Add logic to collect dirty objects as roots

Add logic to collect dirty objects as roots
https://bugs.webkit.org/show_bug.cgi?id=69100

Reviewed by Geoff Garen.

This gives us the ability to walk all the MarkedBlocks in an
AllocationSpace and collect the dirty objects, and then use
them as GC roots.

* dfg/DFGJITCodeGenerator.cpp:
(JSC::DFG::JITCodeGenerator::markCellCard):
* dfg/DFGJITCodeGenerator32_64.cpp:
(JSC::DFG::JITCodeGenerator::markCellCard):
* heap/AllocationSpace.cpp:
   Tidy up the write barrier logic a bit
(JSC::MarkedBlock::gatherDirtyObjects):
(JSC::TakeIfDirty::returnValue):
(JSC::TakeIfDirty::TakeIfDirty):
(JSC::TakeIfDirty::operator()):
(JSC::AllocationSpace::gatherDirtyObjects):
* heap/AllocationSpace.h:
* heap/CardSet.h:
(JSC::::isCardMarked):
(JSC::::clearCard):
* heap/Heap.cpp:
(JSC::Heap::markRoots):
* heap/Heap.h:
(JSC::Heap::writeBarrier):
* heap/MarkStack.cpp:
(JSC::SlotVisitor::visitChildren):
* heap/MarkedBlock.h:
(JSC::MarkedBlock::setDirtyObject):
(JSC::MarkedBlock::addressOfCardFor):
* heap/SlotVisitor.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitWriteBarrier):
   Tidy the write barrier a bit

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@96372 268f45cc-cd09-0410-ab3c-d52691b4dbfc