Fix the missed store buffer entries for live objects on aborted pages. Marking
the page as scan_on_scavenge takes care of rebuilding the entries. Note that
this requires an additional case in the rebuilding logic as we cannot iterate an
aborted pages using the object layout, but rather have to use mark bits for
this.

BUG=chromium:524425, chromium:564498
LOG=N

Review URL: https://codereview.chromium.org/1497883003

Cr-Commit-Position: refs/heads/master@{#32610}