Function constructor-set properties do not work with subclassing

```javascript class Fn extends Function {} var fn = new Fn('a', 'b', 'return a + b'); verifyProperty(fn, 'length', { value: 2, writable: false, enumerable: false, configurable: true, }); ``` this fails because `Fn` extends `Function`, requiring a custom prototype to be set which creates a backing object for `Function`. That backing object has its length property set to the initial value of the `Function`'s heap data which is by default 0. Later we manually override the heap data to contain the value 2 but we do not override the value already set in the backing object. See #943 for an equivalent bug in Error subclassing.