Reserve two in-object properties slots for JSErrors

The most common use-case for creating errors is "new Error('message')".
The resulting JSError object has two properties. The message passed to
the constructor and an accessor for the stack.

This CL reserves two in-object property slots for these two, so no
PropertyArray has to be created.

Bug: v8:9116
Change-Id: I84467453446f333bf65425807707ee6581894e61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564195Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60791}

src/bootstrapper.cc

@@ -1312,9 +1312,15 @@ static void InstallError(Isolate* isolate, Handle<JSObject> global,
                          Handle<String> name, int context_index) {
   Factory* factory = isolate->factory();
 
-  Handle<JSFunction> error_fun = InstallFunction(
-      isolate, global, name, JS_ERROR_TYPE, JSObject::kHeaderSize, 0,
-      factory->the_hole_value(), Builtins::kErrorConstructor);
+  // Most Error objects consist of a message and a stack trace.
+  // Reserve two in-object properties for these.
+  const int kInObjectPropertiesCount = 2;
+  const int kErrorObjectSize =
+      JSObject::kHeaderSize + kInObjectPropertiesCount * kTaggedSize;
+  Handle<JSFunction> error_fun =
+      InstallFunction(isolate, global, name, JS_ERROR_TYPE, kErrorObjectSize,
+                      kInObjectPropertiesCount, factory->the_hole_value(),
+                      Builtins::kErrorConstructor);
   error_fun->shared()->DontAdaptArguments();
   error_fun->shared()->set_length(1);