Allow in-object properties in JSCollections, JSWeakCollections and JSRegExp.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 95fcd3c87fb37374798e5caf813e4661b4668c4a..227a44be3584021f7cbdceb0c6032d6d6d341c8a 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -9846,7 +9846,19 @@ class JSWeakCollection: public JSObject {
   static const int kNextOffset = kTableOffset + kPointerSize;
   static const int kSize = kNextOffset + kPointerSize;
 
-  class BodyDescriptor;
+  // Visiting policy defines whether the table and next collection fields
+  // should be visited or not.
+  enum BodyVisitingPolicy { kVisitStrong, kVisitWeak };
+
+  // Iterates the function object according to the visiting policy.
+  template <BodyVisitingPolicy>
+  class BodyDescriptorImpl;
+
+  // Visit the whole object.
+  typedef BodyDescriptorImpl<kVisitStrong> BodyDescriptor;
+
+  // Don't visit table and next collection fields.
+  typedef BodyDescriptorImpl<kVisitWeak> BodyDescriptorWeak;
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(JSWeakCollection);