Allow in-object properties in JSCollections, JSWeakCollections and JSRegExp.

src/objects-body-descriptors-inl.h

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_OBJECTS_BODY_DESCRIPTORS_INL_H_
 #define V8_OBJECTS_BODY_DESCRIPTORS_INL_H_
 
 #include "src/objects-body-descriptors.h"
 
 namespace v8 {
@@ skipping 235 matching lines @@
     Heap* heap = obj->GetHeap();
     IteratePointer<StaticVisitor>(heap, obj, kBasePointerOffset);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {
     return reinterpret_cast<FixedTypedArrayBase*>(object)->size();
   }
 };
 
 
-class JSWeakCollection::BodyDescriptor final : public BodyDescriptorBase {
+template <JSWeakCollection::BodyVisitingPolicy body_visiting_policy>
+class JSWeakCollection::BodyDescriptorImpl final : public BodyDescriptorBase {
  public:
+  STATIC_ASSERT(kTableOffset + kPointerSize == kNextOffset);
+  STATIC_ASSERT(kNextOffset + kPointerSize == kSize);
+
   static bool IsValidSlot(HeapObject* obj, int offset) {
-    // TODO(ishell): v8:4531, fix when JSWeakCollections are allowed to have
-    // in-object properties
-    // return IsValidSlotImpl(obj, offset);
-    return true;
+    return IsValidSlotImpl(obj, offset);
   }
 
   template <typename ObjectVisitor>
   static inline void IterateBody(HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    IteratePointers(obj, kPropertiesOffset, kSize, v);
-
-    // TODO(ishell): v8:4531, fix when JSWeakCollections are allowed to have
-    // in-object properties
-    // IterateBodyImpl(obj, kSize, object_size, v);
+    if (body_visiting_policy == kVisitStrong) {
+      IterateBodyImpl(obj, kPropertiesOffset, object_size, v);
+    } else {
+      IteratePointers(obj, kPropertiesOffset, kTableOffset, v);
+      IterateBodyImpl(obj, kSize, object_size, v);
+    }
   }
 
   template <typename StaticVisitor>
   static inline void IterateBody(HeapObject* obj, int object_size) {
     Heap* heap = obj->GetHeap();
-    IteratePointers<StaticVisitor>(heap, obj, kPropertiesOffset, kSize);
-
-    // TODO(ishell): v8:4531, fix when JSWeakCollections are allowed to have
-    // in-object properties
-    // IterateBodyImpl<StaticVisitor>(heap, obj, kSize, object_size);
+    if (body_visiting_policy == kVisitStrong) {
+      IterateBodyImpl<StaticVisitor>(heap, obj, kPropertiesOffset, object_size);
+    } else {
+      IteratePointers<StaticVisitor>(heap, obj, kPropertiesOffset,
+                                     kTableOffset);
+      IterateBodyImpl<StaticVisitor>(heap, obj, kSize, object_size);
+    }
   }
 
-  static inline int SizeOf(Map* map, HeapObject* object) { return kSize; }
+  static inline int SizeOf(Map* map, HeapObject* object) {
+    return map->instance_size();
+  }
 };
 
 
 class Foreign::BodyDescriptor final : public BodyDescriptorBase {
  public:
   static bool IsValidSlot(HeapObject* obj, int offset) { return false; }
 
   template <typename ObjectVisitor>
   static inline void IterateBody(HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
@@ skipping 268 matching lines @@
 
 template <typename ObjectVisitor>
 void HeapObject::IterateBodyFast(InstanceType type, int object_size,
                                  ObjectVisitor* v) {
   BodyDescriptorApply<CallIterateBody, void>(type, this, object_size, v);
 }
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_OBJECTS_BODY_DESCRIPTORS_INL_H_