Merged r16346, r16357, r16381 into 3.20 branch.

Merged r16346, r16357, r16381 into 3.20 branch.

Added allocation folding support for old space allocations.

Prefill allocated objects with one word fillers if we do not use allocation folding.

Clear next map word when folding allocations into js arrays.

Also manually merged fix for chromium bug 284577, from r16790.

R=hpayer@chromium.org
BUG=

Committed: https://code.google.com/p/v8/source/detail?r=16878

[Hannes Payer (out of office), 2013-09-23 11:15:42]

LGTM

[mvstanton, 2013-09-23 11:26:16]

Committed patchset #1 manually as r16878 (presubmit successful).