Oilpan: Try to allocate from a smaller FreeListEntry.

PerformanceTests/ShadowDOM/LargeDistributionWithoutLayout allocates a lot of
collection backings with 32KB size and 16KB size. allocateFromFreeList failed
to allocate memory for them frequently even if there were FreeListEntry
with enough sizes because:
 - Actual required size is 32KB+8B or 16KB+8B because of object headers
 - allocateFromFreeList only checked the minimum size of a bucket.  For example,
   a 32KB+8B free slot was listed in the 32KB bucket, and 32KB is smaller than
   32KB+8B.

This CL reduces the peak number of HeapPages in LargeDistributionWithoutLayout
test by 200.

BUG=420515

Review URL: https://codereview.chromium.org/711173004

git-svn-id: svn://svn.chromium.org/blink/trunk@185112 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/platform/heap/Heap.cpp

@@ -729,8 +729,13 @@ bool ThreadHeap<Header>::allocateFromFreeList(size_t minSize)
     size_t bucketSize = 1 << m_freeList.m_biggestFreeListIndex;
     int i = m_freeList.m_biggestFreeListIndex;
     for (; i > 0; i--, bucketSize >>= 1) {
-        if (bucketSize < minSize)
-            break;
+        if (bucketSize < minSize) {
+            // A FreeListEntry for bucketSize might be larger than minSize.
+            // FIXME: We check only the first FreeListEntry because searching
+            // the entire list is costly.
+            if (!m_freeList.m_freeLists[i] || m_freeList.m_freeLists[i]->size() < minSize)
+                break;
+        }
         FreeListEntry* entry = m_freeList.m_freeLists[i];
         if (entry) {
             m_freeList.m_biggestFreeListIndex = i;