More -fsanitize=vptr fixes.

This actually fixes 3 different issues when accessing Operand1:

   * Object vs. HeapObject

   * Wrong defaults for equals/hash

   * silently dropping const

TEST=test/mjsunit/regress/regress-441099.js
BUG=chromium:441099
LOG=y

Review URL: https://codereview.chromium.org/812563002

Cr-Commit-Position: refs/heads/master@{#25843}
Follow-up to r25822: only internalize short strings optimistically

BUG=chromium:442703
LOG=n
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/809723002

Cr-Commit-Position: refs/heads/master@{#25844}
Add tools/find-commit-for-patch.py

It searches for a commit that a given patch can cleanly be applied to.

Review URL: https://codereview.chromium.org/799273003

Cr-Commit-Position: refs/heads/master@{#25845}
Bump the limit for test-heap/TestSizeOfRegExpCode

R=erik.corry@gmail.com

Review URL: https://codereview.chromium.org/808773003

Cr-Commit-Position: refs/heads/master@{#25846}