Create a new paged heap space for global property cells. The new...

src/heap.h

Index: src/heap.h
===================================================================
--- src/heap.h	(revision 2377)
+++ src/heap.h	(working copy)
@@ -103,8 +103,8 @@
   V(Map, boilerplate_function_map)                      \
   V(Map, shared_function_info_map)                      \
   V(Map, proxy_map)                                     \
-  V(Map, one_word_filler_map)                           \
-  V(Map, two_word_filler_map)                           \
+  V(Map, one_pointer_filler_map)                        \
+  V(Map, two_pointer_filler_map)                        \
   V(Object, nan_value)                                  \
   V(Object, undefined_value)                            \
   V(Object, minus_zero_value)                           \
@@ -261,6 +261,7 @@
   static OldSpace* old_data_space() { return old_data_space_; }
   static OldSpace* code_space() { return code_space_; }
   static MapSpace* map_space() { return map_space_; }
+  static CellSpace* cell_space() { return cell_space_; }
   static LargeObjectSpace* lo_space() { return lo_space_; }
 
   static bool always_allocate() { return always_allocate_scope_depth_ != 0; }
@@ -837,6 +838,7 @@
   static OldSpace* old_data_space_;
   static OldSpace* code_space_;
   static MapSpace* map_space_;
+  static CellSpace* cell_space_;
   static LargeObjectSpace* lo_space_;
   static HeapState gc_state_;
 
@@ -924,8 +926,11 @@
   // to Heap::AllocateRaw(size_in_bytes, MAP_SPACE), except that (a) it doesn't
   // have to test the allocation space argument and (b) can reduce code size
   // (since both AllocateRaw and AllocateRawMap are inlined).
-  static inline Object* AllocateRawMap(int size_in_bytes);
+  static inline Object* AllocateRawMap();
 
+  // Allocate an uninitialized object in the global property cell space.
+  static inline Object* AllocateRawCell();
+
   // Initializes a JSObject based on its map.
   static void InitializeJSObjectFromMap(JSObject* obj,
                                         FixedArray* properties,