Fix promotion of JSFunctions with in-object properties.

BUG=v8:4572, chromium:561481
LOG=Y

Review URL: https://codereview.chromium.org/1465223007

Cr-Commit-Position: refs/heads/master@{#32295}

src/heap/scavenger.cc

@@ -192,12 +192,7 @@ class ScavengingVisitor : public StaticVisitorBase {
       *slot = target;
 
       if (object_contents == POINTER_OBJECT) {
-        if (map->instance_type() == JS_FUNCTION_TYPE) {
-          heap->promotion_queue()->insert(target,
-                                          JSFunction::kNonWeakFieldsEndOffset);
-        } else {
-          heap->promotion_queue()->insert(target, object_size);
-        }
+        heap->promotion_queue()->insert(target, object_size);
       }
       heap->IncrementPromotedObjectsSize(object_size);
       return true;