Fix slack tracking for function subclasses.

Bug: chromium:774860
Change-Id: I180ca7e9e8d8603e0d61deb0eb71d758895d0f74
Reviewed-on: https://chromium-review.googlesource.com/721551Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48630}

src/objects.cc

@@ -9499,6 +9499,7 @@ Handle<Map> Map::AsLanguageMode(Handle<Map> initial_map,
                           initial_map->unused_property_fields());
   map->SetConstructor(initial_map->GetConstructor());
   map->set_prototype(initial_map->prototype());
+  map->set_construction_counter(initial_map->construction_counter());
 
   if (TransitionsAccessor(initial_map).CanHaveMoreTransitions()) {
     Map::ConnectTransition(initial_map, map, transition_symbol,

test/mjsunit/regress/regress-crbug-774860.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --verify-heap
+
+(function () {
+  class F extends Function {}
+  let f = new F("'use strict';");
+  // Create enough objects to complete slack tracking.
+  for (let i = 0; i < 20; i++) {
+    new F();
+  }
+  gc();
+})();