Added special handling for Map and Set in the heap snapshot generator.

Extracted common base type from JSMap/JSSet similar to JSWeakMap/JSWeakSet.

After handling collection specific properties all collections are processed as regular JSObject to make sure all regular properties set on them are present in the heap snapshot.

BUG=v8:3368
LOG=Y
R=alph@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/373183002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22311 ce2b1a6d-e550-0410-aec6-3dcde31c8c00