Add C++ implementation of Object.defineProperties

src/runtime/runtime-object.cc

Index: src/runtime/runtime-object.cc
diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc
index b128190fb546a1c1b1a03d4ed9e6167c691ad11d..da4a2b35e806b8e7b00c09ec6d22c4d083e0c1f0 100644
--- a/src/runtime/runtime-object.cc
+++ b/src/runtime/runtime-object.cc
@@ -1614,5 +1614,910 @@ RUNTIME_FUNCTION(Runtime_IsAccessCheckNeeded) {
 }
 
 
+class PropertyDescriptor : public ZoneObject {
+ public:
+  PropertyDescriptor()
+      : enumerable_(false),
+        has_enumerable_(false),
+        configurable_(false),
+        has_configurable_(false),
+        writable_(false),
+        has_writable_(false) {}
+
+  // ES6 6.2.4.1
+  static bool IsAccessorDescriptor(PropertyDescriptor* desc) {
+    if (desc == NULL) return false;
+    return desc->has_get() || desc->has_set();
+  }
+
+  // ES6 6.2.4.2
+  static bool IsDataDescriptor(PropertyDescriptor* desc) {
+    if (desc == NULL) return false;
+    return desc->has_value() || desc->has_writable();
+  }
+
+  // ES6 6.2.4.3
+  static bool IsGenericDescriptor(PropertyDescriptor* desc) {
+    if (desc == NULL) return false;
+    return !IsAccessorDescriptor(desc) && !IsDataDescriptor(desc);
+  }
+
+  bool enumerable() const { return enumerable_; }
+  void set_enumerable(bool enumerable) {
+    enumerable_ = enumerable;
+    has_enumerable_ = true;
+  }
+  bool has_enumerable() const { return has_enumerable_; }
+
+  bool configurable() const { return configurable_; }
+  void set_configurable(bool configurable) {
+    configurable_ = configurable;
+    has_configurable_ = true;
+  }
+  bool has_configurable() const { return has_configurable_; }
+
+  Handle<Object> value() const { return value_; }
+  void set_value(Handle<Object> value) { value_ = value; }
+  bool has_value() const { return !value_.is_null(); }
+
+  bool writable() const { return writable_; }
+  void set_writable(bool writable) {
+    writable_ = writable;
+    has_writable_ = true;
+  }
+  bool has_writable() const { return has_writable_; }
+
+  Handle<Object> get() const { return get_; }
+  void set_get(Handle<Object> get) { get_ = get; }
+  bool has_get() const { return !get_.is_null(); }
+
+  Handle<Object> set() const { return set_; }
+  void set_set(Handle<Object> set) { set_ = set; }
+  bool has_set() const { return !set_.is_null(); }
+
+  Handle<Object> name() const { return name_; }
+  void set_name(Handle<Object> name) { name_ = name; }
+
+  PropertyAttributes ToAttributes() {
+    return static_cast<PropertyAttributes>(
+        (has_enumerable() && !enumerable() ? DONT_ENUM : NONE) |
+        (has_configurable() && !configurable() ? DONT_DELETE : NONE) |
+        (has_writable() && !writable() ? READ_ONLY : NONE));
+  }
+
+ private:
+  bool enumerable_ : 1;
+  bool has_enumerable_ : 1;
+  bool configurable_ : 1;
+  bool has_configurable_ : 1;
+  bool writable_ : 1;
+  bool has_writable_ : 1;
+  Handle<Object> value_;
+  Handle<Object> get_;
+  Handle<Object> set_;
+  Handle<Object> name_;
+};
+
+
+// ES6 9.1.5.1
+// TODO(jkummerow): Unify with "MaybeHandle<Object> GetOwnProperty()" above.
+PropertyDescriptor* GetOwnPropertyDescriptor(Isolate* isolate, Zone* zone,
+                                             Handle<JSObject> obj,
+                                             Handle<Object> name) {
+  // 2. If O does not have an own property with key P, return undefined.
+  LookupIterator it = LookupIterator::PropertyOrElement(isolate, obj, name,
+                                                        LookupIterator::HIDDEN);
+  Maybe<PropertyAttributes> maybe = JSObject::GetPropertyAttributes(&it);
+
+  if (!maybe.IsJust()) return NULL;
+  PropertyAttributes attrs = maybe.FromJust();
+  if (attrs == ABSENT) return NULL;
+  DCHECK(!isolate->has_pending_exception());
+
+  // 3. Let D be a newly created Property Descriptor with no fields.
+  PropertyDescriptor* d = new (zone) PropertyDescriptor();
+  // 4. Let X be O's own property whose key is P.
+  // 5. If X is a data property, then
+  bool is_accessor_pair = it.state() == LookupIterator::ACCESSOR &&
+                          it.GetAccessors()->IsAccessorPair();
+  if (!is_accessor_pair) {
+    // 5a. Set D.[[Value]] to the value of X's [[Value]] attribute.
+    Handle<Object> value = JSObject::GetProperty(&it).ToHandleChecked();
+    d->set_value(value);
+    // 5b. Set D.[[Writable]] to the value of X's [[Writable]] attribute
+    d->set_writable((attrs & READ_ONLY) == 0);
+  } else {
+    // 6. Else X is an accessor property, so
+    Handle<AccessorPair> accessors =
+        Handle<AccessorPair>::cast(it.GetAccessors());
+    // 6a. Set D.[[Get]] to the value of X's [[Get]] attribute.
+    d->set_get(handle(accessors->GetComponent(ACCESSOR_GETTER), isolate));
+    // 6b. Set D.[[Set]] to the value of X's [[Set]] attribute.
+    d->set_set(handle(accessors->GetComponent(ACCESSOR_SETTER), isolate));
+  }
+
+  // 7. Set D.[[Enumerable]] to the value of X's [[Enumerable]] attribute.
+  d->set_enumerable((attrs & DONT_ENUM) == 0);
+  // 8. Set D.[[Configurable]] to the value of X's [[Configurable]] attribute.
+  d->set_configurable((attrs & DONT_DELETE) == 0);
+  // 9. Return D.
+  return d;
+}
+
+
+// ES6 9.1.6.1
+bool OrdinaryDefineOwnProperty(Isolate* isolate, Zone* zone, Handle<JSObject> o,
+                               Handle<Object> name, PropertyDescriptor* desc,
+                               bool should_throw) {
+  // == OrdinaryDefineOwnProperty (O, P, Desc) ==
+  // 1. Let current be O.[[GetOwnProperty]](P).
+  PropertyDescriptor* current =
+      GetOwnPropertyDescriptor(isolate, zone, o, name);
+  // 2. ReturnIfAbrupt(current).
+  if (current == NULL && isolate->has_pending_exception()) return false;
+  // 3. Let extensible be the value of the [[Extensible]] internal slot of O.
+  bool extensible = o->IsExtensible();
+
+  bool desc_is_data_descriptor = PropertyDescriptor::IsDataDescriptor(desc);
+  bool desc_is_accessor_descriptor =
+      PropertyDescriptor::IsAccessorDescriptor(desc);
+  bool desc_is_generic_descriptor =
+      PropertyDescriptor::IsGenericDescriptor(desc);
+
+  // == ValidateAndApplyPropertyDescriptor (O, P, extensible, Desc, current) ==
+  // 2. If current is undefined, then
+  if (current == NULL) {
+    // 2a. If extensible is false, return false.
+    if (!extensible) {
+      if (should_throw) {
+        isolate->Throw(*isolate->factory()->NewTypeError(
+            MessageTemplate::kDefineDisallowed, name));
+      }
+      return false;
+    }
+    // 2c. If IsGenericDescriptor(Desc) or IsDataDescriptor(Desc) is true, then:
+    // (This is equivalent to !IsAccessorDescriptor(desc).)
+    if (!desc_is_accessor_descriptor) {
+      DCHECK(desc_is_generic_descriptor || desc_is_data_descriptor);
+      // 2c i. If O is not undefined, create an own data property named P of
+      // object O whose [[Value]], [[Writable]], [[Enumerable]] and
+      // [[Configurable]] attribute values are described by Desc. If the value
+      // of an attribute field of Desc is absent, the attribute of the newly
+      // created property is set to its default value.
+      if (!o->IsUndefined()) {
+        if (!desc->has_writable()) desc->set_writable(false);
+        if (!desc->has_enumerable()) desc->set_enumerable(false);
+        if (!desc->has_configurable()) desc->set_configurable(false);
+        LookupIterator it = LookupIterator::PropertyOrElement(
+            isolate, o, name, LookupIterator::HIDDEN);
+        Handle<Object> value(
+            desc->has_value()
+                ? desc->value()
+                : Handle<Object>::cast(isolate->factory()->undefined_value()));
+        MaybeHandle<Object> result =
+            JSObject::DefineOwnPropertyIgnoreAttributes(&it, value,
+                                                        desc->ToAttributes());
+        if (result.is_null()) return false;
+      }
+    } else {
+      // 2d. Else Desc must be an accessor Property Descriptor,
+      DCHECK(desc_is_accessor_descriptor);
+      // 2d i. If O is not undefined, create an own accessor property named P
+      // of object O whose [[Get]], [[Set]], [[Enumerable]] and
+      // [[Configurable]] attribute values are described by Desc. If the value
+      // of an attribute field of Desc is absent, the attribute of the newly
+      // created property is set to its default value.
+      if (!o->IsUndefined()) {
+        if (!desc->has_enumerable()) desc->set_enumerable(false);
+        if (!desc->has_configurable()) desc->set_configurable(false);
+        Handle<Object> getter(
+            desc->has_get()
+                ? desc->get()
+                : Handle<Object>::cast(isolate->factory()->undefined_value()));
+        Handle<Object> setter(
+            desc->has_set()
+                ? desc->set()
+                : Handle<Object>::cast(isolate->factory()->undefined_value()));
+        MaybeHandle<Object> result = JSObject::DefineAccessor(
+            o, name, getter, setter, desc->ToAttributes());
+        if (result.is_null()) return false;
+      }
+    }
+    // 2e. Return true.
+    return true;
+  }
+  // 3. Return true, if every field in Desc is absent.
+  // 4. Return true, if every field in Desc also occurs in current and the
+  // value of every field in Desc is the same value as the corresponding field
+  // in current when compared using the SameValue algorithm.
+  if ((!desc->has_enumerable() ||
+       desc->enumerable() == current->enumerable()) &&
+      (!desc->has_configurable() ||
+       desc->configurable() == current->configurable()) &&
+      (!desc->has_value() ||
+       (current->has_value() && current->value()->SameValue(*desc->value()))) &&
+      (!desc->has_writable() ||
+       (current->has_writable() && current->writable() == desc->writable())) &&
+      (!desc->has_get() ||
+       (current->has_get() && current->get()->SameValue(*desc->get()))) &&
+      (!desc->has_set() ||
+       (current->has_set() && current->set()->SameValue(*desc->set())))) {
+    return true;
+  }
+  // 5. If the [[Configurable]] field of current is false, then
+  if (!current->configurable()) {
+    // 5a. Return false, if the [[Configurable]] field of Desc is true.
+    if (desc->has_configurable() && desc->configurable()) {
+      if (should_throw) {
+        isolate->Throw(*isolate->factory()->NewTypeError(
+            MessageTemplate::kRedefineDisallowed, name));
+      }
+      return false;
+    }
+    // 5b. Return false, if the [[Enumerable]] field of Desc is present and the
+    // [[Enumerable]] fields of current and Desc are the Boolean negation of
+    // each other.
+    if (desc->has_enumerable() && desc->enumerable() != current->enumerable()) {
+      if (should_throw) {
+        isolate->Throw(*isolate->factory()->NewTypeError(
+            MessageTemplate::kRedefineDisallowed, name));
+      }
+      return false;
+    }
+  }
+
+  bool current_is_data_descriptor =
+      PropertyDescriptor::IsDataDescriptor(current);
+  // 6. If IsGenericDescriptor(Desc) is true, no further validation is required.
+  if (desc_is_generic_descriptor) {
+    // Nothing to see here.
+
+    // 7. Else if IsDataDescriptor(current) and IsDataDescriptor(Desc) have
+    // different results, then:
+  } else if (current_is_data_descriptor != desc_is_data_descriptor) {
+    // 7a. Return false, if the [[Configurable]] field of current is false.
+    if (!current->configurable()) {
+      if (should_throw) {
+        isolate->Throw(*isolate->factory()->NewTypeError(
+            MessageTemplate::kRedefineDisallowed, name));
+      }
+      return false;
+    }
+    // 7b. If IsDataDescriptor(current) is true, then:
+    if (current_is_data_descriptor) {
+      // 7b i. If O is not undefined, convert the property named P of object O
+      // from a data property to an accessor property. Preserve the existing
+      // values of the converted property's [[Configurable]] and [[Enumerable]]
+      // attributes and set the rest of the property's attributes to their
+      // default values.
+      // --> Folded into step 10.
+    } else {
+      // 7c i. If O is not undefined, convert the property named P of object O
+      // from an accessor property to a data property. Preserve the existing
+      // values of the converted property’s [[Configurable]] and [[Enumerable]]
+      // attributes and set the rest of the property’s attributes to their
+      // default values.
+      // --> Folded into step 10.
+    }
+
+    // 8. Else if IsDataDescriptor(current) and IsDataDescriptor(Desc) are both
+    // true, then:
+  } else if (current_is_data_descriptor && desc_is_data_descriptor) {
+    // 8a. If the [[Configurable]] field of current is false, then:
+    if (!current->configurable()) {
+      // [Strong mode] Disallow changing writable -> readonly for
+      // non-configurable properties.
+      if (current->writable() && desc->has_writable() && !desc->writable() &&
+          o->map()->is_strong()) {
+        if (should_throw) {
+          isolate->Throw(*isolate->factory()->NewTypeError(
+              MessageTemplate::kStrongRedefineDisallowed, o, name));
+        }
+        return false;
+      }
+      // 8a i. Return false, if the [[Writable]] field of current is false and
+      // the [[Writable]] field of Desc is true.
+      if (!current->writable() && desc->has_writable() && desc->writable()) {
+        if (should_throw) {
+          isolate->Throw(*isolate->factory()->NewTypeError(
+              MessageTemplate::kRedefineDisallowed, name));
+        }
+        return false;
+      }
+      // 8a ii. If the [[Writable]] field of current is false, then:
+      if (!current->writable()) {
+        // 8a ii 1. Return false, if the [[Value]] field of Desc is present and
+        // SameValue(Desc.[[Value]], current.[[Value]]) is false.
+        if (desc->has_value() && !desc->value()->SameValue(*current->value())) {
+          if (should_throw) {
+            isolate->Throw(*isolate->factory()->NewTypeError(
+                MessageTemplate::kRedefineDisallowed, name));
+          }
+          return false;
+        }
+      }
+    }
+  } else {
+    // 9. Else IsAccessorDescriptor(current) and IsAccessorDescriptor(Desc)
+    // are both true,
+    DCHECK(PropertyDescriptor::IsAccessorDescriptor(current) &&
+           desc_is_accessor_descriptor);
+    // 9a. If the [[Configurable]] field of current is false, then:
+    if (!current->configurable()) {
+      // 9a i. Return false, if the [[Set]] field of Desc is present and
+      // SameValue(Desc.[[Set]], current.[[Set]]) is false.
+      if (desc->has_set() && !desc->set()->SameValue(*current->set())) {
+        if (should_throw) {
+          isolate->Throw(*isolate->factory()->NewTypeError(
+              MessageTemplate::kRedefineDisallowed, name));
+        }
+        return false;
+      }
+      // 9a ii. Return false, if the [[Get]] field of Desc is present and
+      // SameValue(Desc.[[Get]], current.[[Get]]) is false.
+      if (desc->has_get() && !desc->get()->SameValue(*current->get())) {
+        if (should_throw) {
+          isolate->Throw(*isolate->factory()->NewTypeError(
+              MessageTemplate::kRedefineDisallowed, name));
+        }
+        return false;
+      }
+    }
+  }
+
+  // 10. If O is not undefined, then:
+  if (!o->IsUndefined()) {
+    // 10a. For each field of Desc that is present, set the corresponding
+    // attribute of the property named P of object O to the value of the field.
+    PropertyAttributes attrs = NONE;
+
+    if (desc->has_enumerable()) {
+      attrs = static_cast<PropertyAttributes>(
+          attrs | (desc->enumerable() ? NONE : DONT_ENUM));
+    } else {
+      attrs = static_cast<PropertyAttributes>(
+          attrs | (current->enumerable() ? NONE : DONT_ENUM));
+    }
+    if (desc->has_configurable()) {
+      attrs = static_cast<PropertyAttributes>(
+          attrs | (desc->configurable() ? NONE : DONT_DELETE));
+    } else {
+      attrs = static_cast<PropertyAttributes>(
+          attrs | (current->configurable() ? NONE : DONT_DELETE));
+    }
+    if (desc_is_data_descriptor ||
+        (desc_is_generic_descriptor && current_is_data_descriptor)) {
+      if (desc->has_writable()) {
+        attrs = static_cast<PropertyAttributes>(
+            attrs | (desc->writable() ? NONE : READ_ONLY));
+      } else {
+        attrs = static_cast<PropertyAttributes>(
+            attrs | (current->writable() ? NONE : READ_ONLY));
+      }
+      LookupIterator it = LookupIterator::PropertyOrElement(
+          isolate, o, name, LookupIterator::HIDDEN);
+      Handle<Object> value(
+          desc->has_value() ? desc->value()
+                            : current->has_value()
+                                  ? current->value()
+                                  : Handle<Object>::cast(
+                                        isolate->factory()->undefined_value()));
+      MaybeHandle<Object> result =
+          JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, attrs);
+      if (result.is_null()) return false;
+    } else {
+      DCHECK(desc_is_accessor_descriptor ||
+             (desc_is_generic_descriptor &&
+              PropertyDescriptor::IsAccessorDescriptor(current)));
+      Handle<Object> getter(
+          desc->has_get() ? desc->get()
+                          : current->has_get()
+                                ? current->get()
+                                : Handle<Object>::cast(
+                                      isolate->factory()->undefined_value()));
+      Handle<Object> setter(
+          desc->has_set() ? desc->set()
+                          : current->has_set()
+                                ? current->set()
+                                : Handle<Object>::cast(
+                                      isolate->factory()->undefined_value()));
+      MaybeHandle<Object> result =
+          JSObject::DefineAccessor(o, name, getter, setter, attrs);
+      if (result.is_null()) return false;
+    }
+  }
+
+  // 11. Return true.
+  return true;
+}
+
+
+// TODO(jkummerow): This is copied from FastAsArrayLength() in accessors.cc,
+// consider unification.
+bool PropertyKeyToArrayLength(Handle<Object> value, uint32_t* length) {
+  DCHECK(value->IsNumber() || value->IsName());
+  if (value->ToArrayLength(length)) return true;
+  // We don't support AsArrayLength, so use AsArrayIndex for now. This just
+  // misses out on kMaxUInt32.
+  if (value->IsString()) return String::cast(*value)->AsArrayIndex(length);
+  return false;
+}
+
+
+// TODO(jkummerow): Unify with ArrayLengthSetter in accessors.cc.
+bool AnythingToArrayLength(Isolate* isolate, Handle<Object> length_obj,
+                           uint32_t* output) {
+  // Fast path: check numbers and strings that can be converted directly
+  // and unobservably.
+  if (length_obj->ToUint32(output)) return true;
+  if (length_obj->IsString() &&
+      Handle<String>::cast(length_obj)->AsArrayIndex(output)) {
+    return true;
+  }
+  // Slow path: follow steps in ES6 9.4.2.4 "ArraySetLength".
+  // 3. Let newLen be ToUint32(Desc.[[Value]]).
+  Handle<Object> uint32_v;
+  if (!Execution::ToUint32(isolate, length_obj).ToHandle(&uint32_v)) {
+    // 4. ReturnIfAbrupt(newLen).
+    return false;
+  }
+  // 5. Let numberLen be ToNumber(Desc.[[Value]]).
+  Handle<Object> number_v;
+  if (!Object::ToNumber(length_obj).ToHandle(&number_v)) {
+    // 6. ReturnIfAbrupt(newLen).
+    return false;
+  }
+  // 7. If newLen != numberLen, throw a RangeError exception.
+  if (uint32_v->Number() != number_v->Number()) {
+    Handle<Object> exception =
+        isolate->factory()->NewRangeError(MessageTemplate::kInvalidArrayLength);
+    isolate->Throw(*exception);
+    return false;
+  }
+  return uint32_v->ToArrayLength(output);
+}
+
+
+bool PropertyKeyToArrayIndex(Handle<Object> index_obj, uint32_t* output) {
+  return PropertyKeyToArrayLength(index_obj, output) && *output != kMaxUInt32;
+}
+
+
+// ES6 9.4.2.4
+bool ArraySetLength(Isolate* isolate, Zone* zone, Handle<JSArray> a,
+                    PropertyDescriptor* desc, bool should_throw) {
+  // 1. If the [[Value]] field of Desc is absent, then
+  if (!desc->has_value()) {
+    // 1a. Return OrdinaryDefineOwnProperty(A, "length", Desc).
+    return OrdinaryDefineOwnProperty(isolate, zone, a,
+                                     isolate->factory()->length_string(), desc,
+                                     should_throw);
+  }
+  // 2. Let newLenDesc be a copy of Desc.
+  // (Actual copying is not needed.)
+  PropertyDescriptor* new_len_desc = desc;
+  // 3. - 7. Convert Desc.[[Value]] to newLen.
+  uint32_t new_len = 0;
+  if (!AnythingToArrayLength(isolate, desc->value(), &new_len)) {
+    if (should_throw && !isolate->has_pending_exception()) {
+      isolate->Throw(*isolate->factory()->NewTypeError(
+          MessageTemplate::kCannotConvertToPrimitive));
+    }
+    return false;
+  }
+  // 8. Set newLenDesc.[[Value]] to newLen.
+  // (Not needed.)
+  // 9. Let oldLenDesc be OrdinaryGetOwnProperty(A, "length").
+  PropertyDescriptor* old_len_desc = GetOwnPropertyDescriptor(
+      isolate, zone, a, isolate->factory()->length_string());
+  // 10. (Assert)
+  // 11. Let oldLen be oldLenDesc.[[Value]].
+  uint32_t old_len = 0;
+  CHECK(old_len_desc->value()->ToArrayLength(&old_len));
+  // 12. If newLen >= oldLen, then
+  if (new_len >= old_len) {
+    // 12a. Return OrdinaryDefineOwnProperty(A, "length", newLenDesc).
+    new_len_desc->set_value(isolate->factory()->NewNumberFromUint(new_len));
+    return OrdinaryDefineOwnProperty(isolate, zone, a,
+                                     isolate->factory()->length_string(),
+                                     new_len_desc, should_throw);
+  }
+  // 13. If oldLenDesc.[[Writable]] is false, return false.
+  if (!old_len_desc->writable()) {
+    if (should_throw)
+      isolate->Throw(*isolate->factory()->NewTypeError(
+          MessageTemplate::kRedefineDisallowed,
+          isolate->factory()->length_string()));
+    return false;
+  }
+  // 14. If newLenDesc.[[Writable]] is absent or has the value true,
+  // let newWritable be true.
+  bool new_writable = false;
+  if (!new_len_desc->has_writable() || new_len_desc->writable()) {
+    new_writable = true;
+  } else {
+    // 15. Else,
+    // 15a. Need to defer setting the [[Writable]] attribute to false in case
+    //      any elements cannot be deleted.
+    // 15b. Let newWritable be false. (It's initialized as "false" anyway.)
+    // 15c. Set newLenDesc.[[Writable]] to true.
+    // (Not needed.)
+  }
+  // Most of steps 16 through 19 is implemented by JSArray::SetLength.
+  if (JSArray::ObservableSetLength(a, new_len).is_null()) {
+    if (should_throw) isolate->OptionalRescheduleException(false);
+    return false;
+  }
+  // Steps 19d-ii, 20.
+  if (!new_writable) {
+    PropertyDescriptor* readonly = new (zone) PropertyDescriptor();
+    readonly->set_writable(false);
+    OrdinaryDefineOwnProperty(isolate, zone, a,
+                              isolate->factory()->length_string(), readonly,
+                              should_throw);
+  }
+  uint32_t actual_new_len = 0;
+  CHECK(a->length()->ToArrayLength(&actual_new_len));
+  // Steps 19d-v, 21. Return false if there were non-deletable elements.
+  return actual_new_len == new_len;
+}
+
+
+// ES6 9.4.2.1
+bool DefineOwnProperty_Array(Isolate* isolate, Zone* zone, Handle<JSArray> o,
+                             Handle<Object> name, PropertyDescriptor* desc,
+                             bool should_throw) {
+  // 1. Assert: IsPropertyKey(P) is true. ("P" is |name|.)
+  // 2. If P is "length", then:
+  // TODO(jkummerow): Check if we need slow string comparison.
+  if (*name == isolate->heap()->length_string()) {
+    // 2a. Return ArraySetLength(A, Desc).
+    return ArraySetLength(isolate, zone, o, desc, should_throw);
+  }
+  // 3. Else if P is an array index, then:
+  uint32_t index = 0;
+  if (PropertyKeyToArrayIndex(name, &index)) {
+    // 3a. Let oldLenDesc be OrdinaryGetOwnProperty(A, "length").
+    PropertyDescriptor* old_len_desc = GetOwnPropertyDescriptor(
+        isolate, zone, o, isolate->factory()->length_string());
+    // 3b. (Assert)
+    // 3c. Let oldLen be oldLenDesc.[[Value]].
+    uint32_t old_len = 0;
+    CHECK(old_len_desc->value()->ToArrayLength(&old_len));
+    // 3d. Let index be ToUint32(P).
+    // (Already done above.)
+    // 3e. (Assert)
+    // 3f. If index >= oldLen and oldLenDesc.[[Writable]] is false,
+    //     return false.
+    if (index >= old_len && old_len_desc->has_writable() &&
+        !old_len_desc->writable()) {
+      if (should_throw) {
+        isolate->Throw(*isolate->factory()->NewTypeError(
+            MessageTemplate::kDefineDisallowed, name));
+      }
+      return false;
+    }
+    // 3g. Let succeeded be OrdinaryDefineOwnProperty(A, P, Desc).
+    bool succeeded =
+        OrdinaryDefineOwnProperty(isolate, zone, o, name, desc, should_throw);
+    // 3h. (Assert)
+    // 3i. If succeeded is false, return false.
+    if (!succeeded) return false;
+    // 3j. If index >= oldLen, then:
+    if (index >= old_len) {
+      // 3j i. Set oldLenDesc.[[Value]] to index + 1.
+      old_len_desc->set_value(isolate->factory()->NewNumberFromUint(index + 1));
+      // 3j ii. Let succeeded be
+      //        OrdinaryDefineOwnProperty(A, "length", oldLenDesc).
+      OrdinaryDefineOwnProperty(isolate, zone, o,
+                                isolate->factory()->name_string(), old_len_desc,
+                                should_throw);
+      // 3j iii. (Assert)
+    }
+    // 3k. Return true.
+    return true;
+  }
+
+  // 4. Return OrdinaryDefineOwnProperty(A, P, Desc).
+  return OrdinaryDefineOwnProperty(isolate, zone, o, name, desc, should_throw);
+}
+
+
+// TODO(jkummerow): DefineOwnProperty_Arguments (9.4.4.2)
+// TODO(jkummerow): DefineOwnProperty_IntegerIndexedExotic (9.4.5.3)
+// TODO(jkummerow): DefineOwnProperty_Module (9.4.6.6)
+// TODO(jkummerow): DefineOwnProperty_Proxy (9.5.6)
+
+
+bool DefineOwnProperty(Isolate* isolate, Zone* zone, Handle<JSObject> obj,
+                       Handle<Object> name, PropertyDescriptor* desc,
+                       bool should_throw) {
+  if (obj->IsJSArray()) {
+    return DefineOwnProperty_Array(isolate, zone, Handle<JSArray>::cast(obj),
+                                   name, desc, should_throw);
+  }
+  return OrdinaryDefineOwnProperty(isolate, zone, obj, name, desc,
+                                   should_throw);
+}
+
+
+// Helper function for ToPropertyDescriptor. Handles the case of "simple"
+// objects: nothing on the prototype chain, just own fast data properties.
+// Must not have observable side effects, because the slow path will restart
+// the entire conversion!
+bool ToPropertyDescriptorFastPath(Isolate* isolate, Zone* zone,
+                                  Handle<JSObject> obj,
+                                  PropertyDescriptor* desc) {
+  Map* map = obj->map();
+  if (map->instance_type() != JS_OBJECT_TYPE) return false;
+  if (map->is_access_check_needed()) return false;
+  if (map->prototype() != *isolate->initial_object_prototype()) return false;
+  // TODO(jkummerow): support dictionary properties?
+  if (map->is_dictionary_map()) return false;
+  Handle<DescriptorArray> descs =
+      Handle<DescriptorArray>(map->instance_descriptors());
+  for (int i = 0; i < map->NumberOfOwnDescriptors(); i++) {
+    PropertyDetails details = descs->GetDetails(i);
+    Name* key = descs->GetKey(i);
+    Handle<Object> value;
+    switch (details.type()) {
+      case DATA:
+        value = JSObject::FastPropertyAt(obj, details.representation(),
+                                         FieldIndex::ForDescriptor(map, i));
+        break;
+      case DATA_CONSTANT:
+        value = handle(descs->GetConstant(i), isolate);
+        break;
+      case ACCESSOR:
+      case ACCESSOR_CONSTANT:
+        // Bail out to slow path.
+        return false;
+    }
+    Heap* heap = isolate->heap();
+    if (key == heap->enumerable_string()) {
+      desc->set_enumerable(value->BooleanValue());
+    } else if (key == heap->configurable_string()) {
+      desc->set_configurable(value->BooleanValue());
+    } else if (key == heap->value_string()) {
+      desc->set_value(value);
+    } else if (key == heap->writable_string()) {
+      desc->set_writable(value->BooleanValue());
+    } else if (key == heap->get_string()) {
+      // Bail out to slow path to throw an exception if necessary.
+      if (!value->IsCallable()) return false;
+      desc->set_get(value);
+    } else if (key == heap->set_string()) {
+      // Bail out to slow path to throw an exception if necessary.
+      if (!value->IsCallable()) return false;
+      desc->set_set(value);
+    }
+  }
+  if ((desc->has_get() || desc->has_set()) &&
+      (desc->has_value() || desc->has_writable())) {
+    // Bail out to slow path to throw an exception.
+    return false;
+  }
+  return true;
+}
+
+
+// Helper function for ToPropertyDescriptor. Comments describe steps for
+// "enumerable", other properties are handled the same way.
+// Returns false if an exception was thrown.
+bool GetPropertyIfPresent(Isolate* isolate, Handle<Object> obj,
+                          Handle<String> name, Handle<Object>* value) {
+  LookupIterator it(obj, name);
+  // 4. Let hasEnumerable be HasProperty(Obj, "enumerable").
+  Maybe<PropertyAttributes> maybe_attr = JSReceiver::GetPropertyAttributes(&it);
+  // 5. ReturnIfAbrupt(hasEnumerable).
+  if (!maybe_attr.IsJust()) return false;
+  // 6. If hasEnumerable is true, then
+  if (maybe_attr.FromJust() != ABSENT) {
+    // 6a. Let enum be ToBoolean(Get(Obj, "enumerable")).
+    // 6b. ReturnIfAbrupt(enum).
+    if (!JSObject::GetProperty(&it).ToHandle(value)) return false;
+  }
+  return true;
+}
+
+
+// ES6 6.2.4.5
+// Returns NULL in case of exception.
+PropertyDescriptor* ToPropertyDescriptor(Isolate* isolate, Zone* zone,
+                                         Handle<Object> obj) {
+  // 1. ReturnIfAbrupt(Obj).
+  // 2. If Type(Obj) is not Object, throw a TypeError exception.
+  if (!obj->IsSpecObject()) {
+    isolate->Throw(*isolate->factory()->NewTypeError(
+        MessageTemplate::kPropertyDescObject, obj));
+    return NULL;
+  }
+  // 3. Let desc be a new Property Descriptor that initially has no fields.
+  PropertyDescriptor* desc = new (zone) PropertyDescriptor();
+
+  if (obj->IsJSObject() &&
+      ToPropertyDescriptorFastPath(isolate, zone, Handle<JSObject>::cast(obj),
+                                   desc)) {
+    return desc;
+  }
+
+  // TODO(jkummerow): Implement JSProxy support.
+  if (!obj->IsJSProxy()) {
+    {  // enumerable?
+      Handle<Object> enumerable;
+      // 4 through 6b.
+      if (!GetPropertyIfPresent(isolate, obj,
+                                isolate->factory()->enumerable_string(),
+                                &enumerable)) {
+        return NULL;
+      }
+      // 6c. Set the [[Enumerable]] field of desc to enum.
+      if (!enumerable.is_null()) {
+        desc->set_enumerable(enumerable->BooleanValue());
+      }
+    }
+    {  // configurable?
+      Handle<Object> configurable;
+      // 7 through 9b.
+      if (!GetPropertyIfPresent(isolate, obj,
+                                isolate->factory()->configurable_string(),
+                                &configurable)) {
+        return NULL;
+      }
+      // 9c. Set the [[Configurable]] field of desc to conf.
+      if (!configurable.is_null()) {
+        desc->set_configurable(configurable->BooleanValue());
+      }
+    }
+    {  // value?
+      Handle<Object> value;
+      // 10 through 12b.
+      if (!GetPropertyIfPresent(isolate, obj,
+                                isolate->factory()->value_string(), &value))
+        return NULL;
+      // 12c. Set the [[Value]] field of desc to value.
+      if (!value.is_null()) desc->set_value(value);
+    }
+    {  // writable?
+      Handle<Object> writable;
+      // 13 through 15b.
+      if (!GetPropertyIfPresent(
+              isolate, obj, isolate->factory()->writable_string(), &writable)) {
+        return NULL;
+      }
+      // 15c. Set the [[Writable]] field of desc to writable.
+      if (!writable.is_null()) desc->set_writable(writable->BooleanValue());
+    }
+    {  // getter?
+      Handle<Object> getter;
+      // 16 through 18b.
+      if (!GetPropertyIfPresent(isolate, obj, isolate->factory()->get_string(),
+                                &getter))
+        return NULL;
+      if (!getter.is_null()) {
+        // 18c. If IsCallable(getter) is false and getter is not undefined,
+        // throw a TypeError exception.
+        if (!getter->IsCallable() && !getter->IsUndefined()) {
+          isolate->Throw(*isolate->factory()->NewTypeError(
+              MessageTemplate::kObjectGetterCallable, getter));
+          return NULL;
+        }
+        // 18d. Set the [[Get]] field of desc to getter.
+        desc->set_get(getter);
+      }
+      {  // setter?
+        Handle<Object> setter;
+        // 19 through 21b.
+        if (!GetPropertyIfPresent(isolate, obj,
+                                  isolate->factory()->set_string(), &setter))
+          return NULL;
+        if (!setter.is_null()) {
+          // 21c. If IsCallable(setter) is false and setter is not undefined,
+          // throw a TypeError exception.
+          if (!setter->IsCallable() && !setter->IsUndefined()) {
+            isolate->Throw(*isolate->factory()->NewTypeError(
+                MessageTemplate::kObjectSetterCallable, setter));
+            return NULL;
+          }
+          // 21d. Set the [[Set]] field of desc to setter.
+          desc->set_set(setter);
+        }
+      }
+      // 22. If either desc.[[Get]] or desc.[[Set]] is present, then
+      // 22a. If either desc.[[Value]] or desc.[[Writable]] is present,
+      // throw a TypeError exception.
+      if ((desc->has_get() || desc->has_set()) &&
+          (desc->has_value() || desc->has_writable())) {
+        isolate->Throw(*isolate->factory()->NewTypeError(
+            MessageTemplate::kValueAndAccessor, obj));
+        return NULL;
+      }
+    }
+  } else {
+    DCHECK(obj->IsJSProxy());
+    UNIMPLEMENTED();
+  }
+  // 23. Return desc.
+  return desc;
+}
+
+
+// ES6 19.1.2.3.1
+RUNTIME_FUNCTION(Runtime_ObjectDefineProperties) {
+  HandleScope scope(isolate);
+  DCHECK(args.length() == 2);
+  CONVERT_ARG_HANDLE_CHECKED(Object, o, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, properties, 1);
+
+  // 1. If Type(O) is not Object, throw a TypeError exception.
+  // TODO(jkummerow): Implement Proxy support, change to "IsSpecObject".
+  if (!o->IsJSObject()) {
+    Handle<String> fun_name =
+        isolate->factory()->InternalizeUtf8String("Object.defineProperties");
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kCalledOnNonObject, fun_name));
+  }
+  // 2. Let props be ToObject(Properties).
+  // 3. ReturnIfAbrupt(props).
+  Handle<JSReceiver> props;
+  if (!Object::ToObject(isolate, properties).ToHandle(&props)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kUndefinedOrNullToObject));
+  }
+  // 4. Let keys be props.[[OwnPropertyKeys]]().
+  // 5. ReturnIfAbrupt(keys).
+  Handle<FixedArray> keys;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, keys, JSReceiver::GetKeys(props, JSReceiver::OWN_ONLY,
+                                         JSReceiver::INCLUDE_SYMBOLS));
+  // 6. Let descriptors be an empty List.
+  ZoneScope zone_scope(isolate->runtime_zone());
+  int capacity = keys->length();
+  ZoneList<PropertyDescriptor*> descriptors(capacity, zone_scope.zone());
+  // 7. Repeat for each element nextKey of keys in List order,
+  for (int i = 0; i < keys->length(); ++i) {
+    Handle<Object> next_key(keys->get(i), isolate);
+    // 7a. Let propDesc be props.[[GetOwnProperty]](nextKey).
+    // 7b. ReturnIfAbrupt(propDesc).
+    LookupIterator it = LookupIterator::PropertyOrElement(
+        isolate, props, next_key, LookupIterator::HIDDEN);
+    Maybe<PropertyAttributes> maybe = JSObject::GetPropertyAttributes(&it);
+    if (!maybe.IsJust()) return isolate->heap()->exception();
+    PropertyAttributes attrs = maybe.FromJust();
+    // 7c. If propDesc is not undefined and propDesc.[[Enumerable]] is true:
+    if (attrs == ABSENT) continue;
+    if ((attrs & DONT_ENUM) == 0) {
+      // 7c i. Let descObj be Get(props, nextKey).
+      // 7c ii. ReturnIfAbrupt(descObj).
+      Handle<Object> desc_obj;
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, desc_obj,
+                                         JSObject::GetProperty(&it));
+      // 7c iii. Let desc be ToPropertyDescriptor(descObj).
+      PropertyDescriptor* desc =
+          ToPropertyDescriptor(isolate, zone_scope.zone(), desc_obj);
+      // 7c iv. ReturnIfAbrupt(desc).
+      if (desc == NULL) return isolate->heap()->exception();
+      // 7c v. Append the pair (a two element List) consisting of nextKey and
+      //       desc to the end of descriptors.
+      desc->set_name(next_key);
+      descriptors.Add(desc, zone_scope.zone());
+    }
+  }
+  // 8. For each pair from descriptors in list order,
+  for (int i = 0; i < descriptors.length(); ++i) {
+    PropertyDescriptor* desc = descriptors[i];
+    // 8a. Let P be the first element of pair.
+    // 8b. Let desc be the second element of pair.
+    // 8c. Let status be DefinePropertyOrThrow(O, P, desc).
+    bool status =
+        DefineOwnProperty(isolate, zone_scope.zone(), Handle<JSObject>::cast(o),
+                          desc->name(), desc, true /* should_throw */);
+    // 8d. ReturnIfAbrupt(status).
+    if (isolate->has_pending_exception()) return isolate->heap()->exception();
+    RUNTIME_ASSERT(status == true);
+  }
+  // 9. Return o.
+  return *o;
+}
 }  // namespace internal
 }  // namespace v8