This is a reland of 21adacab

The failure that caused this revert is unrelated to this change
and is fixed in a separate CL (https://crbug.com/v8/9123).

Original change's description:
> Reserve two in-object properties slots for JSErrors
>
> The most common use-case for creating errors is "new Error('message')".
> The resulting JSError object has two properties. The message passed to
> the constructor and an accessor for the stack.
>
> This CL reserves two in-object property slots for these two, so no
> PropertyArray has to be created.
>
> Bug: v8:9116
> Change-Id: I84467453446f333bf65425807707ee6581894e61
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564195
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60791}

Bug: v8:9116
Change-Id: I5b0e0183ca0cbc55739aae9097c08aee34b4fa54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564059
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60809}