Port 4e207a42

Original Commit Message:

    This switches the "code entry" field on JSFunction to no longer be an
    inner pointer into a Code object (i.e. to the start of the instruction
    stream), but a properly tagged pointer instead.

    Motivation behind this is the ability to treat this field regularly as
    part of escape analysis in the optimizing compiler. Also simplifies the
    object visitation for JSFunction objects.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ifa5998551e041c8de647df7306dd549455936699
Reviewed-on: https://chromium-review.googlesource.com/588468Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46934}