And reland "Use a slot that is located on a heap page when removing
invalid entries from the SlotsBuffer."

This reverts commits de018fbd and
d23a9f7a.

Reason for relanding: looking fine on Canary, let's get these fixes back in.

BUG=chromium:454297,chromium:470801
LOG=y
TBR=ishell@chromium.org

Review URL: https://codereview.chromium.org/1043703003

Cr-Commit-Position: refs/heads/master@{#27507}