[stubs] Also handle properties of the JSBuiltinsObject in the fast case.

[stubs] Also handle properties of the JSBuiltinsObject in the fast case.

We can apply the shortcut used for data properties of the JSGlobalObject
to builtin properties as well. This mostly affects the custom properties
we use for the Math functions (i.e. rngstate for Math.random() and kMath
for sin, cos and friends).

Drive-by-fix: Also mark the internal builtin typed arrays properties
(rngstate, kMath and rempio2result) as READ_ONLY, as they should not be
touched after genesis.

R=yangguo@chromium.org

Committed: https://crrev.com/6cf94ebde1ad31dfce0af4dfa642468ec21b0174
Cr-Commit-Position: refs/heads/master@{#29887}

[Benedikt Meurer, 2015-07-28 06:26:46]

Hey Yang,

This is the fix I've told you about. It basically removes the restriction to
JSGlobalObject and also allows JSBuiltinsObject.
Please take a look.

Thanks,
Benedikt

[Yang, 2015-07-28 06:27:48]

On 2015/07/28 06:26:46, Benedikt Meurer wrote:
> Hey Yang,
> 
> This is the fix I've told you about. It basically removes the restriction to
> JSGlobalObject and also allows JSBuiltinsObject.
> Please take a look.
> 
> Thanks,
> Benedikt

lgtm.

[Benedikt Meurer, 2015-07-28 06:28:15]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2015-07-28 06:28:28]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1254143003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1254143003/1

[commit-bot: I haz the power, 2015-07-28 06:48:13]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-07-28 06:48:37]

Patchset 1 (id:??) landed as
https://crrev.com/6cf94ebde1ad31dfce0af4dfa642468ec21b0174
Cr-Commit-Position: refs/heads/master@{#29887}