| Index: src/heap.cc
 | 
| diff --git a/src/heap.cc b/src/heap.cc
 | 
| index 10cb4738abdf66c07be84b3900eeb9dd2d95c553..9ec4e7d01eb0ab4991ab1c9d92cc3d8884890717 100644
 | 
| --- a/src/heap.cc
 | 
| +++ b/src/heap.cc
 | 
| @@ -4146,7 +4146,9 @@ MaybeObject* Heap::AllocateInitialMap(JSFunction* fun) {
 | 
|        for (int i = 0; i < count; i++) {
 | 
|          String* name = fun->shared()->GetThisPropertyAssignmentName(i);
 | 
|          ASSERT(name->IsInternalizedString());
 | 
| -        FieldDescriptor field(name, i, NONE, i + 1);
 | 
| +        // TODO(verwaest): Since we cannot update the boilerplate's map yet,
 | 
| +        // initialize to the worst case.
 | 
| +        FieldDescriptor field(name, i, NONE, Representation::Tagged(), i + 1);
 | 
|          descriptors->Set(i, &field, witness);
 | 
|        }
 | 
|        descriptors->Sort();
 | 
| @@ -4580,6 +4582,7 @@ MaybeObject* Heap::AllocateGlobalObject(JSFunction* constructor) {
 | 
|      ASSERT(details.type() == CALLBACKS);  // Only accessors are expected.
 | 
|      PropertyDetails d = PropertyDetails(details.attributes(),
 | 
|                                          CALLBACKS,
 | 
| +                                        Representation::None(),
 | 
|                                          details.descriptor_index());
 | 
|      Object* value = descs->GetCallbacksObject(i);
 | 
|      MaybeObject* maybe_value = AllocateJSGlobalPropertyCell(value);
 | 
| 
 |