[heap] Only insert new slot set entries.

BUG=chromium:648973,chromium:648568

Review-Url: https://codereview.chromium.org/2360233002
Cr-Commit-Position: refs/heads/master@{#39624}

src/heap/slot-set.h

@@ -48,8 +48,10 @@ class SlotSet : public Malloced {
       current_bucket = AllocateBucket();
       bucket[bucket_index].SetValue(current_bucket);
     }
+    if (!(current_bucket[cell_index].Value() & (1u << bit_index))) {
       current_bucket[cell_index].SetBit(bit_index);
     }
+  }
 
   // The slot offset specifies a slot at address page_start_ + slot_offset.
   void Remove(int slot_offset) {