Reland "Use C++ implementation of Object.definePropert{y,ies}"

src/property-descriptor.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/property-descriptor.h"
 
+#include "src/bootstrapper.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
 #include "src/lookup.h"
 #include "src/objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
 // Helper function for ToPropertyDescriptor. Comments describe steps for
 // "enumerable", other properties are handled the same way.
@@ skipping 19 matching lines @@
 // objects: nothing on the prototype chain, just own fast data properties.
 // Must not have observable side effects, because the slow path will restart
 // the entire conversion!
 bool ToPropertyDescriptorFastPath(Isolate* isolate, Handle<Object> obj,
                                   PropertyDescriptor* desc) {
   if (!obj->IsJSObject()) return false;
   Map* map = Handle<JSObject>::cast(obj)->map();
   if (map->instance_type() != JS_OBJECT_TYPE) return false;
   if (map->is_access_check_needed()) return false;
   if (map->prototype() != *isolate->initial_object_prototype()) return false;
+  // During bootstrapping, the object_function_prototype_map hasn't been
+  // set up yet.
+  if (isolate->bootstrapper()->IsActive()) return false;
   if (JSObject::cast(map->prototype())->map() !=
       isolate->native_context()->object_function_prototype_map()) {
     return false;
   }
   // TODO(jkummerow): support dictionary properties?
   if (map->is_dictionary_map()) return false;
   Handle<DescriptorArray> descs =
       Handle<DescriptorArray>(map->instance_descriptors());
   for (int i = 0; i < map->NumberOfOwnDescriptors(); i++) {
     PropertyDetails details = descs->GetDetails(i);
@@ skipping 147 matching lines @@
       // throw a TypeError exception.
       if ((desc->has_get() || desc->has_set()) &&
           (desc->has_value() || desc->has_writable())) {
         isolate->Throw(*isolate->factory()->NewTypeError(
             MessageTemplate::kValueAndAccessor, obj));
         return false;
       }
     }
   } else {
     DCHECK(obj->IsJSProxy());
-    UNIMPLEMENTED();
+    // Having an UNIMPLEMENTED() here would upset ClusterFuzz, because
+    // --harmony-proxies makes it possible to reach this branch.
+    isolate->Throw(
+        *isolate->factory()->NewTypeError(MessageTemplate::kUnsupported));
+    return false;
   }
   // 23. Return desc.
   return true;
 }
 
 
 }  // namespace internal
 }  // namespace v8