Use weak cells to embed maps in store handler.

Use weak cells to embed maps in store handler.

BUG=v8:3629
LOG=N

[ulan, 2014-12-03 12:26:01]

ulan@chromium.org changed reviewers:
+ verwaest@chromium.org

[ulan, 2014-12-03 12:26:02]

PTAL

[Toon Verwaest, 2014-12-03 12:29:04]

lgtm

[ulan, 2014-12-03 12:48:20]

The CQ bit was checked by ulan@chromium.org

[commit-bot: I haz the power, 2014-12-03 12:49:02]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/774473004/1

[commit-bot: I haz the power, 2014-12-03 13:07:34]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-12-03 13:07:35]

Try jobs failed on following builders:
  v8_linux_arm64_rel on tryserver.v8
(http://build.chromium.org/p/tryserver.v8/builders/v8_linux_arm64_rel/builds/1515)

[ulan, 2014-12-03 13:10:43]

The CQ bit was checked by ulan@chromium.org

[commit-bot: I haz the power, 2014-12-03 13:11:13]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/774473004/20001

[commit-bot: I haz the power, 2014-12-03 13:36:54]

Committed patchset #2 (id:20001)

[adamk, 2014-12-04 21:27:01]

On 2014/12/03 13:36:54, I haz the power (commit-bot) wrote:
> Committed patchset #2 (id:20001)

This patch seems to be causing failures on the arm64 debug gc stress bot; this
is the first failure:

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20s...

I can reproduce with the commandline:

out/arm64.debug/d8 --test --random-seed=1979322950 --stress-opt --always-opt
--nohard-abort --nodead-code-elimination --nofold-constants
--enable-slow-asserts --debug-code --verify-heap --expose-debug-as debug
--expose-gc test/mjsunit/mjsunit.js test/mjsunit/es6/mirror-collections.js
--gc-interval=500 --stress-compaction --concurrent-recompilation-queue-length=64
--concurrent-recompilation-delay=500 --concurrent-recompilation

and reverting this change clears up the failure.

[ulan, 2014-12-05 13:00:34]

> I can reproduce with the commandline:
> 
> out/arm64.debug/d8 --test --random-seed=1979322950 --stress-opt --always-opt
> --nohard-abort --nodead-code-elimination --nofold-constants
> --enable-slow-asserts --debug-code --verify-heap --expose-debug-as debug
> --expose-gc test/mjsunit/mjsunit.js test/mjsunit/es6/mirror-collections.js
> --gc-interval=500 --stress-compaction
--concurrent-recompilation-queue-length=64
> --concurrent-recompilation-delay=500 --concurrent-recompilation
> 
> and reverting this change clears up the failure.

This uncovered an existing bug. The fix is in review:
https://codereview.chromium.org/783673002/