Clear old backing store of WeakCollection on updates.

Clear old backing store of WeakCollection on updates.

Not clearing can lead to a crash under following conditions:
1. Backing store of a weak map is allocated in large object space.
2. The backing store is marked incrementaly via the weak map.
3. The weak map is updated and gets a new backing store.
4. The store buffer overflows and marks the chunk of the old backing store as
"scan on scavenge."
5. Mark-compact collection kills some elements of the weak map. Note that the
old backing store survives because it was marked incrementally, but its dead
elements are not cleared.
6. Scavenger iterates over the old backing store, tries to move a dead object
and crashes.

BUG=v8:3631
LOG=N
TEST=cctest/test-heap/Regress3631
R=jkummerow@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=25032

[ulan, 2014-10-28 17:15:42]

ulan@chromium.org changed reviewers:
+ jkummerow@chromium.org

[ulan, 2014-10-28 17:15:42]

PTAL

[Jakob Kummerow, 2014-10-29 12:00:44]

LGTM

[ulan, 2014-10-31 13:11:38]

Committed patchset #2 (id:20001) manually as 25032 (presubmit successful).