src: include Environment in snapshot

This PR adds snapshotting support for everything that currently runs as part of our bootstrapping, for improved startup performance (+36 % currently until the main script starts). It should also enable us to include more data in the snapshot in the future.

/cc @joyeecheung (and thanks to her for a bunch of help looking into this!)

---

src: introduce BaseObject base FunctionTemplate

This enables us to tell whether a JS bindings object is associated with a BaseObject or not.

src: collect external references for snapshot

Gather external references from the different native modules that are loaded during bootstrapping, for inclusion in the snapshot.

lib,src: fix process.features.cached_builtins when snapshotted

This value is not a constant, in the sense that its value when running node_mksnapshot and when running the default node binary are different.

buffer: refactor zero-fill-field passing

Instead of storing the zero-fill-field as a fixed ArrayBuffer on the binding, only load it via a function call once bootstrapping is complete. This makes sure that the value is set correctly after loading from a snapshot (i.e. that the accessor for the field is stored in the snapshot, not the field itself).

deps: V8: cherry-pick bb9f0c2b2fe9

Original commit message:

[snapshot] Improve snapshot docs and error printing

- Minor improvements to the documentation for snapshotting.
- Add newlines to printed errors where necessary.

Change-Id: I822e7e850adb67eae73b51c23cf34e40ba3106f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144954
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67111}

Refs: https://github.com/v8/v8/commit/bb9f0c2b2fe920a717794f3279758846f59f7840

deps: V8: cherry-pick ea0719b8ed08

Original commit message:

[snapshot] Do not defer ArrayBuffers during snapshotting

ArrayBuffer instances are serialized by first re-assigning a index
to the backing store field, then serializing the object, and then
storing the actual backing store address again (and the same for the
ArrayBufferExtension). If serialization of the object itself is deferred,
the real backing store address is written into the snapshot, which cannot be
processed when deserializing, leading to a crash.

This fixes this by not deferring ArrayBuffer serialization and adding a DCHECK
for the crash that previously occurred.

Change-Id: Id9bea8268061bd0770cde7bfeb6695248978f994
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144123
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67114}

Refs: https://github.com/v8/v8/commit/ea0719b8ed087d1f511e78595dcb596faa7638d0

deps: V8: cherry-pick 9baf2865671c

Original commit message:

rehash JSMap and JSSet during deserialization

To rehash JSMap and JSSet, we simply replace the backing store
with a new one created with the new hash.

Bug: v8:9187

Refs: https://github.com/joyeecheung/v8/commit/9baf2865671ccd49b606b00db8e8c20705591c53

src: include Environment in snapshot

This snapshots a lot more data for startup than what we did previously for increased startup performance.

                                                                                   confidence improvement accuracy (*)   (**)  (***)
misc/startup.js mode='process' script='benchmark/fixtures/require-cachable' dur=1        ***      9.73 %       ±3.78% ±5.03% ±6.54%
misc/startup.js mode='process' script='test/fixtures/semicolon' dur=1                    ***     36.11 %       ±3.91% ±5.23% ±6.86%

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• commit message follows commit guidelines