Add HeapNumber fast path to v8::Value::{Uint,Int}32Value()

This has the added benefit that these functions are now guaranteed not to throw when v8::Value::Is{Uint,Int}32() returned true, even when calling into JavaScript would throw a stack limit error.

BUG=chromium:446097
LOG=y

Review URL: https://codereview.chromium.org/873983003

Cr-Commit-Position: refs/heads/master@{#26273}

src/api.cc

@@ -2840,8 +2840,8 @@ Local<Uint32> Value::ToArrayIndex() const {
 
 int32_t Value::Int32Value() const {
   i::Handle<i::Object> obj = Utils::OpenHandle(this);
-  if (obj->IsSmi()) {
-    return i::Smi::cast(*obj)->value();
+  if (obj->IsNumber()) {
+    return NumberToInt32(*obj);
   } else {
     i::Isolate* isolate = i::HeapObject::cast(*obj)->GetIsolate();
     LOG_API(isolate, "Int32Value (slow)");
@@ -2941,8 +2941,8 @@ bool Value::SameValue(Handle<Value> that) const {
 
 uint32_t Value::Uint32Value() const {
   i::Handle<i::Object> obj = Utils::OpenHandle(this);
-  if (obj->IsSmi()) {
-    return i::Smi::cast(*obj)->value();
+  if (obj->IsNumber()) {
+    return NumberToUint32(*obj);
   } else {
     i::Isolate* isolate = i::HeapObject::cast(*obj)->GetIsolate();
     LOG_API(isolate, "Uint32Value");