[wasm] Load call builtin in JS-to-JS wrappers.

This loads the call builtin from the Isolate root instead of embedding
it into the instruction stream. This can be more efficient, but more
importantly it fixes an issue with tracing and eventually allows for
background compilation of these wrappers.

R=clemensh@chromium.org
TEST=mjsunit/regress/wasm/regress-crbug-1006631
BUG=chromium:1006631

Change-Id: Ife1bc513340d233a3c01789c7b56126fe3b87f6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815245Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63924}

src/compiler/wasm-compiler.cc

@@ -6112,8 +6112,8 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
     // Call the underlying closure.
     Vector<Node*> args = Buffer(wasm_count + 7);
     int pos = 0;
-    args[pos++] = graph()->NewNode(mcgraph()->common()->HeapConstant(
-        BUILTIN_CODE(isolate, Call_ReceiverIsAny)));
+    args[pos++] =
+        BuildLoadBuiltinFromIsolateRoot(Builtins::kCall_ReceiverIsAny);
     args[pos++] = callable;
     args[pos++] = mcgraph()->Int32Constant(wasm_count);   // argument count
     args[pos++] = BuildLoadUndefinedValueFromInstance();  // receiver

test/mjsunit/regress/wasm/regress-crbug-1006631.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-type-reflection --trace-turbo-graph
+
+new WebAssembly.Function({ parameters: [], results: [] }, x => x);