Fix memory leak caused by field type in descriptor array.

Fix memory leak caused by field type in descriptor array.

When a field type is a map, it is wrapped in a weak cell upon storing to the descriptor array.

Map::GetFieldType(i) does the unwrapping.

BUG=v8:3877
LOG=N
TEST=cctest/test-heap/Regress3877

Committed: https://crrev.com/77d3ae0e119893ac8d34ea6ca090cddd5bbf987e
Cr-Commit-Position: refs/heads/master@{#26879}

[ulan, 2015-02-26 09:46:22]

ulan@chromium.org changed reviewers:
+ verwaest@chromium.org

[ulan, 2015-02-26 09:46:22]

PTAL

[Toon Verwaest, 2015-02-26 10:00:28]

Looks good, but what about getting rid of using HeapType altogether for the
field type?

[Toon Verwaest, 2015-02-26 10:49:41]

lgtm

[ulan, 2015-02-26 10:54:07]

On 2015/02/26 10:49:41, Toon Verwaest wrote:
> lgtm
Thanks, landing.

> Looks good, but what about getting rid of using HeapType altogether for the
field type?
As discussed offline, I will replace HeapType with a simpler type in a separate
CL as that cleanup is unrelated to weak cell wrapping.

[ulan, 2015-02-26 10:54:22]

The CQ bit was checked by ulan@chromium.org

[commit-bot: I haz the power, 2015-02-26 10:56:04]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/955063002/20001

[commit-bot: I haz the power, 2015-02-26 10:59:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-02-26 10:59:56]

Try jobs failed on following builders:
  v8_linux_nodcheck_rel on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_nodcheck_rel/build...)

[ulan, 2015-02-26 12:52:47]

The CQ bit was checked by ulan@chromium.org

[ulan, 2015-02-26 12:52:48]

The patchset sent to the CQ was uploaded after l-g-t-m from
verwaest@chromium.org
Link to the patchset: https://codereview.chromium.org/955063002/#ps40001 (title:
"Remove unused var in release.")

[commit-bot: I haz the power, 2015-02-26 12:54:54]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/955063002/40001

[commit-bot: I haz the power, 2015-02-26 13:16:38]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2015-02-26 13:16:49]

Patchset 3 (id:??) landed as
https://crrev.com/77d3ae0e119893ac8d34ea6ca090cddd5bbf987e
Cr-Commit-Position: refs/heads/master@{#26879}

[marja, 2015-02-26 14:45:24]

A revert of this CL (patchset #3 id:40001) has been created in
https://codereview.chromium.org/960103003/ by marja@chromium.org.

The reason for reverting is: Breaks test/mjsunit/debug-clearbreakpointgroup.js
on arm64.debug..