1) The Map::CopyInitialMap() did not set descriptor's array if
the source initial map had one.
2) Subclasses are temporarily disallowed to have more in-object
properties than the parent class (for GC reasons).

BUG=v8:3101, v8:3330, v8:4531
LOG=N

Review URL: https://codereview.chromium.org/1431593003

Cr-Commit-Position: refs/heads/master@{#31743}