https://bugs.webkit.org/show_bug.cgi?id=28294

Reviewed by Maciej Stachowiak.

Add a bit to TypeInfo to indicate that an object uses the standard
JSObject::markChildren method.  This allows us to devirtualise marking
of most objects (though a branch is still needed).  We also add a branch
to identify arrays thus devirtualising marking in that case as well.

In order to make the best use of this devirtualisation I've also reworked
the MarkStack::drain() logic to make the iteration more efficient.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@47267 268f45cc-cd09-0410-ab3c-d52691b4dbfc