Swap bitfield3 and backpointer.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 8e146cb35037c1a44bc5a8d07c34a6ea8ee4f2bd..7249eca7b75e6013a225a285b8f81efa7631f555 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -2190,13 +2190,13 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_FunctionSetReadOnlyPrototype) {
     DescriptorArray* new_descriptors =
         DescriptorArray::cast(descriptors_unchecked);
     // Create a new map featuring the new field descriptors array.
-    Object* map_unchecked;
-    { MaybeObject* maybe_map_unchecked = function->map()->CopyDropDescriptors();
-      if (!maybe_map_unchecked->ToObject(&map_unchecked)) {
+    Map* new_map;
+    { MaybeObject* maybe_map_unchecked =
+          function->map()->CopyDropDescriptors();
+      if (!maybe_map_unchecked->To(&new_map)) {
         return maybe_map_unchecked;
       }
     }
-    Map* new_map = Map::cast(map_unchecked);
     new_map->set_instance_descriptors(new_descriptors);
     function->set_map(new_map);
   } else {  // Dictionary properties.