Merged r16346, r16357, r16381 into 3.20 branch.

Added allocation folding support for old space allocations.

Prefill allocated objects with one word fillers if we do not use allocation folding.

Clear next map word when folding allocations into js arrays.

Also manually merged fix for chromium bug 284577, from r16790.

R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/24279003

git-svn-id: https://v8.googlecode.com/svn/branches/3.20@16878 ce2b1a6d-e550-0410-aec6-3dcde31c8c00