[runtime] Fix hash used in template cache

Also add a DCHECK to prevent this stupid mistake in the future.

Bug: v8:13190
Fixed: chromium:1363969
Change-Id: Ieb855ccfb42a1a6d84798eb09721d454c355935f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3899313Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83222}

src/objects/hash-table-inl.h

@@ -168,6 +168,7 @@ InternalIndex HashTable<Derived, Shape>::FindEntry(PtrComprCageBase cage_base,
   uint32_t count = 1;
   Object undefined = roots.undefined_value();
   Object the_hole = roots.the_hole_value();
+  DCHECK_EQ(Shape::Hash(roots, key), static_cast<uint32_t>(hash));
   // EnsureCapacity will guarantee the hash table is never full.
   for (InternalIndex entry = FirstProbe(hash, capacity);;
        entry = NextProbe(entry, count++, capacity)) {

src/objects/template-objects.cc

@@ -19,12 +19,13 @@ Handle<JSArray> TemplateObjectDescription::GetTemplateObject(
     Isolate* isolate, Handle<NativeContext> native_context,
     Handle<TemplateObjectDescription> description,
     Handle<SharedFunctionInfo> shared_info, int slot_id) {
-  uint32_t hash = shared_info->Hash();
   int function_literal_id = shared_info->function_literal_id();
 
   // Check the template weakmap to see if the template object already exists.
   Handle<EphemeronHashTable> template_weakmap;
   Handle<Script> script(Script::cast(shared_info->script(isolate)), isolate);
+  int32_t hash =
+      EphemeronHashTable::ShapeT::Hash(ReadOnlyRoots(isolate), script);
   MaybeHandle<CachedTemplateObject> existing_cached_template;
 
   if (native_context->template_weakmap().IsUndefined(isolate)) {