Filter out slot buffer slots, that point to SMIs in dead objects.

Filter out slot buffer slots, that point to SMIs in dead objects.

The following situation may happen which reproduces this bug:
(1) We allocate JSObject A on an evacuation candidate.
(2) We allocate JSObject B on a non-evacuation candidate.
(3) Incremental marking starts and marks object A and B.
(4) We create a reference from B.field = A; which records the slot B.field since A is on an evacuation candidate.
(5) After that we write a SMI into B.field.
(6) After that B goes into dictionary mode and shrinks its original size. B.field is now outside of the JSObject, i.e B.field is in memory that will be freed by the sweeper threads.
(7) GC is triggered.
(8) BUG: Slots buffer filtering walks over the slots buffer, SMIs are not filtered out because we assumed that SMIs are just ignored when the slots get updated later. However, recorded SMI slots of dead objects may be overwritten by double values at evacuation time.
(9) During evacuation, a heap number that looks like a valid pointer is moved over B.field.
(10) The slots buffer is scanned for updates, follows B.field since it looks like a pointer (the double value looks like a pointer), and crashes.

BUG=chromium:519577, chromium:454297
LOG=y

Committed: https://crrev.com/8606664b37f4dc4b42106563984c19e4f72d9d3a
Cr-Commit-Position: refs/heads/master@{#30200}

[Hannes Payer (out of office), 2015-08-17 14:56:36]

hpayer@chromium.org changed reviewers:
+ jkummerow@chromium.org

[Jakob Kummerow, 2015-08-17 14:58:55]

lgtm

[Hannes Payer (out of office), 2015-08-17 14:59:20]

The CQ bit was checked by hpayer@chromium.org

[commit-bot: I haz the power, 2015-08-17 14:59:28]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1286343004/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1286343004/1

[commit-bot: I haz the power, 2015-08-17 15:03:07]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-08-17 15:03:07]

Try jobs failed on following builders:
  v8_presubmit on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_presubmit/builds/4962)

[Hannes Payer (out of office), 2015-08-17 15:06:48]

The CQ bit was checked by hpayer@chromium.org

[commit-bot: I haz the power, 2015-08-17 15:06:56]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1286343004/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1286343004/1

[commit-bot: I haz the power, 2015-08-17 15:24:18]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-08-17 15:24:36]

Patchset 1 (id:??) landed as
https://crrev.com/8606664b37f4dc4b42106563984c19e4f72d9d3a
Cr-Commit-Position: refs/heads/master@{#30200}