Allow in-object properties in JSCollections, JSWeakCollections and JSRegExp.

src/objects-body-descriptors-inl.h

Index: src/objects-body-descriptors-inl.h
diff --git a/src/objects-body-descriptors-inl.h b/src/objects-body-descriptors-inl.h
index e8de54d57e00a901263835293905042aa033d79e..4f30f99b458d98c1a2fe3790d28fb041776734f1 100644
--- a/src/objects-body-descriptors-inl.h
+++ b/src/objects-body-descriptors-inl.h
@@ -253,36 +253,42 @@ class FixedTypedArrayBase::BodyDescriptor final : public BodyDescriptorBase {
 };
 
 
-class JSWeakCollection::BodyDescriptor final : public BodyDescriptorBase {
+template <JSWeakCollection::BodyVisitingPolicy body_visiting_policy>
+class JSWeakCollection::BodyDescriptorImpl final : public BodyDescriptorBase {
  public:
+  STATIC_ASSERT(kTableOffset + kPointerSize == kNextOffset);
+  STATIC_ASSERT(kNextOffset + kPointerSize == kSize);
+
   static bool IsValidSlot(HeapObject* obj, int offset) {
-    // TODO(ishell): v8:4531, fix when JSWeakCollections are allowed to have
-    // in-object properties
-    // return IsValidSlotImpl(obj, offset);
-    return true;
+    return IsValidSlotImpl(obj, offset);
   }
 
   template <typename ObjectVisitor>
   static inline void IterateBody(HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
-    IteratePointers(obj, kPropertiesOffset, kSize, v);
-
-    // TODO(ishell): v8:4531, fix when JSWeakCollections are allowed to have
-    // in-object properties
-    // IterateBodyImpl(obj, kSize, object_size, v);
+    if (body_visiting_policy == kVisitStrong) {
+      IterateBodyImpl(obj, kPropertiesOffset, object_size, v);
+    } else {
+      IteratePointers(obj, kPropertiesOffset, kTableOffset, v);
+      IterateBodyImpl(obj, kSize, object_size, v);
+    }
   }
 
   template <typename StaticVisitor>
   static inline void IterateBody(HeapObject* obj, int object_size) {
     Heap* heap = obj->GetHeap();
-    IteratePointers<StaticVisitor>(heap, obj, kPropertiesOffset, kSize);
-
-    // TODO(ishell): v8:4531, fix when JSWeakCollections are allowed to have
-    // in-object properties
-    // IterateBodyImpl<StaticVisitor>(heap, obj, kSize, object_size);
+    if (body_visiting_policy == kVisitStrong) {
+      IterateBodyImpl<StaticVisitor>(heap, obj, kPropertiesOffset, object_size);
+    } else {
+      IteratePointers<StaticVisitor>(heap, obj, kPropertiesOffset,
+                                     kTableOffset);
+      IterateBodyImpl<StaticVisitor>(heap, obj, kSize, object_size);
+    }
   }
 
-  static inline int SizeOf(Map* map, HeapObject* object) { return kSize; }
+  static inline int SizeOf(Map* map, HeapObject* object) {
+    return map->instance_size();
+  }
 };