Hand out freelist entries more accurately relative to page boundaries.

This fixes a minor inefficiency in freelist filling. In some cases, we were
not writing a freelist pointer that fit within the bounds of the faulted page,
leading to hitting the partitionAlloc slow path to fetch more freelist entries
more often than is necessary.

The logic now also assumes that any returned object will be fully written to,
leading to more opportunities to write an extra freelist pointer in to the
last faulted page.

Review URL: https://codereview.chromium.org/108573011

git-svn-id: svn://svn.chromium.org/blink/trunk@164271 bbb929c8-8fbe-4397-9dbb-9b2b20218538