[es6] Fix RegExp built-in subclassing.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include <cmath>
 #include <iomanip>
 #include <sstream>
 
@@ skipping 8206 matching lines @@
   Object* constructor = map->GetConstructor();
   DCHECK(constructor->IsJSFunction());
   DCHECK_EQ(*map, JSFunction::cast(constructor)->initial_map());
 #endif
   Handle<Map> result = RawCopy(map, instance_size);
 
   // Please note instance_type and instance_size are set when allocated.
   result->SetInObjectProperties(in_object_properties);
   result->set_unused_property_fields(unused_property_fields);
 
+  int number_of_own_descriptors = map->NumberOfOwnDescriptors();
+  if (number_of_own_descriptors > 0) {
+    DCHECK(map->owns_descriptors());
+    // The copy will use the same descriptors array, but it's not the owner.
+    result->UpdateDescriptors(map->instance_descriptors(),
+                              map->layout_descriptor());
+    result->set_owns_descriptors(false);
+    result->SetNumberOfOwnDescriptors(number_of_own_descriptors);
+
+    DCHECK_EQ(result->NumberOfFields(),
+              in_object_properties - unused_property_fields);
+  }
+
   return result;
 }
 
 
 Handle<Map> Map::CopyDropDescriptors(Handle<Map> map) {
   Handle<Map> result = RawCopy(map, map->instance_size());
 
   // Please note instance_type and instance_size are set when allocated.
   result->SetInObjectProperties(map->GetInObjectProperties());
   result->set_unused_property_fields(map->unused_property_fields());
@@ skipping 3662 matching lines @@
   Handle<Object> prototype;
   if (original_constructor->has_instance_prototype()) {
     prototype = handle(original_constructor->instance_prototype(), isolate);
   } else {
     prototype = isolate->factory()->NewFunctionPrototype(original_constructor);
   }
 
   // Finally link initial map and constructor function if the original
   // constructor is actually a subclass constructor.
   if (IsSubclassConstructor(original_constructor->shared()->kind())) {
+// TODO(ishell): v8:4531, allow ES6 built-ins subclasses to have
+// in-object properties.
+#if 0
     InstanceType instance_type = constructor_initial_map->instance_type();
     int internal_fields =
         JSObject::GetInternalFieldCount(*constructor_initial_map);
+    int pre_allocated = constructor_initial_map->GetInObjectProperties() -
+                            constructor_initial_map->unused_property_fields();
     int instance_size;
     int in_object_properties;
     original_constructor->CalculateInstanceSizeForDerivedClass(
         instance_type, internal_fields, &instance_size, &in_object_properties);
 
+    int unused_property_fields = in_object_properties - pre_allocated;
     Handle<Map> map =
         Map::CopyInitialMap(constructor_initial_map, instance_size,
-                            in_object_properties, in_object_properties);
+                            in_object_properties, unused_property_fields);
+#endif
+    Handle<Map> map = Map::CopyInitialMap(constructor_initial_map);
 
     JSFunction::SetInitialMap(original_constructor, map, prototype);
     map->SetConstructor(*constructor);
     original_constructor->StartInobjectSlackTracking();
     return map;
 
   } else {
     Handle<Map> map = Map::CopyInitialMap(constructor_initial_map);
     DCHECK(prototype->IsJSReceiver());
     if (map->prototype() != *prototype) {
@@ skipping 6082 matching lines @@
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 
 }  // namespace internal
 }  // namespace v8