Allow in-object properties in JSArrayBuffer.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index cca264aa3764f9851903de0afed7ac270ba0bf28..91d6de091a4ccd56d2a32b03ff9da27238c43c0e 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -12045,6 +12045,7 @@ void JSFunction::SetInitialMap(Handle<JSFunction> function, Handle<Map> map,
 }
 
 
+#ifdef DEBUG
 namespace {
 
 bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
@@ -12057,6 +12058,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case JS_DATE_TYPE:
     case JS_ARRAY_TYPE:
     case JS_MESSAGE_OBJECT_TYPE:
+    case JS_ARRAY_BUFFER_TYPE:
     case JS_TYPED_ARRAY_TYPE:
     case JS_DATA_VIEW_TYPE:
     case JS_SET_TYPE:
@@ -12071,11 +12073,8 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case JS_FUNCTION_TYPE:
       return true;
 
-    case JS_PROXY_TYPE:
     case JS_FUNCTION_PROXY_TYPE:
-    case JS_ARRAY_BUFFER_TYPE:
-      return false;
-
+    case JS_PROXY_TYPE:
     case JS_GLOBAL_PROXY_TYPE:
     case JS_GLOBAL_OBJECT_TYPE:
     case FIXED_ARRAY_TYPE:
@@ -12113,6 +12112,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
 }
 
 }  // namespace
+#endif
 
 
 void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
@@ -12189,27 +12189,21 @@ Handle<Map> JSFunction::EnsureDerivedHasInitialMap(
   // Finally link initial map and constructor function if the original
   // constructor is actually a subclass constructor.
   if (IsSubclassConstructor(new_target->shared()->kind())) {
-    // TODO(ishell): v8:4531, allow ES6 built-ins subclasses to have
-    // in-object properties.
     InstanceType instance_type = constructor_initial_map->instance_type();
-    Handle<Map> map;
-    if (CanSubclassHaveInobjectProperties(instance_type)) {
-      int internal_fields =
-          JSObject::GetInternalFieldCount(*constructor_initial_map);
-      int pre_allocated = constructor_initial_map->GetInObjectProperties() -
-                          constructor_initial_map->unused_property_fields();
-      int instance_size;
-      int in_object_properties;
-      new_target->CalculateInstanceSizeForDerivedClass(
-          instance_type, internal_fields, &instance_size,
-          &in_object_properties);
-
-      int unused_property_fields = in_object_properties - pre_allocated;
-      map = Map::CopyInitialMap(constructor_initial_map, instance_size,
-                                in_object_properties, unused_property_fields);
-    } else {
-      map = Map::CopyInitialMap(constructor_initial_map);
-    }
+    DCHECK(CanSubclassHaveInobjectProperties(instance_type));
+    int internal_fields =
+        JSObject::GetInternalFieldCount(*constructor_initial_map);
+    int pre_allocated = constructor_initial_map->GetInObjectProperties() -
+                        constructor_initial_map->unused_property_fields();
+    int instance_size;
+    int in_object_properties;
+    new_target->CalculateInstanceSizeForDerivedClass(
+        instance_type, internal_fields, &instance_size, &in_object_properties);
+
+    int unused_property_fields = in_object_properties - pre_allocated;
+    Handle<Map> map =
+        Map::CopyInitialMap(constructor_initial_map, instance_size,
+                            in_object_properties, unused_property_fields);
 
     JSFunction::SetInitialMap(new_target, map, prototype);
     map->SetConstructor(*constructor);