[runtime] MigrateFastToFast: fix check for unboxed inobject doubles

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index f40dc1e007d58b0ddc36cf753bdbedaf53fbb4c5..b99fe18d4115bb0985a1234ab3edbcf9758e9afd 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3473,9 +3473,8 @@ void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
     // which there is still space, and which does not require a mutable double
     // box (an out-of-object double).
     if (details.location() == kDescriptor ||
-        (have_space &&
-         ((FLAG_unbox_double_fields && object->properties()->length() == 0) ||
-          !details.representation().IsDouble()))) {
+        (have_space && ((FLAG_unbox_double_fields && target_index < 0) ||
+                        !details.representation().IsDouble()))) {
       object->synchronized_set_map(*new_map);
       return;
     }