Fix performance regression introduced in r28961

where bound functions' length was made configurable. The bootstrapper must be kept in sync to avoid polymorphism.

BUG=chromium:500686
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1221383003

Cr-Commit-Position: refs/heads/master@{#29496}

src/bootstrapper.cc

@@ -598,7 +598,7 @@ void Genesis::SetStrictFunctionInstanceDescriptor(Handle<Map> map,
   // Add length.
   if (function_mode == BOUND_FUNCTION) {
     Handle<String> length_string = isolate()->factory()->length_string();
-    DataDescriptor d(length_string, 0, ro_attribs, Representation::Tagged());
+    DataDescriptor d(length_string, 0, roc_attribs, Representation::Tagged());
     map->AppendDescriptor(&d);
   } else {
     DCHECK(function_mode == FUNCTION_WITH_WRITEABLE_PROTOTYPE ||

src/runtime/runtime-function.cc

@@ -447,6 +447,9 @@ RUNTIME_FUNCTION(Runtime_FunctionBindArguments) {
       isolate->native_context()->bound_function_map());
   JSObject::MigrateToMap(bound_function, bound_function_map);
   Handle<String> length_string = isolate->factory()->length_string();
+  // These attributes must be kept in sync with how the bootstrapper
+  // configures the bound_function_map retrieved above.
+  // We use ...IgnoreAttributes() here because of length's read-onliness.
   PropertyAttributes attr =
       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
   RETURN_FAILURE_ON_EXCEPTION(