Function constructor-set properties do not work with subclassing

[aapoalas]

class Fn extends Function {}

var fn = new Fn('a', 'b', 'return a + b');

verifyProperty(fn, 'length', {
  value: 2,
  writable: false,
  enumerable: false,
  configurable: true,
});

this fails because Fn extends Function, requiring a custom prototype to be set which creates a backing object for Function. That backing object has its length property set to the initial value of the Function's heap data which is by default 0. Later we manually override the heap data to contain the value 2 but we do not override the value already set in the backing object.

See #943 for an equivalent bug in Error subclassing.