[bootstrapper] Ensure RegExp constructor has fast properties.

Currently x instanceof RegExp checks cannot take the fast path, since
the RegExp constructor has dictionary properties. To avoid that, just
forcibly migrate the RegExp constructor to fast properties again once
it's fully setup in the bootstrapper. This yields a 10x improvement for
x instanceof RegExp checks.

R=yangguo@chromium.org
BUG=v8:5902

Review-Url: https://codereview.chromium.org/2786143004
Cr-Commit-Position: refs/heads/master@{#44316}

src/bootstrapper.cc

@@ -2437,6 +2437,15 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     native_context()->set_regexp_last_match_info(*last_match_info);
     Handle<RegExpMatchInfo> internal_match_info = factory->NewRegExpMatchInfo();
     native_context()->set_regexp_internal_match_info(*internal_match_info);
+
+    // Force the RegExp constructor to fast properties, so that we can use the
+    // fast paths for various things like
+    //
+    //   x instanceof RegExp
+    //
+    // etc. We should probably come up with a more principled approach once
+    // the JavaScript builtins are gone.
+    JSObject::MigrateSlowToFast(regexp_fun, 0, "Bootstrapping");
   }
 
   {  // -- E r r o r

test/mjsunit/regress/regress-5902.js

@@ -55,7 +55,7 @@ Object.getOwnPropertyNames(global).forEach(function(name) {
 // Remove items as we fix them. See issue 5902.
 assertEquals(
     [
-      'RegExp', 'RegExp.prototype.constructor', 'Error.prototype',
+      'Error.prototype',
       'EvalError.prototype', 'RangeError.prototype', 'ReferenceError.prototype',
       'SyntaxError.prototype', 'TypeError.prototype', 'URIError.prototype',
       'Map', 'Map.prototype.constructor', 'Set', 'Set.prototype.constructor'