Fix JSFunction's in-object properties initialization.

src/objects-inl.h

Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index 937cddfe3129d5df4b9eb0ae1deb4730b3c89449..597a00cd6c084b6e0c7ddc066a1fef7796671108 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -2288,7 +2288,7 @@ Object* JSObject::InObjectPropertyAtPut(int index,
 }
 
 
-void JSObject::InitializeBody(Map* map,
+void JSObject::InitializeBody(Map* map, int start_offset,
                               Object* pre_allocated_value,
                               Object* filler_value) {
   DCHECK(!filler_value->IsHeapObject() ||
@@ -2296,7 +2296,7 @@ void JSObject::InitializeBody(Map* map,
   DCHECK(!pre_allocated_value->IsHeapObject() ||
          !GetHeap()->InNewSpace(pre_allocated_value));
   int size = map->instance_size();
-  int offset = kHeaderSize;
+  int offset = start_offset;
   if (filler_value != pre_allocated_value) {
     int end_of_pre_allocated_offset =
         size - (map->unused_property_fields() * kPointerSize);