Introduce --zap-cpp-pointers (off by default)

src/property-descriptor.cc

Index: src/property-descriptor.cc
diff --git a/src/property-descriptor.cc b/src/property-descriptor.cc
index 70ddd5d5217e5fc78d5c8b7324cb52e8e70d1061..a941a18f9782ce277054f77b778caeb8c08bb11a 100644
--- a/src/property-descriptor.cc
+++ b/src/property-descriptor.cc
@@ -42,7 +42,7 @@ bool GetPropertyIfPresent(Handle<JSReceiver> receiver, Handle<String> name,
 bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<JSReceiver> obj,
                                   PropertyDescriptor* desc) {
   if (!obj->IsJSObject()) return false;
-  Map* map = Handle<JSObject>::cast(obj)->map();
+  Handle<Map> map = handle(Handle<JSObject>::cast(obj)->map(), isolate);
   if (map->instance_type() != JS_OBJECT_TYPE) return false;
   if (map->is_access_check_needed()) return false;
   if (map->prototype() != *isolate->initial_object_prototype()) return false;
@@ -55,8 +55,7 @@ bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<JSReceiver> obj,
   }
   // TODO(jkummerow): support dictionary properties?
   if (map->is_dictionary_map()) return false;
-  Handle<DescriptorArray> descs =
-      Handle<DescriptorArray>(map->instance_descriptors());
+  Handle<DescriptorArray> descs = handle(map->instance_descriptors(), isolate);
   for (int i = 0; i < map->NumberOfOwnDescriptors(); i++) {
     PropertyDetails details = descs->GetDetails(i);
     Name* key = descs->GetKey(i);
@@ -65,7 +64,7 @@ bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<JSReceiver> obj,
       if (details.kind() == kData) {
         value = JSObject::FastPropertyAt(Handle<JSObject>::cast(obj),
                                          details.representation(),
-                                         FieldIndex::ForDescriptor(map, i));
+                                         FieldIndex::ForDescriptor(*map, i));
       } else {
         DCHECK_EQ(kAccessor, details.kind());
         // Bail out to slow path.