Only verify in-object fields in fast properties case.

This matches the behavior of JSObject::JSObjectVerify() and seems to be
the current contract for --verify-heap.

BUG=chromium:572590
LOG=n

Review URL: https://codereview.chromium.org/1553463002

Cr-Commit-Position: refs/heads/master@{#33056}

src/objects-debug.cc

@@ -549,8 +549,10 @@ void SlicedString::SlicedStringVerify() {
 
 void JSBoundFunction::JSBoundFunctionVerify() {
   CHECK(IsJSBoundFunction());
-  VerifyObjectField(kLengthOffset);
-  VerifyObjectField(kNameOffset);
+  if (HasFastProperties()) {
+    VerifyObjectField(kLengthOffset);
+    VerifyObjectField(kNameOffset);
+  }
   VerifyObjectField(kBoundThisOffset);
   VerifyObjectField(kBoundTargetFunctionOffset);
   VerifyObjectField(kBoundArgumentsOffset);

test/mjsunit/mjsunit.status

@@ -990,6 +990,7 @@
   'regress/regress-crbug-568477-2': [SKIP],
   'regress/regress-crbug-568477-3': [SKIP],
   'regress/regress-crbug-568477-4': [SKIP],
+  'regress/regress-crbug-572590': [SKIP],
   'regress/regress-deopt-gcb': [SKIP],
   'regress/regress-deopt-gc': [SKIP],
   'regress/regress-deopt-in-array-literal-spread': [SKIP],

test/mjsunit/regress/regress-crbug-572590.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --verify-heap
+
+function g() { }
+var f = g.bind();
+f.__defineGetter__('length', g);
+gc();