Use JSObjectVerify instead of trying to reimplement parts of it.

test/mjsunit/regress/regress-crbug-573857.js

Index: test/mjsunit/regress/regress-crbug-573857.js
diff --git a/test/mjsunit/regress/regress-crbug-572590.js b/test/mjsunit/regress/regress-crbug-573857.js
similarity index 61%
copy from test/mjsunit/regress/regress-crbug-572590.js
copy to test/mjsunit/regress/regress-crbug-573857.js
index 5871005423a8c6af85fb04cbb56347d6abac950f..d2892c924f683d5d4de999fb9cb4e60d6e7c58ee 100644
--- a/test/mjsunit/regress/regress-crbug-572590.js
+++ b/test/mjsunit/regress/regress-crbug-573857.js
@@ -4,7 +4,10 @@
 
 // Flags: --expose-gc --verify-heap
 
-function g() { }
-var f = g.bind();
-f.__defineGetter__('length', g);
+function f() {}
+f = f.bind();
+f.x = f.name;
+f.__defineGetter__('name', function() { return f.x; });
+function g() {}
+g.prototype = f;
 gc();