Allow in-object properties in JSArrayBuffer.

src/objects-body-descriptors.h

Index: src/objects-body-descriptors.h
diff --git a/src/objects-body-descriptors.h b/src/objects-body-descriptors.h
index 8168447da688bf392fb3ad6a56fbd4f81e1cb71d..91cb8883be88739eab2b10df71f6f0d08aab436e 100644
--- a/src/objects-body-descriptors.h
+++ b/src/objects-body-descriptors.h
@@ -51,13 +51,15 @@ class BodyDescriptorBase BASE_EMBEDDED {
   static inline void IteratePointer(Heap* heap, HeapObject* obj, int offset);
 
  protected:
-  // Returns true for all header fields.
+  // Returns true for all header and internal fields.
   static inline bool IsValidSlotImpl(HeapObject* obj, int offset);
 
+  // Treats all header and internal fields in the range as tagged.
   template <typename ObjectVisitor>
   static inline void IterateBodyImpl(HeapObject* obj, int start_offset,
                                      int end_offset, ObjectVisitor* v);
 
+  // Treats all header and internal fields in the range as tagged.
   template <typename StaticVisitor>
   static inline void IterateBodyImpl(Heap* heap, HeapObject* obj,
                                      int start_offset, int end_offset);