[stubs] Also handle properties of the JSBuiltinsObject in the fast case.

We can apply the shortcut used for data properties of the JSGlobalObject
to builtin properties as well. This mostly affects the custom properties
we use for the Math functions (i.e. rngstate for Math.random() and kMath
for sin, cos and friends).

Drive-by-fix: Also mark the internal builtin typed arrays properties
(rngstate, kMath and rempio2result) as READ_ONLY, as they should not be
touched after genesis.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1254143003

Cr-Commit-Position: refs/heads/master@{#29887}

src/bootstrapper.cc

@@ -1819,7 +1819,8 @@ Data* SetBuiltinTypedArray(Isolate* isolate, Handle<JSBuiltinsObject> builtins,
   // Reset property cell type before (re)initializing.
   JSBuiltinsObject::InvalidatePropertyCell(builtins, name_string);
   JSObject::SetOwnPropertyIgnoreAttributes(builtins, name_string, typed_array,
-                                           DONT_DELETE).Assert();
+                                           FROZEN)
+      .Assert();
   return data;
 }
 

src/runtime/runtime-object.cc

@@ -437,8 +437,8 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalViaContext) {
 
   // Switch to fast mode only if there is a data property and it's not on
   // a hidden prototype.
-  if (LookupIterator::DATA == it.state() &&
-      it.GetHolder<Object>()->IsJSGlobalObject()) {
+  if (it.state() == LookupIterator::DATA &&
+      it.GetHolder<Object>().is_identical_to(global_object)) {
     // Now update the cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(slot, *cell);
@@ -469,10 +469,11 @@ Object* StoreGlobalViaContext(Isolate* isolate, int slot, Handle<Object> value,
   Handle<Name> name(scope_info->ContextSlotName(slot), isolate);
   Handle<GlobalObject> global_object(script_context->global_object(), isolate);
   LookupIterator it(global_object, name, LookupIterator::HIDDEN);
+
   // Switch to fast mode only if there is a data property and it's not on
   // a hidden prototype.
-  if (LookupIterator::DATA == it.state() &&
-      it.GetHolder<Object>()->IsJSGlobalObject()) {
+  if (it.state() == LookupIterator::DATA &&
+      it.GetHolder<Object>().is_identical_to(global_object)) {
     // Now update cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(slot, *cell);