Liftoff could only call to code object on the gc heap so far. This CL
extends this to support calls to the native wasm heap. This became
urgent since --jit-to-native is enabled by default now.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Ie07416a4041d4e6ea26a8c315008a41d81f52aab
Reviewed-on: https://chromium-review.googlesource.com/863667
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50537}