Reland "Reserve two in-object properties slots for JSErrors"

This is a reland of 21adacab

The failure that caused this revert is unrelated to this change
and is fixed in a separate CL (https://crbug.com/v8/9123).

Original change's description:
> Reserve two in-object properties slots for JSErrors
>
> The most common use-case for creating errors is "new Error('message')".
> The resulting JSError object has two properties. The message passed to
> the constructor and an accessor for the stack.
>
> This CL reserves two in-object property slots for these two, so no
> PropertyArray has to be created.
>
> Bug: v8:9116
> Change-Id: I84467453446f333bf65425807707ee6581894e61
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564195
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60791}

Bug: v8:9116
Change-Id: I5b0e0183ca0cbc55739aae9097c08aee34b4fa54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564059
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60809}

src/bootstrapper.cc

@@ -1312,9 +1312,15 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
                          Handle<String> name, int context_index) {
   Factory* factory = isolate->factory();
 
-  Handle<JSFunction> error_fun = InstallFunction(
-      isolate, global, name, JS_ERROR_TYPE, JSObject::kHeaderSize, 0,
-      factory->the_hole_value(), Builtins::kErrorConstructor);
+  // Most Error objects consist of a message and a stack trace.
+  // Reserve two in-object properties for these.
+  const int kInObjectPropertiesCount = 2;
+  const int kErrorObjectSize =
+      JSObject::kHeaderSize + kInObjectPropertiesCount * kTaggedSize;
+  Handle<JSFunction> error_fun =
+      InstallFunction(isolate, global, name, JS_ERROR_TYPE, kErrorObjectSize,
+                      kInObjectPropertiesCount, factory->the_hole_value(),
+                      Builtins::kErrorConstructor);
   error_fun->shared()->DontAdaptArguments();
   error_fun->shared()->set_length(1);