   CONVERT_CHECKED(JSObject, obj, args[0]);
   CONVERT_CHECKED(String, name, args[1]);
   CONVERT_CHECKED(Smi, flag, args[2]);
   return obj->LookupAccessor(name, flag->value() == 0);
 }
 
 
 #ifdef ENABLE_DEBUGGER_SUPPORT
-static Object* Runtime_DebugBreak(Arguments args) {
+static MaybeObject* Runtime_DebugBreak(Arguments args) {
   ASSERT(args.length() == 0);
   return Execution::DebugBreakHelper();
 }
 
 
 // Helper functions for wrapping and unwrapping stack frame ids.
 static Smi* WrapFrameId(StackFrame::Id id) {
   ASSERT(IsAligned(OffsetFrom(id), static_cast<intptr_t>(4)));
   return Smi::FromInt(id >> 2);
 }
 
 
 static StackFrame::Id UnwrapFrameId(Smi* wrapped) {
   return static_cast<StackFrame::Id>(wrapped->value() << 2);
 }
 
 
 // Adds a JavaScript function as a debug event listener.
 // args[0]: debug event listener function to set or null or undefined for
 //          clearing the event listener function
 // args[1]: object supplied during callback
-static Object* Runtime_SetDebugEventListener(Arguments args) {
+static MaybeObject* Runtime_SetDebugEventListener(Arguments args) {
   ASSERT(args.length() == 2);
   RUNTIME_ASSERT(args[0]->IsJSFunction() ||
                  args[0]->IsUndefined() ||
                  args[0]->IsNull());
   Handle<Object> callback = args.at<Object>(0);
   Handle<Object> data = args.at<Object>(1);
   Debugger::SetEventListener(callback, data);
 
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_Break(Arguments args) {
+static MaybeObject* Runtime_Break(Arguments args) {
   ASSERT(args.length() == 0);
   StackGuard::DebugBreak();
   return Heap::undefined_value();
 }
 
 
-static Object* DebugLookupResultValue(Object* receiver, String* name,
-                                      LookupResult* result,
-                                      bool* caught_exception) {
+static MaybeObject* DebugLookupResultValue(Object* receiver, String* name,
+                                           LookupResult* result,
+                                           bool* caught_exception) {
   Object* value;
   switch (result->type()) {
     case NORMAL:
       value = result->holder()->GetNormalizedProperty(result);
       if (value->IsTheHole()) {
         return Heap::undefined_value();
       }
       return value;
     case FIELD:
       value =
           JSObject::cast(
               result->holder())->FastPropertyAt(result->GetFieldIndex());
       if (value->IsTheHole()) {
         return Heap::undefined_value();
       }
       return value;
     case CONSTANT_FUNCTION:
       return result->GetConstantFunction();
     case CALLBACKS: {
       Object* structure = result->GetCallbackObject();
       if (structure->IsProxy() || structure->IsAccessorInfo()) {
-        value = receiver->GetPropertyWithCallback(
+        MaybeObject* maybe_value = receiver->GetPropertyWithCallback(
             receiver, structure, name, result->holder());
-        if (value->IsException()) {
-          value = Top::pending_exception();
+        if (!maybe_value->ToObject(&value)) {
+          ASSERT(maybe_value->IsException());
+          maybe_value = Top::pending_exception();
           Top::clear_pending_exception();
           if (caught_exception != NULL) {
             *caught_exception = true;
           }
+          return maybe_value;
         }
         return value;
       } else {
         return Heap::undefined_value();
       }
     }
     case INTERCEPTOR:
     case MAP_TRANSITION:
     case CONSTANT_TRANSITION:
     case NULL_DESCRIPTOR:
@@ skipping 11 matching lines @@
 // args[1]: name of the property
 //
 // The array returned contains the following information:
 // 0: Property value
 // 1: Property details
 // 2: Property value is exception
 // 3: Getter function if defined
 // 4: Setter function if defined
 // Items 2-4 are only filled if the property has either a getter or a setter
 // defined through __defineGetter__ and/or __defineSetter__.
-static Object* Runtime_DebugGetPropertyDetails(Arguments args) {
+static MaybeObject* Runtime_DebugGetPropertyDetails(Arguments args) {
   HandleScope scope;
 
   ASSERT(args.length() == 2);
 
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
   CONVERT_ARG_CHECKED(String, name, 1);
 
   // Make sure to set the current context to the context before the debugger was
   // entered (if the debugger is entered). The reason for switching context here
   // is that for some property lookups (accessors and interceptors) callbacks
@@ skipping 10 matching lines @@
   if (obj->IsJSGlobalProxy()) {
     obj = Handle<JSObject>(JSObject::cast(obj->GetPrototype()));
   }
 
 
   // Check if the name is trivially convertible to an index and get the element
   // if so.
   uint32_t index;
   if (name->AsArrayIndex(&index)) {
     Handle<FixedArray> details = Factory::NewFixedArray(2);
-    Object* element_or_char = Runtime::GetElementOrCharAt(obj, index);
+    Object* element_or_char;
+    { MaybeObject* maybe_element_or_char =
+          Runtime::GetElementOrCharAt(obj, index);
+      if (!maybe_element_or_char->ToObject(&element_or_char)) {
+        return maybe_element_or_char;
+      }
+    }
     details->set(0, element_or_char);
     details->set(1, PropertyDetails(NONE, NORMAL).AsSmi());
     return *Factory::NewJSArrayWithElements(details);
   }
 
   // Find the number of objects making up this.
   int length = LocalPrototypeChainLength(*obj);
 
   // Try local lookup on each of the objects.
   Handle<JSObject> jsproto = obj;
   for (int i = 0; i < length; i++) {
     LookupResult result;
     jsproto->LocalLookup(*name, &result);
     if (result.IsProperty()) {
       // LookupResult is not GC safe as it holds raw object pointers.
       // GC can happen later in this code so put the required fields into
       // local variables using handles when required for later use.
       PropertyType result_type = result.type();
       Handle<Object> result_callback_obj;
       if (result_type == CALLBACKS) {
         result_callback_obj = Handle<Object>(result.GetCallbackObject());
       }
       Smi* property_details = result.GetPropertyDetails().AsSmi();
       // DebugLookupResultValue can cause GC so details from LookupResult needs
       // to be copied to handles before this.
       bool caught_exception = false;
-      Object* raw_value = DebugLookupResultValue(*obj, *name, &result,
-                                                 &caught_exception);
-      if (raw_value->IsFailure()) return raw_value;
+      Object* raw_value;
+      { MaybeObject* maybe_raw_value =
+            DebugLookupResultValue(*obj, *name, &result, &caught_exception);
+        if (!maybe_raw_value->ToObject(&raw_value)) return maybe_raw_value;
+      }
       Handle<Object> value(raw_value);
 
       // If the callback object is a fixed array then it contains JavaScript
       // getter and/or setter.
       bool hasJavaScriptAccessors = result_type == CALLBACKS &&
                                     result_callback_obj->IsFixedArray();
       Handle<FixedArray> details =
           Factory::NewFixedArray(hasJavaScriptAccessors ? 5 : 2);
       details->set(0, *value);
       details->set(1, property_details);
       if (hasJavaScriptAccessors) {
         details->set(2,
                      caught_exception ? Heap::true_value()
                                       : Heap::false_value());
         details->set(3, FixedArray::cast(*result_callback_obj)->get(0));
         details->set(4, FixedArray::cast(*result_callback_obj)->get(1));
       }
 
       return *Factory::NewJSArrayWithElements(details);
     }
     if (i < length - 1) {
       jsproto = Handle<JSObject>(JSObject::cast(jsproto->GetPrototype()));
     }
   }
 
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_DebugGetProperty(Arguments args) {
+static MaybeObject* Runtime_DebugGetProperty(Arguments args) {
   HandleScope scope;
 
   ASSERT(args.length() == 2);
 
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
   CONVERT_ARG_CHECKED(String, name, 1);
 
   LookupResult result;
   obj->Lookup(*name, &result);
   if (result.IsProperty()) {
     return DebugLookupResultValue(*obj, *name, &result, NULL);
   }
   return Heap::undefined_value();
 }
 
 
 // Return the property type calculated from the property details.
 // args[0]: smi with property details.
-static Object* Runtime_DebugPropertyTypeFromDetails(Arguments args) {
+static MaybeObject* Runtime_DebugPropertyTypeFromDetails(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(Smi, details, args[0]);
   PropertyType type = PropertyDetails(details).type();
   return Smi::FromInt(static_cast<int>(type));
 }
 
 
 // Return the property attribute calculated from the property details.
 // args[0]: smi with property details.
-static Object* Runtime_DebugPropertyAttributesFromDetails(Arguments args) {
+static MaybeObject* Runtime_DebugPropertyAttributesFromDetails(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(Smi, details, args[0]);
   PropertyAttributes attributes = PropertyDetails(details).attributes();
   return Smi::FromInt(static_cast<int>(attributes));
 }
 
 
 // Return the property insertion index calculated from the property details.
 // args[0]: smi with property details.
-static Object* Runtime_DebugPropertyIndexFromDetails(Arguments args) {
+static MaybeObject* Runtime_DebugPropertyIndexFromDetails(Arguments args) {
   ASSERT(args.length() == 1);
   CONVERT_CHECKED(Smi, details, args[0]);
   int index = PropertyDetails(details).index();
   return Smi::FromInt(index);
 }
 
 
 // Return property value from named interceptor.
 // args[0]: object
 // args[1]: property name
-static Object* Runtime_DebugNamedInterceptorPropertyValue(Arguments args) {
+static MaybeObject* Runtime_DebugNamedInterceptorPropertyValue(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
   RUNTIME_ASSERT(obj->HasNamedInterceptor());
   CONVERT_ARG_CHECKED(String, name, 1);
 
   PropertyAttributes attributes;
   return obj->GetPropertyWithInterceptor(*obj, *name, &attributes);
 }
 
 
 // Return element value from indexed interceptor.
 // args[0]: object
 // args[1]: index
-static Object* Runtime_DebugIndexedInterceptorElementValue(Arguments args) {
+static MaybeObject* Runtime_DebugIndexedInterceptorElementValue(
+    Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
   CONVERT_ARG_CHECKED(JSObject, obj, 0);
   RUNTIME_ASSERT(obj->HasIndexedInterceptor());
   CONVERT_NUMBER_CHECKED(uint32_t, index, Uint32, args[1]);
 
   return obj->GetElementWithInterceptor(*obj, index);
 }
 
 
-static Object* Runtime_CheckExecutionState(Arguments args) {
+static MaybeObject* Runtime_CheckExecutionState(Arguments args) {
   ASSERT(args.length() >= 1);
   CONVERT_NUMBER_CHECKED(int, break_id, Int32, args[0]);
   // Check that the break id is valid.
   if (Debug::break_id() == 0 || break_id != Debug::break_id()) {
     return Top::Throw(Heap::illegal_execution_state_symbol());
   }
 
   return Heap::true_value();
 }
 
 
-static Object* Runtime_GetFrameCount(Arguments args) {
+static MaybeObject* Runtime_GetFrameCount(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   // Check arguments.
-  Object* result = Runtime_CheckExecutionState(args);
-  if (result->IsFailure()) return result;
+  Object* result;
+  { MaybeObject* maybe_result = Runtime_CheckExecutionState(args);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
 
   // Count all frames which are relevant to debugging stack trace.
   int n = 0;
   StackFrame::Id id = Debug::break_frame_id();
   if (id == StackFrame::NO_ID) {
     // If there is no JavaScript stack frame count is 0.
     return Smi::FromInt(0);
   }
   for (JavaScriptFrameIterator it(id); !it.done(); it.Advance()) n++;
   return Smi::FromInt(n);
@@ skipping 21 matching lines @@
 // 2: Function
 // 3: Argument count
 // 4: Local count
 // 5: Source position
 // 6: Constructor call
 // 7: Is at return
 // 8: Debugger frame
 // Arguments name, value
 // Locals name, value
 // Return value if any
-static Object* Runtime_GetFrameDetails(Arguments args) {
+static MaybeObject* Runtime_GetFrameDetails(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
 
   // Check arguments.
-  Object* check = Runtime_CheckExecutionState(args);
-  if (check->IsFailure()) return check;
+  Object* check;
+  { MaybeObject* maybe_check = Runtime_CheckExecutionState(args);
+    if (!maybe_check->ToObject(&check)) return maybe_check;
+  }
   CONVERT_NUMBER_CHECKED(int, index, Int32, args[1]);
 
   // Find the relevant frame with the requested index.
   StackFrame::Id id = Debug::break_frame_id();
   if (id == StackFrame::NO_ID) {
     // If there are no JavaScript stack frames return undefined.
     return Heap::undefined_value();
   }
   int count = 0;
   JavaScriptFrameIterator it(id);
@@ skipping 280 matching lines @@
   // Check whether the arguments shadow object exists.
   int arguments_shadow_index =
       shared->scope_info()->ContextSlotIndex(Heap::arguments_shadow_symbol(),
                                              NULL);
   if (arguments_shadow_index >= 0) {
     // In this case all the arguments are available in the arguments shadow
     // object.
     Handle<JSObject> arguments_shadow(
         JSObject::cast(context->get(arguments_shadow_index)));
     for (int i = 0; i < scope_info.number_of_parameters(); ++i) {
+      // We don't expect exception-throwing getters on the arguments shadow.
+      Object* element = arguments_shadow->GetElement(i)->ToObjectUnchecked();
       SetProperty(closure_scope,
                   scope_info.parameter_name(i),
-                  Handle<Object>(arguments_shadow->GetElement(i)), NONE);
+                  Handle<Object>(element),
+                  NONE);
     }
   }
 
   // Fill all context locals to the context extension.
   CopyContextLocalsToScopeObject(serialized_scope_info, scope_info,
                                  context, closure_scope);
 
   // Finally copy any properties from the function context extension. This will
   // be variables introduced by eval.
   if (context->has_extension()) {
@@ skipping 211 matching lines @@
   JavaScriptFrame* frame_;
   Handle<JSFunction> function_;
   Handle<Context> context_;
   bool local_done_;
   bool at_local_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(ScopeIterator);
 };
 
 
-static Object* Runtime_GetScopeCount(Arguments args) {
+static MaybeObject* Runtime_GetScopeCount(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
 
   // Check arguments.
-  Object* check = Runtime_CheckExecutionState(args);
-  if (check->IsFailure()) return check;
+  Object* check;
+  { MaybeObject* maybe_check = Runtime_CheckExecutionState(args);
+    if (!maybe_check->ToObject(&check)) return maybe_check;
+  }
   CONVERT_CHECKED(Smi, wrapped_id, args[1]);
 
   // Get the frame where the debugging is performed.
   StackFrame::Id id = UnwrapFrameId(wrapped_id);
   JavaScriptFrameIterator it(id);
   JavaScriptFrame* frame = it.frame();
 
   // Count the visible scopes.
   int n = 0;
   for (ScopeIterator it(frame); !it.Done(); it.Next()) {
     n++;
   }
 
   return Smi::FromInt(n);
 }
 
 
 static const int kScopeDetailsTypeIndex = 0;
 static const int kScopeDetailsObjectIndex = 1;
 static const int kScopeDetailsSize = 2;
 
 // Return an array with scope details
 // args[0]: number: break id
 // args[1]: number: frame index
 // args[2]: number: scope index
 //
 // The array returned contains the following information:
 // 0: Scope type
 // 1: Scope object
-static Object* Runtime_GetScopeDetails(Arguments args) {
+static MaybeObject* Runtime_GetScopeDetails(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 3);
 
   // Check arguments.
-  Object* check = Runtime_CheckExecutionState(args);
-  if (check->IsFailure()) return check;
+  Object* check;
+  { MaybeObject* maybe_check = Runtime_CheckExecutionState(args);
+    if (!maybe_check->ToObject(&check)) return maybe_check;
+  }
   CONVERT_CHECKED(Smi, wrapped_id, args[1]);
   CONVERT_NUMBER_CHECKED(int, index, Int32, args[2]);
 
   // Get the frame where the debugging is performed.
   StackFrame::Id id = UnwrapFrameId(wrapped_id);
   JavaScriptFrameIterator frame_it(id);
   JavaScriptFrame* frame = frame_it.frame();
 
   // Find the requested scope.
   int n = 0;
@@ skipping 11 matching lines @@
 
   // Fill in scope details.
   details->set(kScopeDetailsTypeIndex, Smi::FromInt(it.Type()));
   Handle<JSObject> scope_object = it.ScopeObject();
   details->set(kScopeDetailsObjectIndex, *scope_object);
 
   return *Factory::NewJSArrayWithElements(details);
 }
 
 
-static Object* Runtime_DebugPrintScopes(Arguments args) {
+static MaybeObject* Runtime_DebugPrintScopes(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 0);
 
 #ifdef DEBUG
   // Print the scopes for the top frame.
   StackFrameLocator locator;
   JavaScriptFrame* frame = locator.FindJavaScriptFrame(0);
   for (ScopeIterator it(frame); !it.Done(); it.Next()) {
     it.DebugPrint();
   }
 #endif
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_GetCFrames(Arguments args) {
-  HandleScope scope;
-  ASSERT(args.length() == 1);
-  Object* result = Runtime_CheckExecutionState(args);
-  if (result->IsFailure()) return result;
-
-#if V8_HOST_ARCH_64_BIT
-  UNIMPLEMENTED();
+static MaybeObject* Runtime_GetCFrames(Arguments args) {
+  // See bug 906.
   return Heap::undefined_value();
-#else
-
-  static const int kMaxCFramesSize = 200;
-  ScopedVector<OS::StackFrame> frames(kMaxCFramesSize);
-  int frames_count = OS::StackWalk(frames);
-  if (frames_count == OS::kStackWalkError) {
-    return Heap::undefined_value();
-  }
-
-  Handle<String> address_str = Factory::LookupAsciiSymbol("address");
-  Handle<String> text_str = Factory::LookupAsciiSymbol("text");
-  Handle<FixedArray> frames_array = Factory::NewFixedArray(frames_count);
-  for (int i = 0; i < frames_count; i++) {
-    Handle<JSObject> frame_value = Factory::NewJSObject(Top::object_function());
-    Handle<Object> frame_address =
-        Factory::NewNumberFromInt(reinterpret_cast<int>(frames[i].address));
-
-    frame_value->SetProperty(*address_str, *frame_address, NONE);
-
-    // Get the stack walk text for this frame.
-    Handle<String> frame_text;
-    int frame_text_length = StrLength(frames[i].text);
-    if (frame_text_length > 0) {
-      Vector<const char> str(frames[i].text, frame_text_length);
-      frame_text = Factory::NewStringFromAscii(str);
-    }
-
-    if (!frame_text.is_null()) {
-      frame_value->SetProperty(*text_str, *frame_text, NONE);
-    }
-
-    frames_array->set(i, *frame_value);
-  }
-  return *Factory::NewJSArrayWithElements(frames_array);
-#endif  // V8_HOST_ARCH_64_BIT
 }
 
 
-static Object* Runtime_GetThreadCount(Arguments args) {
+static MaybeObject* Runtime_GetThreadCount(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   // Check arguments.
-  Object* result = Runtime_CheckExecutionState(args);
-  if (result->IsFailure()) return result;
+  Object* result;
+  { MaybeObject* maybe_result = Runtime_CheckExecutionState(args);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
 
   // Count all archived V8 threads.
   int n = 0;
   for (ThreadState* thread = ThreadState::FirstInUse();
        thread != NULL;
        thread = thread->Next()) {
     n++;
   }
 
   // Total number of threads is current thread and archived threads.
   return Smi::FromInt(n + 1);
 }
 
 
 static const int kThreadDetailsCurrentThreadIndex = 0;
 static const int kThreadDetailsThreadIdIndex = 1;
 static const int kThreadDetailsSize = 2;
 
 // Return an array with thread details
 // args[0]: number: break id
 // args[1]: number: thread index
 //
 // The array returned contains the following information:
 // 0: Is current thread?
 // 1: Thread id
-static Object* Runtime_GetThreadDetails(Arguments args) {
+static MaybeObject* Runtime_GetThreadDetails(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
 
   // Check arguments.
-  Object* check = Runtime_CheckExecutionState(args);
-  if (check->IsFailure()) return check;
+  Object* check;
+  { MaybeObject* maybe_check = Runtime_CheckExecutionState(args);
+    if (!maybe_check->ToObject(&check)) return maybe_check;
+  }
   CONVERT_NUMBER_CHECKED(int, index, Int32, args[1]);
 
   // Allocate array for result.
   Handle<FixedArray> details = Factory::NewFixedArray(kThreadDetailsSize);
 
   // Thread index 0 is current thread.
   if (index == 0) {
     // Fill the details.
     details->set(kThreadDetailsCurrentThreadIndex, Heap::true_value());
     details->set(kThreadDetailsThreadIdIndex,
@@ skipping 15 matching lines @@
     details->set(kThreadDetailsThreadIdIndex, Smi::FromInt(thread->id()));
   }
 
   // Convert to JS array and return.
   return *Factory::NewJSArrayWithElements(details);
 }
 
 
 // Sets the disable break state
 // args[0]: disable break state
-static Object* Runtime_SetDisableBreak(Arguments args) {
+static MaybeObject* Runtime_SetDisableBreak(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   CONVERT_BOOLEAN_CHECKED(disable_break, args[0]);
   Debug::set_disable_break(disable_break);
   return  Heap::undefined_value();
 }
 
 
-static Object* Runtime_GetBreakLocations(Arguments args) {
+static MaybeObject* Runtime_GetBreakLocations(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
 
   CONVERT_ARG_CHECKED(JSFunction, fun, 0);
   Handle<SharedFunctionInfo> shared(fun->shared());
   // Find the number of break points
   Handle<Object> break_locations = Debug::GetSourceBreakLocations(shared);
   if (break_locations->IsUndefined()) return Heap::undefined_value();
   // Return array as JS array
   return *Factory::NewJSArrayWithElements(
       Handle<FixedArray>::cast(break_locations));
 }
 
 
 // Set a break point in a function
 // args[0]: function
 // args[1]: number: break source position (within the function source)
 // args[2]: number: break point object
-static Object* Runtime_SetFunctionBreakPoint(Arguments args) {
+static MaybeObject* Runtime_SetFunctionBreakPoint(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 3);
   CONVERT_ARG_CHECKED(JSFunction, fun, 0);
   Handle<SharedFunctionInfo> shared(fun->shared());
   CONVERT_NUMBER_CHECKED(int32_t, source_position, Int32, args[1]);
   RUNTIME_ASSERT(source_position >= 0);
   Handle<Object> break_point_object_arg = args.at<Object>(2);
 
   // Set break point.
   Debug::SetBreakPoint(shared, break_point_object_arg, &source_position);
@@ skipping 78 matching lines @@
   return *target;
 }
 
 
 // Changes the state of a break point in a script and returns source position
 // where break point was set. NOTE: Regarding performance see the NOTE for
 // GetScriptFromScriptData.
 // args[0]: script to set break point in
 // args[1]: number: break source position (within the script source)
 // args[2]: number: break point object
-static Object* Runtime_SetScriptBreakPoint(Arguments args) {
+static MaybeObject* Runtime_SetScriptBreakPoint(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 3);
   CONVERT_ARG_CHECKED(JSValue, wrapper, 0);
   CONVERT_NUMBER_CHECKED(int32_t, source_position, Int32, args[1]);
   RUNTIME_ASSERT(source_position >= 0);
   Handle<Object> break_point_object_arg = args.at<Object>(2);
 
   // Get the script from the script wrapper.
   RUNTIME_ASSERT(wrapper->value()->IsScript());
   Handle<Script> script(Script::cast(wrapper->value()));
@@ skipping 13 matching lines @@
     Debug::SetBreakPoint(shared, break_point_object_arg, &position);
     position += shared->start_position();
     return Smi::FromInt(position);
   }
   return  Heap::undefined_value();
 }
 
 
 // Clear a break point
 // args[0]: number: break point object
-static Object* Runtime_ClearBreakPoint(Arguments args) {
+static MaybeObject* Runtime_ClearBreakPoint(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   Handle<Object> break_point_object_arg = args.at<Object>(0);
 
   // Clear break point.
   Debug::ClearBreakPoint(break_point_object_arg);
 
   return Heap::undefined_value();
 }
 
 
 // Change the state of break on exceptions.
 // args[0]: Enum value indicating whether to affect caught/uncaught exceptions.
 // args[1]: Boolean indicating on/off.
-static Object* Runtime_ChangeBreakOnException(Arguments args) {
+static MaybeObject* Runtime_ChangeBreakOnException(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 2);
   RUNTIME_ASSERT(args[0]->IsNumber());
   CONVERT_BOOLEAN_CHECKED(enable, args[1]);
 
   // If the number doesn't match an enum value, the ChangeBreakOnException
   // function will default to affecting caught exceptions.
   ExceptionBreakType type =
       static_cast<ExceptionBreakType>(NumberToUint32(args[0]));
   // Update break point state.
   Debug::ChangeBreakOnException(type, enable);
   return Heap::undefined_value();
 }
 
 
 // Returns the state of break on exceptions
 // args[0]: boolean indicating uncaught exceptions
-static Object* Runtime_IsBreakOnException(Arguments args) {
+static MaybeObject* Runtime_IsBreakOnException(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 1);
   RUNTIME_ASSERT(args[0]->IsNumber());
 
   ExceptionBreakType type =
       static_cast<ExceptionBreakType>(NumberToUint32(args[0]));
   bool result = Debug::IsBreakOnException(type);
   return Smi::FromInt(result);
 }
 
 
 // Prepare for stepping
 // args[0]: break id for checking execution state
 // args[1]: step action from the enumeration StepAction
 // args[2]: number of times to perform the step, for step out it is the number
 //          of frames to step down.
-static Object* Runtime_PrepareStep(Arguments args) {
+static MaybeObject* Runtime_PrepareStep(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 3);
   // Check arguments.
-  Object* check = Runtime_CheckExecutionState(args);
-  if (check->IsFailure()) return check;
+  Object* check;
+  { MaybeObject* maybe_check = Runtime_CheckExecutionState(args);
+    if (!maybe_check->ToObject(&check)) return maybe_check;
+  }
   if (!args[1]->IsNumber() || !args[2]->IsNumber()) {
     return Top::Throw(Heap::illegal_argument_symbol());
   }
 
   // Get the step action and check validity.
   StepAction step_action = static_cast<StepAction>(NumberToInt32(args[1]));
   if (step_action != StepIn &&
       step_action != StepNext &&
       step_action != StepOut &&
       step_action != StepInMin &&
@@ skipping 10 matching lines @@
   // Clear all current stepping setup.
   Debug::ClearStepping();
 
   // Prepare step.
   Debug::PrepareStep(static_cast<StepAction>(step_action), step_count);
   return Heap::undefined_value();
 }
 
 
 // Clear all stepping set by PrepareStep.
-static Object* Runtime_ClearStepping(Arguments args) {
+static MaybeObject* Runtime_ClearStepping(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 0);
   Debug::ClearStepping();
   return Heap::undefined_value();
 }
 
 
 // Creates a copy of the with context chain. The copy of the context chain is
 // is linked to the function context supplied.
 static Handle<Context> CopyWithContextChain(Handle<Context> context_chain,
@@ skipping 56 matching lines @@
 // debugging. This is accomplished by creating a new context which in its
 // extension part has all the parameters and locals of the function on the
 // stack frame. A function which calls eval with the code to evaluate is then
 // compiled in this context and called in this context. As this context
 // replaces the context of the function on the stack frame a new (empty)
 // function is created as well to be used as the closure for the context.
 // This function and the context acts as replacements for the function on the
 // stack frame presenting the same view of the values of parameters and
 // local variables as if the piece of JavaScript was evaluated at the point
 // where the function on the stack frame is currently stopped.
-static Object* Runtime_DebugEvaluate(Arguments args) {
+static MaybeObject* Runtime_DebugEvaluate(Arguments args) {
   HandleScope scope;
 
   // Check the execution state and decode arguments frame and source to be
   // evaluated.
   ASSERT(args.length() == 4);
-  Object* check_result = Runtime_CheckExecutionState(args);
-  if (check_result->IsFailure()) return check_result;
+  Object* check_result;
+  { MaybeObject* maybe_check_result = Runtime_CheckExecutionState(args);
+    if (!maybe_check_result->ToObject(&check_result)) {
+      return maybe_check_result;
+    }
+  }
   CONVERT_CHECKED(Smi, wrapped_id, args[1]);
   CONVERT_ARG_CHECKED(String, source, 2);
   CONVERT_BOOLEAN_CHECKED(disable_break, args[3]);
 
   // Handle the processing of break.
   DisableBreak disable_break_save(disable_break);
 
   // Get the frame where the debugging is performed.
   StackFrame::Id id = UnwrapFrameId(wrapped_id);
   JavaScriptFrameIterator it(id);
@@ skipping 83 matching lines @@
   // Skip the global proxy as it has no properties and always delegates to the
   // real global object.
   if (result->IsJSGlobalProxy()) {
     result = Handle<JSObject>(JSObject::cast(result->GetPrototype()));
   }
 
   return *result;
 }
 
 
-static Object* Runtime_DebugEvaluateGlobal(Arguments args) {
+static MaybeObject* Runtime_DebugEvaluateGlobal(Arguments args) {
   HandleScope scope;
 
   // Check the execution state and decode arguments frame and source to be
   // evaluated.
   ASSERT(args.length() == 3);
-  Object* check_result = Runtime_CheckExecutionState(args);
-  if (check_result->IsFailure()) return check_result;
+  Object* check_result;
+  { MaybeObject* maybe_check_result = Runtime_CheckExecutionState(args);
+    if (!maybe_check_result->ToObject(&check_result)) {
+      return maybe_check_result;
+    }
+  }
   CONVERT_ARG_CHECKED(String, source, 1);
   CONVERT_BOOLEAN_CHECKED(disable_break, args[2]);
 
   // Handle the processing of break.
   DisableBreak disable_break_save(disable_break);
 
   // Enter the top context from before the debugger was invoked.
   SaveContext save;
   SaveContext* top = &save;
   while (top != NULL && *top->context() == *Debug::debug_context()) {
@@ skipping 22 matching lines @@
   bool has_pending_exception;
   Handle<Object> receiver = Top::global();
   Handle<Object> result =
     Execution::Call(compiled_function, receiver, 0, NULL,
                     &has_pending_exception);
   if (has_pending_exception) return Failure::Exception();
   return *result;
 }
 
 
-static Object* Runtime_DebugGetLoadedScripts(Arguments args) {
+static MaybeObject* Runtime_DebugGetLoadedScripts(Arguments args) {
   HandleScope scope;
   ASSERT(args.length() == 0);
 
   // Fill the script objects.
   Handle<FixedArray> instances = Debug::GetLoadedScripts();
 
   // Convert the script objects to proper JS objects.
   for (int i = 0; i < instances->length(); i++) {
     Handle<Script> script = Handle<Script>(Script::cast(instances->get(i)));
     // Get the script wrapper in a local handle before calling GetScriptWrapper,
@@ skipping 79 matching lines @@
 
   // Return the number of referencing objects found.
   return count;
 }
 
 
 // Scan the heap for objects with direct references to an object
 // args[0]: the object to find references to
 // args[1]: constructor function for instances to exclude (Mirror)
 // args[2]: the the maximum number of objects to return
-static Object* Runtime_DebugReferencedBy(Arguments args) {
+static MaybeObject* Runtime_DebugReferencedBy(Arguments args) {
   ASSERT(args.length() == 3);
 
   // First perform a full GC in order to avoid references from dead objects.
   Heap::CollectAllGarbage(false);
 
   // Check parameters.
   CONVERT_CHECKED(JSObject, target, args[0]);
   Object* instance_filter = args[1];
   RUNTIME_ASSERT(instance_filter->IsUndefined() ||
                  instance_filter->IsJSObject());
   CONVERT_NUMBER_CHECKED(int32_t, max_references, Int32, args[2]);
   RUNTIME_ASSERT(max_references >= 0);
 
   // Get the constructor function for context extension and arguments array.
   JSObject* arguments_boilerplate =
       Top::context()->global_context()->arguments_boilerplate();
   JSFunction* arguments_function =
       JSFunction::cast(arguments_boilerplate->map()->constructor());
 
   // Get the number of referencing objects.
   int count;
   count = DebugReferencedBy(target, instance_filter, max_references,
                             NULL, 0, arguments_function);
 
   // Allocate an array to hold the result.
-  Object* object = Heap::AllocateFixedArray(count);
-  if (object->IsFailure()) return object;
+  Object* object;
+  { MaybeObject* maybe_object = Heap::AllocateFixedArray(count);
+    if (!maybe_object->ToObject(&object)) return maybe_object;
+  }
   FixedArray* instances = FixedArray::cast(object);
 
   // Fill the referencing objects.
   count = DebugReferencedBy(target, instance_filter, max_references,
                             instances, count, arguments_function);
 
   // Return result as JS array.
-  Object* result =
-      Heap::AllocateJSObject(
-          Top::context()->global_context()->array_function());
-  if (!result->IsFailure()) JSArray::cast(result)->SetContent(instances);
+  Object* result;
+  { MaybeObject* maybe_result = Heap::AllocateJSObject(
+        Top::context()->global_context()->array_function());
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
+  JSArray::cast(result)->SetContent(instances);
   return result;
 }
 
 
 // Helper function used by Runtime_DebugConstructedBy below.
 static int DebugConstructedBy(JSFunction* constructor, int max_references,
                               FixedArray* instances, int instances_size) {
   AssertNoAllocation no_alloc;
 
   // Iterate the heap.
@@ skipping 17 matching lines @@
   }
 
   // Return the number of referencing objects found.
   return count;
 }
 
 
 // Scan the heap for objects constructed by a specific function.
 // args[0]: the constructor to find instances of
 // args[1]: the the maximum number of objects to return
-static Object* Runtime_DebugConstructedBy(Arguments args) {
+static MaybeObject* Runtime_DebugConstructedBy(Arguments args) {
   ASSERT(args.length() == 2);
 
   // First perform a full GC in order to avoid dead objects.
   Heap::CollectAllGarbage(false);
 
   // Check parameters.
   CONVERT_CHECKED(JSFunction, constructor, args[0]);
   CONVERT_NUMBER_CHECKED(int32_t, max_references, Int32, args[1]);
   RUNTIME_ASSERT(max_references >= 0);
 
   // Get the number of referencing objects.
   int count;
   count = DebugConstructedBy(constructor, max_references, NULL, 0);
 
   // Allocate an array to hold the result.
-  Object* object = Heap::AllocateFixedArray(count);
-  if (object->IsFailure()) return object;
+  Object* object;
+  { MaybeObject* maybe_object = Heap::AllocateFixedArray(count);
+    if (!maybe_object->ToObject(&object)) return maybe_object;
+  }
   FixedArray* instances = FixedArray::cast(object);
 
   // Fill the referencing objects.
   count = DebugConstructedBy(constructor, max_references, instances, count);
 
   // Return result as JS array.
-  Object* result =
-      Heap::AllocateJSObject(
-          Top::context()->global_context()->array_function());
-  if (!result->IsFailure()) JSArray::cast(result)->SetContent(instances);
+  Object* result;
+  { MaybeObject* maybe_result = Heap::AllocateJSObject(
+        Top::context()->global_context()->array_function());
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
+  JSArray::cast(result)->SetContent(instances);
   return result;
 }
 
 
 // Find the effective prototype object as returned by __proto__.
 // args[0]: the object to find the prototype for.
-static Object* Runtime_DebugGetPrototype(Arguments args) {
+static MaybeObject* Runtime_DebugGetPrototype(Arguments args) {
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSObject, obj, args[0]);
 
   // Use the __proto__ accessor.
   return Accessors::ObjectPrototype.getter(obj, NULL);
 }
 
 
-static Object* Runtime_SystemBreak(Arguments args) {
+static MaybeObject* Runtime_SystemBreak(Arguments args) {
   ASSERT(args.length() == 0);
   CPU::DebugBreak();
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_DebugDisassembleFunction(Arguments args) {
+static MaybeObject* Runtime_DebugDisassembleFunction(Arguments args) {
 #ifdef DEBUG
   HandleScope scope;
   ASSERT(args.length() == 1);
   // Get the function and make sure it is compiled.
   CONVERT_ARG_CHECKED(JSFunction, func, 0);
   Handle<SharedFunctionInfo> shared(func->shared());
   if (!EnsureCompiled(shared, KEEP_EXCEPTION)) {
     return Failure::Exception();
   }
   func->code()->PrintLn();
 #endif  // DEBUG
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_DebugDisassembleConstructor(Arguments args) {
+static MaybeObject* Runtime_DebugDisassembleConstructor(Arguments args) {
 #ifdef DEBUG
   HandleScope scope;
   ASSERT(args.length() == 1);
   // Get the function and make sure it is compiled.
   CONVERT_ARG_CHECKED(JSFunction, func, 0);
   Handle<SharedFunctionInfo> shared(func->shared());
   if (!EnsureCompiled(shared, KEEP_EXCEPTION)) {
     return Failure::Exception();
   }
   shared->construct_stub()->PrintLn();
 #endif  // DEBUG
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_FunctionGetInferredName(Arguments args) {
+static MaybeObject* Runtime_FunctionGetInferredName(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(JSFunction, f, args[0]);
   return f->shared()->inferred_name();
 }
 
 
 static int FindSharedFunctionInfosForScript(Script* script,
                                      FixedArray* buffer) {
@@ skipping 15 matching lines @@
       buffer->set(counter, shared);
     }
     counter++;
   }
   return counter;
 }
 
 // For a script finds all SharedFunctionInfo's in the heap that points
 // to this script. Returns JSArray of SharedFunctionInfo wrapped
 // in OpaqueReferences.
-static Object* Runtime_LiveEditFindSharedFunctionInfosForScript(
+static MaybeObject* Runtime_LiveEditFindSharedFunctionInfosForScript(
     Arguments args) {
   ASSERT(args.length() == 1);
   HandleScope scope;
   CONVERT_CHECKED(JSValue, script_value, args[0]);
 
   Handle<Script> script = Handle<Script>(Script::cast(script_value->value()));
 
   const int kBufferSize = 32;
 
   Handle<FixedArray> array;
@@ skipping 12 matching lines @@
   return *result;
 }
 
 // For a script calculates compilation information about all its functions.
 // The script source is explicitly specified by the second argument.
 // The source of the actual script is not used, however it is important that
 // all generated code keeps references to this particular instance of script.
 // Returns a JSArray of compilation infos. The array is ordered so that
 // each function with all its descendant is always stored in a continues range
 // with the function itself going first. The root function is a script function.
-static Object* Runtime_LiveEditGatherCompileInfo(Arguments args) {
+static MaybeObject* Runtime_LiveEditGatherCompileInfo(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   CONVERT_CHECKED(JSValue, script, args[0]);
   CONVERT_ARG_CHECKED(String, source, 1);
   Handle<Script> script_handle = Handle<Script>(Script::cast(script->value()));
 
   JSArray* result =  LiveEdit::GatherCompileInfo(script_handle, source);
 
   if (Top::has_pending_exception()) {
     return Failure::Exception();
   }
 
   return result;
 }
 
 // Changes the source of the script to a new_source.
 // If old_script_name is provided (i.e. is a String), also creates a copy of
 // the script with its original source and sends notification to debugger.
-static Object* Runtime_LiveEditReplaceScript(Arguments args) {
+static MaybeObject* Runtime_LiveEditReplaceScript(Arguments args) {
   ASSERT(args.length() == 3);
   HandleScope scope;
   CONVERT_CHECKED(JSValue, original_script_value, args[0]);
   CONVERT_ARG_CHECKED(String, new_source, 1);
   Handle<Object> old_script_name(args[2]);
 
   CONVERT_CHECKED(Script, original_script_pointer,
                   original_script_value->value());
   Handle<Script> original_script(original_script_pointer);
 
   Object* old_script = LiveEdit::ChangeScriptSource(original_script,
                                                     new_source,
                                                     old_script_name);
 
   if (old_script->IsScript()) {
     Handle<Script> script_handle(Script::cast(old_script));
     return *(GetScriptWrapper(script_handle));
   } else {
     return Heap::null_value();
   }
 }
 
 // Replaces code of SharedFunctionInfo with a new one.
-static Object* Runtime_LiveEditReplaceFunctionCode(Arguments args) {
+static MaybeObject* Runtime_LiveEditReplaceFunctionCode(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   CONVERT_ARG_CHECKED(JSArray, new_compile_info, 0);
   CONVERT_ARG_CHECKED(JSArray, shared_info, 1);
 
   return LiveEdit::ReplaceFunctionCode(new_compile_info, shared_info);
 }
 
 // Connects SharedFunctionInfo to another script.
-static Object* Runtime_LiveEditFunctionSetScript(Arguments args) {
+static MaybeObject* Runtime_LiveEditFunctionSetScript(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   Handle<Object> function_object(args[0]);
   Handle<Object> script_object(args[1]);
 
   if (function_object->IsJSValue()) {
     Handle<JSValue> function_wrapper = Handle<JSValue>::cast(function_object);
     if (script_object->IsJSValue()) {
       CONVERT_CHECKED(Script, script, JSValue::cast(*script_object)->value());
       script_object = Handle<Object>(script);
     }
 
     LiveEdit::SetFunctionScript(function_wrapper, script_object);
   } else {
     // Just ignore this. We may not have a SharedFunctionInfo for some functions
     // and we check it in this function.
   }
 
   return Heap::undefined_value();
 }
 
 
 // In a code of a parent function replaces original function as embedded object
 // with a substitution one.
-static Object* Runtime_LiveEditReplaceRefToNestedFunction(Arguments args) {
+static MaybeObject* Runtime_LiveEditReplaceRefToNestedFunction(Arguments args) {
   ASSERT(args.length() == 3);
   HandleScope scope;
 
   CONVERT_ARG_CHECKED(JSValue, parent_wrapper, 0);
   CONVERT_ARG_CHECKED(JSValue, orig_wrapper, 1);
   CONVERT_ARG_CHECKED(JSValue, subst_wrapper, 2);
 
   LiveEdit::ReplaceRefToNestedFunction(parent_wrapper, orig_wrapper,
                                        subst_wrapper);
 
   return Heap::undefined_value();
 }
 
 
 // Updates positions of a shared function info (first parameter) according
 // to script source change. Text change is described in second parameter as
 // array of groups of 3 numbers:
 // (change_begin, change_end, change_end_new_position).
 // Each group describes a change in text; groups are sorted by change_begin.
-static Object* Runtime_LiveEditPatchFunctionPositions(Arguments args) {
+static MaybeObject* Runtime_LiveEditPatchFunctionPositions(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   CONVERT_ARG_CHECKED(JSArray, shared_array, 0);
   CONVERT_ARG_CHECKED(JSArray, position_change_array, 1);
 
   return LiveEdit::PatchFunctionPositions(shared_array, position_change_array);
 }
 
 
 // For array of SharedFunctionInfo's (each wrapped in JSValue)
 // checks that none of them have activations on stacks (of any thread).
 // Returns array of the same length with corresponding results of
 // LiveEdit::FunctionPatchabilityStatus type.
-static Object* Runtime_LiveEditCheckAndDropActivations(Arguments args) {
+static MaybeObject* Runtime_LiveEditCheckAndDropActivations(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   CONVERT_ARG_CHECKED(JSArray, shared_array, 0);
   CONVERT_BOOLEAN_CHECKED(do_drop, args[1]);
 
   return *LiveEdit::CheckAndDropActivations(shared_array, do_drop);
 }
 
 // Compares 2 strings line-by-line and returns diff in form of JSArray of
 // triplets (pos1, pos1_end, pos2_end) describing list of diff chunks.
-static Object* Runtime_LiveEditCompareStringsLinewise(Arguments args) {
+static MaybeObject* Runtime_LiveEditCompareStringsLinewise(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   CONVERT_ARG_CHECKED(String, s1, 0);
   CONVERT_ARG_CHECKED(String, s2, 1);
 
   return *LiveEdit::CompareStringsLinewise(s1, s2);
 }
 
 
 
 // A testing entry. Returns statement position which is the closest to
 // source_position.
-static Object* Runtime_GetFunctionCodePositionFromSource(Arguments args) {
+static MaybeObject* Runtime_GetFunctionCodePositionFromSource(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   CONVERT_ARG_CHECKED(JSFunction, function, 0);
   CONVERT_NUMBER_CHECKED(int32_t, source_position, Int32, args[1]);
 
   Handle<Code> code(function->code());
 
   RelocIterator it(*code, 1 << RelocInfo::STATEMENT_POSITION);
   int closest_pc = 0;
   int distance = kMaxInt;
@@ skipping 11 matching lines @@
     it.next();
   }
 
   return Smi::FromInt(closest_pc);
 }
 
 
 // Calls specified function with or without entering the debugger.
 // This is used in unit tests to run code as if debugger is entered or simply
 // to have a stack with C++ frame in the middle.
-static Object* Runtime_ExecuteInDebugContext(Arguments args) {
+static MaybeObject* Runtime_ExecuteInDebugContext(Arguments args) {
   ASSERT(args.length() == 2);
   HandleScope scope;
   CONVERT_ARG_CHECKED(JSFunction, function, 0);
   CONVERT_BOOLEAN_CHECKED(without_debugger, args[1]);
 
   Handle<Object> result;
   bool pending_exception;
   {
     if (without_debugger) {
       result = Execution::Call(function, Top::global(), 0, NULL,
                                &pending_exception);
     } else {
       EnterDebugger enter_debugger;
       result = Execution::Call(function, Top::global(), 0, NULL,
                                &pending_exception);
     }
   }
   if (!pending_exception) {
     return *result;
   } else {
     return Failure::Exception();
   }
 }
 
 
 #endif  // ENABLE_DEBUGGER_SUPPORT
 
 #ifdef ENABLE_LOGGING_AND_PROFILING
 
-static Object* Runtime_ProfilerResume(Arguments args) {
+static MaybeObject* Runtime_ProfilerResume(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(Smi, smi_modules, args[0]);
   CONVERT_CHECKED(Smi, smi_tag, args[1]);
   v8::V8::ResumeProfilerEx(smi_modules->value(), smi_tag->value());
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_ProfilerPause(Arguments args) {
+static MaybeObject* Runtime_ProfilerPause(Arguments args) {
   NoHandleAllocation ha;
   ASSERT(args.length() == 2);
 
   CONVERT_CHECKED(Smi, smi_modules, args[0]);
   CONVERT_CHECKED(Smi, smi_tag, args[1]);
   v8::V8::PauseProfilerEx(smi_modules->value(), smi_tag->value());
   return Heap::undefined_value();
 }
 
 #endif  // ENABLE_LOGGING_AND_PROFILING
@@ skipping 26 matching lines @@
   if (script.is_null()) return Factory::undefined_value();
 
   // Return the script found.
   return GetScriptWrapper(script);
 }
 
 
 // Get the script object from script data. NOTE: Regarding performance
 // see the NOTE for GetScriptFromScriptData.
 // args[0]: script data for the script to find the source for
-static Object* Runtime_GetScript(Arguments args) {
+static MaybeObject* Runtime_GetScript(Arguments args) {
   HandleScope scope;
 
   ASSERT(args.length() == 1);
 
   CONVERT_CHECKED(String, script_name, args[0]);
 
   // Find the requested script.
   Handle<Object> result =
       Runtime_GetScriptFromScriptName(Handle<String>(script_name));
   return *result;
@@ skipping 24 matching lines @@
   // obvious builtin calls.  Some builtin calls (such as Number.ADD
   // which is invoked using 'call') are very difficult to recognize
   // so we're leaving them in for now.
   return *seen_caller && !frame->receiver()->IsJSBuiltinsObject();
 }
 
 
 // Collect the raw data for a stack trace.  Returns an array of three
 // element segments each containing a receiver, function and native
 // code offset.
-static Object* Runtime_CollectStackTrace(Arguments args) {
+static MaybeObject* Runtime_CollectStackTrace(Arguments args) {
   ASSERT_EQ(args.length(), 2);
   Handle<Object> caller = args.at<Object>(0);
   CONVERT_NUMBER_CHECKED(int32_t, limit, Int32, args[1]);
 
   HandleScope scope;
 
   limit = Max(limit, 0);  // Ensure that limit is not negative.
   int initial_size = Min(limit, 10);
   Handle<JSArray> result = Factory::NewJSArray(initial_size * 3);
 
@@ skipping 29 matching lines @@
     }
     iter.Advance();
   }
 
   result->set_length(Smi::FromInt(cursor));
   return *result;
 }
 
 
 // Returns V8 version as a string.
-static Object* Runtime_GetV8Version(Arguments args) {
+static MaybeObject* Runtime_GetV8Version(Arguments args) {
   ASSERT_EQ(args.length(), 0);
 
   NoHandleAllocation ha;
 
   const char* version_string = v8::V8::GetVersion();
 
   return Heap::AllocateStringFromAscii(CStrVector(version_string), NOT_TENURED);
 }
 
 
-static Object* Runtime_Abort(Arguments args) {
+static MaybeObject* Runtime_Abort(Arguments args) {
   ASSERT(args.length() == 2);
   OS::PrintError("abort: %s\n", reinterpret_cast<char*>(args[0]) +
                                     Smi::cast(args[1])->value());
   Top::PrintStack();
   OS::Abort();
   UNREACHABLE();
   return NULL;
 }
 
 
-static Object* Runtime_DeleteHandleScopeExtensions(Arguments args) {
-  ASSERT(args.length() == 0);
-  HandleScope::DeleteExtensions();
-  return Heap::undefined_value();
-}
-
-
-static Object* CacheMiss(FixedArray* cache_obj, int index, Object* key_obj) {
+MUST_USE_RESULT static MaybeObject* CacheMiss(FixedArray* cache_obj,
+                                              int index,
+                                              Object* key_obj) {
   ASSERT(index % 2 == 0);  // index of the key
   ASSERT(index >= JSFunctionResultCache::kEntriesIndex);
   ASSERT(index < cache_obj->length());
 
   HandleScope scope;
 
   Handle<FixedArray> cache(cache_obj);
   Handle<Object> key(key_obj);
   Handle<JSFunction> factory(JSFunction::cast(
         cache->get(JSFunctionResultCache::kFactoryIndex)));
@@ skipping 14 matching lines @@
   }
 
   cache->set(index, *key);
   cache->set(index + 1, *value);
   cache->set(JSFunctionResultCache::kFingerIndex, Smi::FromInt(index));
 
   return *value;
 }
 
 
-static Object* Runtime_GetFromCache(Arguments args) {
+static MaybeObject* Runtime_GetFromCache(Arguments args) {
   // This is only called from codegen, so checks might be more lax.
   CONVERT_CHECKED(FixedArray, cache, args[0]);
   Object* key = args[1];
 
   const int finger_index =
       Smi::cast(cache->get(JSFunctionResultCache::kFingerIndex))->value();
 
   Object* o = cache->get(finger_index);
   if (o == key) {
     // The fastest case: hit the same place again.
@@ skipping 32 matching lines @@
     if (target_index == cache->length()) {
       target_index = JSFunctionResultCache::kEntriesIndex;
     }
     return CacheMiss(cache, target_index, key);
   }
 }
 
 #ifdef DEBUG
 // ListNatives is ONLY used by the fuzz-natives.js in debug mode
 // Exclude the code in release mode.
-static Object* Runtime_ListNatives(Arguments args) {
+static MaybeObject* Runtime_ListNatives(Arguments args) {
   ASSERT(args.length() == 0);
   HandleScope scope;
   Handle<JSArray> result = Factory::NewJSArray(0);
   int index = 0;
   bool inline_runtime_functions = false;
 #define ADD_ENTRY(Name, argc, ressize)                                       \
   {                                                                          \
     HandleScope inner;                                                       \
     Handle<String> name;                                                     \
     /* Inline runtime functions have an underscore in front of the name. */  \
@@ skipping 13 matching lines @@
   RUNTIME_FUNCTION_LIST(ADD_ENTRY)
   inline_runtime_functions = true;
   INLINE_FUNCTION_LIST(ADD_ENTRY)
   INLINE_RUNTIME_FUNCTION_LIST(ADD_ENTRY)
 #undef ADD_ENTRY
   return *result;
 }
 #endif
 
 
-static Object* Runtime_Log(Arguments args) {
+static MaybeObject* Runtime_Log(Arguments args) {
   ASSERT(args.length() == 2);
   CONVERT_CHECKED(String, format, args[0]);
   CONVERT_CHECKED(JSArray, elms, args[1]);
   Vector<const char> chars = format->ToAsciiVector();
   Logger::LogRuntime(chars, elms);
   return Heap::undefined_value();
 }
 
 
-static Object* Runtime_IS_VAR(Arguments args) {
+static MaybeObject* Runtime_IS_VAR(Arguments args) {
   UNREACHABLE();  // implemented as macro in the parser
   return NULL;
 }
 
 
 // ----------------------------------------------------------------------------
 // Implementation of Runtime
 
 #define F(name, number_of_args, result_size)                             \
   { Runtime::k##name, Runtime::RUNTIME, #name,   \
     FUNCTION_ADDR(Runtime_##name), number_of_args, result_size },
 
 
 #define I(name, number_of_args, result_size)                             \
   { Runtime::kInline##name, Runtime::INLINE,     \
     "_" #name, NULL, number_of_args, result_size },
 
 Runtime::Function kIntrinsicFunctions[] = {
   RUNTIME_FUNCTION_LIST(F)
   INLINE_FUNCTION_LIST(I)
   INLINE_RUNTIME_FUNCTION_LIST(I)
 };
 
 
-Object* Runtime::InitializeIntrinsicFunctionNames(Object* dictionary) {
+MaybeObject* Runtime::InitializeIntrinsicFunctionNames(Object* dictionary) {
   ASSERT(dictionary != NULL);
   ASSERT(StringDictionary::cast(dictionary)->NumberOfElements() == 0);
   for (int i = 0; i < kNumFunctions; ++i) {
-    Object* name_symbol = Heap::LookupAsciiSymbol(kIntrinsicFunctions[i].name);
-    if (name_symbol->IsFailure()) return name_symbol;
+    Object* name_symbol;
+    { MaybeObject* maybe_name_symbol =
+          Heap::LookupAsciiSymbol(kIntrinsicFunctions[i].name);
+      if (!maybe_name_symbol->ToObject(&name_symbol)) return maybe_name_symbol;
+    }
     StringDictionary* string_dictionary = StringDictionary::cast(dictionary);
-    dictionary = string_dictionary->Add(String::cast(name_symbol),
-                                        Smi::FromInt(i),
-                                        PropertyDetails(NONE, NORMAL));
-    // Non-recoverable failure.  Calling code must restart heap initialization.
-    if (dictionary->IsFailure()) return dictionary;
+    { MaybeObject* maybe_dictionary = string_dictionary->Add(
+          String::cast(name_symbol),
+          Smi::FromInt(i),
+          PropertyDetails(NONE, NORMAL));
+      if (!maybe_dictionary->ToObject(&dictionary)) {
+        // Non-recoverable failure.  Calling code must restart heap
+        // initialization.
+        return maybe_dictionary;
+      }
+    }
   }
   return dictionary;
 }
 
 
 Runtime::Function* Runtime::FunctionForSymbol(Handle<String> name) {
   int entry = Heap::intrinsic_function_names()->FindEntry(*name);
   if (entry != kNotFound) {
     Object* smi_index = Heap::intrinsic_function_names()->ValueAt(entry);
     int function_index = Smi::cast(smi_index)->value();
@@ skipping 17 matching lines @@
   } else {
     // Handle last resort GC and make sure to allow future allocations
     // to grow the heap without causing GCs (if possible).
     Counters::gc_last_resort_from_js.Increment();
     Heap::CollectAllGarbage(false);
   }
 }
 
 
 } }  // namespace v8::internal