Deserializing the partial snapshot may prematurely stop using a map page, adding a free-space filler at the end. Scan-on-scavenge of map-space did not expect anything but maps, and would interpret the uninitialized memory as pointers. Using the heap iterator we can skip over free space and only visit maps.

BUG=390732
LOG=y
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/364063007

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22208 ce2b1a6d-e550-0410-aec6-3dcde31c8c00