Allow in-object properties in JSArrayBuffer.

src/objects-body-descriptors-inl.h

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_OBJECTS_BODY_DESCRIPTORS_INL_H_
 #define V8_OBJECTS_BODY_DESCRIPTORS_INL_H_
 
 #include "src/objects-body-descriptors.h"
 
 namespace v8 {
@@ skipping 148 matching lines @@
 
 class JSArrayBuffer::BodyDescriptor final : public BodyDescriptorBase {
  public:
   STATIC_ASSERT(kByteLengthOffset + kPointerSize == kBackingStoreOffset);
   STATIC_ASSERT(kBackingStoreOffset + kPointerSize == kBitFieldSlot);
   STATIC_ASSERT(kBitFieldSlot + kPointerSize == kSize);
 
   static bool IsValidSlot(HeapObject* obj, int offset) {
     if (offset < kBackingStoreOffset) return true;
     if (offset < kSize) return false;
-    if (offset < kSizeWithInternalFields) return true;
-    // TODO(ishell): v8:4531, fix when JSArrayBuffers are allowed to have
-    // in-object properties
-    // return IsValidSlotImpl(obj, offset);
-    return true;
+    return IsValidSlotImpl(obj, offset);
   }
 
   template <typename ObjectVisitor>
   static inline void IterateBody(HeapObject* obj, int object_size,
                                  ObjectVisitor* v) {
     IteratePointers(obj, kPropertiesOffset, kBackingStoreOffset, v);
-    IteratePointers(obj, kSize, kSizeWithInternalFields, v);
-
-    // TODO(ishell): v8:4531, fix when JSArrayBuffers are allowed to have
-    // in-object properties
-    // IterateBodyImpl(obj, kSize, object_size, v);
+    IterateBodyImpl(obj, kSize, object_size, v);
   }
 
   template <typename StaticVisitor>
   static inline void IterateBody(HeapObject* obj, int object_size) {
     Heap* heap = obj->GetHeap();
     IteratePointers<StaticVisitor>(heap, obj, kPropertiesOffset,
                                    kBackingStoreOffset);
-    IteratePointers<StaticVisitor>(heap, obj, kSize, kSizeWithInternalFields);
-
-    // TODO(ishell): v8:4531, fix when JSArrayBuffers are allowed to have
-    // in-object properties
-    // IterateBodyImpl<StaticVisitor>(heap, obj, kSize, object_size);
+    IterateBodyImpl<StaticVisitor>(heap, obj, kSize, object_size);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {
-    // TODO(ishell): v8:4531, fix when JSArrayBuffers are allowed to have
-    // in-object properties
-    // return map->instance_size();
-    return kSizeWithInternalFields;
+    return map->instance_size();
   }
 };
 
 
 class BytecodeArray::BodyDescriptor final : public BodyDescriptorBase {
  public:
   static bool IsValidSlot(HeapObject* obj, int offset) {
     return offset == kConstantPoolOffset;
   }
 
@@ skipping 356 matching lines @@
 
 template <typename ObjectVisitor>
 void HeapObject::IterateBodyFast(InstanceType type, int object_size,
                                  ObjectVisitor* v) {
   BodyDescriptorApply<CallIterateBody, void>(type, this, object_size, v);
 }
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_OBJECTS_BODY_DESCRIPTORS_INL_H_