Fix JSFunction's in-object properties initialization.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 22d079f083672f3f7562d06a3b9d40295044e565..95fcd3c87fb37374798e5caf813e4661b4668c4a 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2346,14 +2346,13 @@ class JSObject: public JSReceiver {
                                                   bool from_javascript,
                                                   ShouldThrow should_throw);
 
-  // Initializes the body after properties slot, properties slot is
-  // initialized by set_properties.  Fill the pre-allocated fields with
+  // Initializes the body starting at |start_offset|. It is responsibility of
+  // the caller to initialize object header. Fill the pre-allocated fields with
   // pre_allocated_value and the rest with filler_value.
   // Note: this call does not update write barrier, the caller is responsible
   // to ensure that |filler_value| can be collected without WB here.
-  inline void InitializeBody(Map* map,
-                             Object* pre_allocated_value,
-                             Object* filler_value);
+  inline void InitializeBody(Map* map, int start_offset,
+                             Object* pre_allocated_value, Object* filler_value);
 
   // Check whether this object references another object
   bool ReferencesObject(Object* obj);