Fix Regress3540 after r25441.

test/cctest/test-spaces.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 204 matching lines @@
   const size_t code_range_size = 4 * MB;
   if (!code_range->SetUp(
           code_range_size +
           RoundUp(v8::base::OS::CommitPageSize() * kReservedCodeRangePages,
                   MemoryChunk::kAlignment) +
           v8::internal::MemoryAllocator::CodePageAreaSize())) {
     return;
   }
   Address address;
   size_t size;
-  address = code_range->AllocateRawMemory(code_range_size - MB,
-                                          code_range_size - MB, &size);
+  address = code_range->AllocateRawMemory(code_range_size - 2 * MB,
+                                          code_range_size - 2 * MB, &size);
   CHECK(address != NULL);
   Address null_address;
   size_t null_size;
   null_address = code_range->AllocateRawMemory(
       code_range_size - MB, code_range_size - MB, &null_size);
   CHECK(null_address == NULL);
   code_range->FreeRawMemory(address, size);
   delete code_range;
   memory_allocator->TearDown();
   delete memory_allocator;
@@ skipping 265 matching lines @@
 
       // Turn the allocation into a proper object so isolate teardown won't
       // crash.
       v8::internal::FreeListNode* node =
           v8::internal::FreeListNode::cast(allocation.ToObjectChecked());
       node->set_size(new_space->heap(), 80);
     }
   }
   isolate->Dispose();
 }