Only verify in-object fields in fast properties case.

test/mjsunit/regress/regress-crbug-572590.js

Index: test/mjsunit/regress/regress-crbug-572590.js
diff --git a/test/message/destructuring-modify-const.js b/test/mjsunit/regress/regress-crbug-572590.js
similarity index 60%
copy from test/message/destructuring-modify-const.js
copy to test/mjsunit/regress/regress-crbug-572590.js
index 88bda351d8e12ef06fd895e9617dee5829824440..5871005423a8c6af85fb04cbb56347d6abac950f 100644
--- a/test/message/destructuring-modify-const.js
+++ b/test/mjsunit/regress/regress-crbug-572590.js
@@ -2,8 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-destructuring-bind
-'use strict';
+// Flags: --expose-gc --verify-heap
 
-const { x : x, y : y } = { x : 1, y : 2 };
-x++;
+function g() { }
+var f = g.bind();
+f.__defineGetter__('length', g);
+gc();