[objects] Relax JSBoundFunction verification.

src/deoptimizer.cc

Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index be2e45f90644fd726ba5ca7efc81c2e5cc679b34..db71343956791cd1931eb7bf376357e74bb842dd 100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -4426,14 +4426,14 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
       return object;
     }
     case JS_BOUND_FUNCTION_TYPE: {
-      Handle<JSBoundFunction> object = Handle<JSBoundFunction>::cast(
-          isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
-      slot->value_ = object;
       Handle<Object> properties = materializer.FieldAt(value_index);
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> bound_target_function = materializer.FieldAt(value_index);
       Handle<Object> bound_this = materializer.FieldAt(value_index);
       Handle<Object> bound_arguments = materializer.FieldAt(value_index);
+      Handle<JSBoundFunction> object = Handle<JSBoundFunction>::cast(
+          isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
+      slot->value_ = object;

[Michael Starzinger, 2017/06/13 07:57:32]

This only works because escape analysis currently doesn't support cycles. As
soon as cycles are supported it might be that the bound function references
itself in the properties or elements backing store above. Please add a big TODO
here in that regard, explaining that this should be move up again.

       object->set_properties(FixedArray::cast(*properties));
       object->set_elements(FixedArrayBase::cast(*elements));
       object->set_bound_target_function(