[objects] Relax JSBoundFunction verification.

src/deoptimizer.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/deoptimizer.h"
 
 #include <memory>
 
 #include "src/accessors.h"
 #include "src/assembler-inl.h"
@@ skipping 4408 matching lines @@
       slot->value_ = object;
       Handle<Object> properties = materializer.FieldAt(value_index);
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> array_length = materializer.FieldAt(value_index);
       object->set_properties(FixedArray::cast(*properties));
       object->set_elements(FixedArrayBase::cast(*elements));
       object->set_length(*array_length);
       return object;
     }
     case JS_BOUND_FUNCTION_TYPE: {
-      Handle<JSBoundFunction> object = Handle<JSBoundFunction>::cast(
-          isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
-      slot->value_ = object;
       Handle<Object> properties = materializer.FieldAt(value_index);
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> bound_target_function = materializer.FieldAt(value_index);
       Handle<Object> bound_this = materializer.FieldAt(value_index);
       Handle<Object> bound_arguments = materializer.FieldAt(value_index);
+      Handle<JSBoundFunction> object = Handle<JSBoundFunction>::cast(
+          isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
+      slot->value_ = object;

[Michael Starzinger, 2017/06/13 07:57:32]

This only works because escape analysis currently doesn't support cycles. As
soon as cycles are supported it might be that the bound function references
itself in the properties or elements backing store above. Please add a big TODO
here in that regard, explaining that this should be move up again.

       object->set_properties(FixedArray::cast(*properties));
       object->set_elements(FixedArrayBase::cast(*elements));
       object->set_bound_target_function(
           JSReceiver::cast(*bound_target_function));
       object->set_bound_this(*bound_this);
       object->set_bound_arguments(FixedArray::cast(*bound_arguments));
       return object;
     }
     case JS_GENERATOR_OBJECT_TYPE: {
       Handle<JSGeneratorObject> object = Handle<JSGeneratorObject>::cast(
@@ skipping 418 matching lines @@
       CHECK(value_info->IsMaterializedObject());
 
       value_info->value_ =
           Handle<Object>(previously_materialized_objects->get(i), isolate_);
     }
   }
 }
 
 }  // namespace internal
 }  // namespace v8