Revert of [heap] Fine-grained JSArrayBuffer tracking

Revert of [heap] Fine-grained JSArrayBuffer tracking (patchset #19 id:770001 of https://codereview.chromium.org/1964023002/ )

Reason for revert:
Causing frequent test flakes on maps_pixel_tests on various chromium bots.

For example in 
https://build.chromium.org/p/chromium.gpu/builders/Linux%20Release%20%28NVIDIA%29/builds/78677/steps/maps_pixel_test%20on%20NVIDIA%20GPU%20on%20Linux%20on%20Linux/logs/stdio

it crashes in 
	 0  chrome!Process<(lambda at ../../v8/src/heap/array-buffer-tracker-inl.h:51:15)> [spaces.h : 962 + 0x0]
	 1  chrome!EvacuatePage [array-buffer-tracker-inl.h : 51 + 0x5]
	 2  chrome!RunInternal [mark-compact.cc : 3213 + 0x5]
...

Original issue's description:
> [heap] Fine-grained JSArrayBuffer tracking
> 
> Track based on JSArrayBuffer addresses instead of the attached backing store.
> This way we can later on iterate buffers on a single page. The reland also
> switches to a page-based implementation where a page contains the set of its
> contained (live and dead) buffers.
> 
> Details of tracking:
> - Scavenge: New space pages are processes in bulk on the main thread
> - MC: Unswept pages are processed in bulk in parallel. All other pages
>   are processed by the sweeper concurrently.
> 
> BUG=chromium:611688
> LOG=N
> CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
> 
> Committed: https://crrev.com/b2d8bfc7931eef49d527605ba485950dea41cde3
> Cr-Commit-Position: refs/heads/master@{#36437}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:611688

[Marijn Kruisselbrink, 2016-05-23 21:40:56]

Created Revert of [heap] Fine-grained JSArrayBuffer tracking

[commit-bot: I haz the power, 2016-05-23 21:41:01]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2006923002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2006923002/1

[commit-bot: I haz the power, 2016-05-23 21:41:02]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-05-23 21:41:03]

No L-G-T-M from a valid reviewer yet. 
CQ run can only be started by full committers or once the patch has
received an L-G-T-M from a full committer.
Even if an L-G-T-M may have been provided, it was from a non-committer,
_not_ a full super star committer.
Committers are members of the group "project-v8-committers".
Note that this has nothing to do with OWNERS files.

[Michael Lippautz, 2016-05-24 06:20:53]

lgtm

[Michael Lippautz, 2016-05-24 06:20:57]

The CQ bit was checked by mlippautz@chromium.org

[commit-bot: I haz the power, 2016-05-24 06:21:04]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2006923002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2006923002/1

[commit-bot: I haz the power, 2016-05-24 06:21:15]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-05-24 06:21:16]

Failed to apply patch for src/heap/scavenger.cc:
While running git apply --index -3 -p1;
  error: patch failed: src/heap/scavenger.cc:289
  Falling back to three-way merge...
  Applied patch to 'src/heap/scavenger.cc' with conflicts.
  U src/heap/scavenger.cc

Patch:       src/heap/scavenger.cc
Index: src/heap/scavenger.cc
diff --git a/src/heap/scavenger.cc b/src/heap/scavenger.cc
index
51968c3990b23f1916a773917b17d801052071f8..1d785d08d24232388be4d45603d68f9da313c22a
100644
--- a/src/heap/scavenger.cc
+++ b/src/heap/scavenger.cc
@@ -289,6 +289,14 @@
   static inline void EvacuateJSArrayBuffer(Map* map, HeapObject** slot,
                                            HeapObject* object) {
     ObjectEvacuationStrategy<POINTER_OBJECT>::Visit(map, slot, object);
+
+    Heap* heap = map->GetHeap();
+    MapWord map_word = object->map_word();
+    DCHECK(map_word.IsForwardingAddress());
+    HeapObject* target = map_word.ToForwardingAddress();
+    if (!heap->InNewSpace(target)) {
+      heap->array_buffer_tracker()->Promote(JSArrayBuffer::cast(target));
+    }
   }

[commit-bot: I haz the power, 2016-05-24 06:21:16]

The CQ bit was unchecked by commit-bot@chromium.org

[Michael Lippautz, 2016-05-24 07:21:37]

Description was changed from

==========
Revert of [heap] Fine-grained JSArrayBuffer tracking (patchset #19 id:770001 of
https://codereview.chromium.org/1964023002/ )

Reason for revert:
Causing frequent test flakes on maps_pixel_tests on various chromium bots.

For example in 
https://build.chromium.org/p/chromium.gpu/builders/Linux%20Release%20%28NVIDI...

it crashes in 
	 0  chrome!Process<(lambda at
../../v8/src/heap/array-buffer-tracker-inl.h:51:15)> [spaces.h : 962 + 0x0]
	 1  chrome!EvacuatePage [array-buffer-tracker-inl.h : 51 + 0x5]
	 2  chrome!RunInternal [mark-compact.cc : 3213 + 0x5]
...

Original issue's description:
> [heap] Fine-grained JSArrayBuffer tracking
> 
> Track based on JSArrayBuffer addresses instead of the attached backing store.
> This way we can later on iterate buffers on a single page. The reland also
> switches to a page-based implementation where a page contains the set of its
> contained (live and dead) buffers.
> 
> Details of tracking:
> - Scavenge: New space pages are processes in bulk on the main thread
> - MC: Unswept pages are processed in bulk in parallel. All other pages
>   are processed by the sweeper concurrently.
> 
> BUG=chromium:611688
> LOG=N
>
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
> 
> Committed: https://crrev.com/b2d8bfc7931eef49d527605ba485950dea41cde3
> Cr-Commit-Position: refs/heads/master@{#36437}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:611688
==========

to

==========
Revert of [heap] Fine-grained JSArrayBuffer tracking (patchset #19 id:770001 of
https://codereview.chromium.org/1964023002/ )

Reason for revert:
Causing frequent test flakes on maps_pixel_tests on various chromium bots.

For example in 
https://build.chromium.org/p/chromium.gpu/builders/Linux%20Release%20%28NVIDI...

it crashes in 
	 0  chrome!Process<(lambda at
../../v8/src/heap/array-buffer-tracker-inl.h:51:15)> [spaces.h : 962 + 0x0]
	 1  chrome!EvacuatePage [array-buffer-tracker-inl.h : 51 + 0x5]
	 2  chrome!RunInternal [mark-compact.cc : 3213 + 0x5]
...

Original issue's description:
> [heap] Fine-grained JSArrayBuffer tracking
> 
> Track based on JSArrayBuffer addresses instead of the attached backing store.
> This way we can later on iterate buffers on a single page. The reland also
> switches to a page-based implementation where a page contains the set of its
> contained (live and dead) buffers.
> 
> Details of tracking:
> - Scavenge: New space pages are processes in bulk on the main thread
> - MC: Unswept pages are processed in bulk in parallel. All other pages
>   are processed by the sweeper concurrently.
> 
> BUG=chromium:611688
> LOG=N
>
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
> 
> Committed: https://crrev.com/b2d8bfc7931eef49d527605ba485950dea41cde3
> Cr-Commit-Position: refs/heads/master@{#36437}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:611688
==========