Bound functions should also have configurable length

BUG=v8:4116
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1180873002

Cr-Commit-Position: refs/heads/master@{#28961}

src/runtime/runtime-function.cc

@@ -446,7 +446,7 @@ RUNTIME_FUNCTION(Runtime_FunctionBindArguments) {
   JSObject::MigrateToMap(bound_function, bound_function_map);
   Handle<String> length_string = isolate->factory()->length_string();
   PropertyAttributes attr =
-      static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY);
+      static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
   RETURN_FAILURE_ON_EXCEPTION(
       isolate, JSObject::SetOwnPropertyIgnoreAttributes(
                    bound_function, length_string, new_length, attr));

test/mjsunit/regress/regress-1419.js

@@ -44,4 +44,12 @@ assertEquals(1, f1.length);
 var desc = Object.getOwnPropertyDescriptor(f1, 'length');
 assertEquals(false, desc.writable);
 assertEquals(false, desc.enumerable);
-assertEquals(false, desc.configurable);
+assertEquals(true, desc.configurable);
+
+Object.defineProperty(f1, 'length', {
+  value: 'abc',
+  writable: true
+});
+assertEquals('abc', f1.length);
+f1.length = 42;
+assertEquals(42, f1.length);

test/test262-es6/test262-es6.status

@@ -626,8 +626,9 @@
   'built-ins/Function/prototype/bind/15.3.4.5-21-4': [FAIL_OK],
   'built-ins/Function/prototype/bind/15.3.4.5-21-5': [FAIL_OK],
 
-  # This invalid test has been fixed upstream.
+  # These invalid tests have been fixed upstream.
   'built-ins/Array/prototype/find/Array.prototype.find_remove-after-start': [FAIL],
+  'built-ins/Function/prototype/bind/15.3.4.5-15-2': [FAIL],
 
   ############################ SKIPPED TESTS #############################
 

test/test262/test262.status

@@ -229,6 +229,7 @@
   'S15.9.5.7_A3_T2': [FAIL],
   'S15.9.5.8_A3_T2': [FAIL],
   'S15.9.5.9_A3_T2': [FAIL],
+  '15.3.4.5-15-2': [FAIL],
 
   # Object.getPrototypeOf wraps primitive values in ES6.
   '15.2.3.2-1': [FAIL],