Introduce --zap-cpp-pointers (off by default)

src/property-descriptor.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/property-descriptor.h"
 
 #include "src/bootstrapper.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
 #include "src/lookup.h"
@@ skipping 24 matching lines @@
 }
 
 
 // Helper function for ToPropertyDescriptor. Handles the case of "simple"
 // objects: nothing on the prototype chain, just own fast data properties.
 // Must not have observable side effects, because the slow path will restart
 // the entire conversion!
 bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<JSReceiver> obj,
                                   PropertyDescriptor* desc) {
   if (!obj->IsJSObject()) return false;
-  Map* map = Handle<JSObject>::cast(obj)->map();
+  Handle<Map> map = handle(Handle<JSObject>::cast(obj)->map(), isolate);
   if (map->instance_type() != JS_OBJECT_TYPE) return false;
   if (map->is_access_check_needed()) return false;
   if (map->prototype() != *isolate->initial_object_prototype()) return false;
   // During bootstrapping, the object_function_prototype_map hasn't been
   // set up yet.
   if (isolate->bootstrapper()->IsActive()) return false;
   if (JSObject::cast(map->prototype())->map() !=
       isolate->native_context()->object_function_prototype_map()) {
     return false;
   }
   // TODO(jkummerow): support dictionary properties?
   if (map->is_dictionary_map()) return false;
-  Handle<DescriptorArray> descs =
-      Handle<DescriptorArray>(map->instance_descriptors());
+  Handle<DescriptorArray> descs = handle(map->instance_descriptors(), isolate);
   for (int i = 0; i < map->NumberOfOwnDescriptors(); i++) {
     PropertyDetails details = descs->GetDetails(i);
     Name* key = descs->GetKey(i);
     Handle<Object> value;
     if (details.location() == kField) {
       if (details.kind() == kData) {
         value = JSObject::FastPropertyAt(Handle<JSObject>::cast(obj),
                                          details.representation(),
-                                         FieldIndex::ForDescriptor(map, i));
+                                         FieldIndex::ForDescriptor(*map, i));
       } else {
         DCHECK_EQ(kAccessor, details.kind());
         // Bail out to slow path.
         return false;
       }
 
     } else {
       DCHECK_EQ(kDescriptor, details.location());
       if (details.kind() == kData) {
         value = handle(descs->GetValue(i), isolate);
@@ skipping 257 matching lines @@
   //    Desc.[[Enumerable]] to like.[[Enumerable]].
   if (!desc->has_enumerable()) desc->set_enumerable(false);
   // 7. If Desc does not have a [[Configurable]] field, set
   //    Desc.[[Configurable]] to like.[[Configurable]].
   if (!desc->has_configurable()) desc->set_configurable(false);
   // 8. Return Desc.
 }
 
 }  // namespace internal
 }  // namespace v8