Land number collision fix for v8 3.6 by Erik Corry

Update with fixes from: http://codereview.chromium.org/9190001/

deps/v8/src/ia32/code-stubs-ia32.cc

@@ -5614,6 +5614,7 @@ void StringHelper::GenerateHashInit(MacroAssembler* masm,
     __ mov(scratch, Operand::StaticArray(scratch,
                                          times_pointer_size,
                                          roots_address));
+    __ SmiUntag(scratch);
     __ add(scratch, Operand(character));
     __ mov(hash, scratch);
     __ shl(scratch, 10);

deps/v8/src/objects.h

@@ -2534,9 +2534,7 @@ class HashTable: public FixedArray {
   // Wrapper methods
   inline uint32_t Hash(Key key) {
     if (Shape::UsesSeed) {
-      // I'm using map()->heap() to skip is_safe_to_read_maps assertion.
-      // That was done, because NumberDictionary is used inside GC.
-      return Shape::SeededHash(key, map()->heap()->HashSeed());
+      return Shape::SeededHash(key, GetHeap()->HashSeed());
     } else {
       return Shape::Hash(key);
     }
@@ -2544,9 +2542,7 @@ class HashTable: public FixedArray {
 
   inline uint32_t HashForObject(Key key, Object* object) {
     if (Shape::UsesSeed) {
-      // I'm using map()->heap() to skip is_safe_to_read_maps assertion.
-      // That was done, because NumberDictionary is used inside GC.
-      return Shape::SeededHashForObject(key, map()->heap()->HashSeed(), object);
+      return Shape::SeededHashForObject(key, GetHeap()->HashSeed(), object);
     } else {
       return Shape::HashForObject(key, object);
     }