[runtime] Introduce dedicated JSBoundFunction to represent bound functions.

src/runtime/runtime-observe.cc

Index: src/runtime/runtime-observe.cc
diff --git a/src/runtime/runtime-observe.cc b/src/runtime/runtime-observe.cc
index b3c6ff11797ae4bc236487c36ab45c7847f8d0c9..0407b8a9df1bed970abc727614a8803d230161f0 100644
--- a/src/runtime/runtime-observe.cc
+++ b/src/runtime/runtime-observe.cc
@@ -56,7 +56,7 @@ RUNTIME_FUNCTION(Runtime_RunMicrotasks) {
 RUNTIME_FUNCTION(Runtime_DeliverObservationChangeRecords) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 2);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, callback, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, callback, 0);
   CONVERT_ARG_HANDLE_CHECKED(Object, argument, 1);
   v8::TryCatch catcher(reinterpret_cast<v8::Isolate*>(isolate));
   // We should send a message on uncaught exception thrown during
@@ -96,11 +96,18 @@ static bool ContextsHaveSameOrigin(Handle<Context> context1,
 RUNTIME_FUNCTION(Runtime_ObserverObjectAndRecordHaveSameOrigin) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 3);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, observer, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, observer, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 1);
   CONVERT_ARG_HANDLE_CHECKED(JSObject, record, 2);
 
-  Handle<Context> observer_context(observer->context()->native_context());
+  while (observer->IsJSBoundFunction()) {
+    observer = handle(
+        Handle<JSBoundFunction>::cast(observer)->bound_target_function());
+  }
+  if (!observer->IsJSFunction()) return isolate->heap()->false_value();
+
+  Handle<Context> observer_context(
+      Handle<JSFunction>::cast(observer)->context()->native_context());
   Handle<Context> object_context(object->GetCreationContext());
   Handle<Context> record_context(record->GetCreationContext());