Fix of argument materialization of captured heap numbers.

Fix of argument materialization of captured heap numbers.

The escape analysis calculates the number of slots in an object as
no-of-slots = object-size / pointer-size.  This gives 3 slots for
heap numbers on 32-bit architectures (one slot for the map, two for
the double value); however, my argument materialization code assumed
just two slots (map + value). Since Hydrogen allocates heap numbers
quite rarely, it is hard to produce a more meaningful repro than the
one provided by Clusterfuzz. Any suggestions are welcome.

The fix is simple - we just read out all extra slots (beyond the map
and the double) for heap numbers.

R=mstarzinger@chromium.org
BUG=351315
LOG=N

Committed: https://code.google.com/p/v8/source/detail?r=19874

[Michael Starzinger, 2014-03-12 09:24:10]

LGTM.

[Jarin, 2014-03-13 07:17:44]

Committed patchset #1 manually as r19874 (presubmit successful).