Use C++ implementation of Object.definePropert{y,ies}

src/property-descriptor.cc

Index: src/property-descriptor.cc
diff --git a/src/property-descriptor.cc b/src/property-descriptor.cc
index 442d056a1c081a6ca22b78ccbfcd5ef8dc056dbc..0745207e74229b5225d5d0cce9539943012a7027 100644
--- a/src/property-descriptor.cc
+++ b/src/property-descriptor.cc
@@ -4,6 +4,7 @@
 
 #include "src/property-descriptor.h"
 
+#include "src/bootstrapper.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
 #include "src/lookup.h"
@@ -43,6 +44,9 @@ bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<Object> obj,
   if (map->instance_type() != JS_OBJECT_TYPE) return false;
   if (map->is_access_check_needed()) return false;
   if (map->prototype() != *isolate->initial_object_prototype()) return false;
+  // During bootstrapping, the object_function_prototype_map hasn't been
+  // set up yet.
+  if (isolate->bootstrapper()->IsActive()) return false;

[Jakob Kummerow, 2015/10/15 17:08:55]

Alternative fix:

Object* empty_prototype_map = isolate->native_context()->get(
    Context::OBJECT_FUNCTION_PROTOTYPE_MAP_INDEX);
if (!empty_prototype_map->IsMap() ||
    JSObject::cast(map->prototype())->map() !=
        Map::cast(empty_prototype_map)) {
  return false;
}

That trades the src/bootstrapper.h #include for a raw ->get(..._INDEX) access. I
think both fixes are ugly. Which one do you prefer? :-)

   if (JSObject::cast(map->prototype())->map() !=
       isolate->native_context()->object_function_prototype_map()) {
     return false;