More -fsanitize=vptr fixes.

More -fsanitize=vptr fixes.

This actually fixes 3 different issues when accessing Operand1:

   * Object vs. HeapObject

   * Wrong defaults for equals/hash

   * silently dropping const

TEST=test/mjsunit/regress/regress-441099.js
BUG=chromium:441099
LOG=y

Committed: https://crrev.com/cbf3b0bcc745536ee97ca21a3f9a7e613f31bc18
Cr-Commit-Position: refs/heads/master@{#25843}

[Sven Panne, 2014-12-16 12:45:32]

svenpanne@chromium.org changed reviewers:
+ bmeurer@chromium.org

[Benedikt Meurer, 2014-12-16 13:01:03]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2014-12-16 13:01:03]

Urgs...LGTM

[commit-bot: I haz the power, 2014-12-16 13:01:38]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/812563002/1

[commit-bot: I haz the power, 2014-12-16 14:20:23]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2014-12-17 10:14:15]

Patchset 1 (id:??) landed as
https://crrev.com/cbf3b0bcc745536ee97ca21a3f9a7e613f31bc18
Cr-Commit-Position: refs/heads/master@{#25843}