Allow in-object properties in JSFunctions.

This CL also fixes HeapObject::IterateFast() and HeapObject::IterateBodyFast().

BUG=v8:4531
LOG=Y

Review URL: https://codereview.chromium.org/1469883002

Cr-Commit-Position: refs/heads/master@{#32195}

src/heap/scavenger.cc

@@ -76,14 +76,7 @@ class ScavengingVisitor : public StaticVisitorBase {
     table_.Register(kVisitJSRegExp,
                     &ObjectEvacuationStrategy<POINTER_OBJECT>::Visit);
 
-    if (marks_handling == IGNORE_MARKS) {
-      table_.Register(
-          kVisitJSFunction,
-          &ObjectEvacuationStrategy<POINTER_OBJECT>::template VisitSpecialized<
-              JSFunction::kSize>);
-    } else {
-      table_.Register(kVisitJSFunction, &EvacuateJSFunction);
-    }
+    table_.Register(kVisitJSFunction, &EvacuateJSFunction);
 
     table_.RegisterSpecializations<ObjectEvacuationStrategy<DATA_OBJECT>,
                                    kVisitDataObject, kVisitDataObjectGeneric>();
@@ -242,8 +235,9 @@ class ScavengingVisitor : public StaticVisitorBase {
 
   static inline void EvacuateJSFunction(Map* map, HeapObject** slot,
                                         HeapObject* object) {
-    ObjectEvacuationStrategy<POINTER_OBJECT>::template VisitSpecialized<
-        JSFunction::kSize>(map, slot, object);
+    ObjectEvacuationStrategy<POINTER_OBJECT>::Visit(map, slot, object);
+
+    if (marks_handling == IGNORE_MARKS) return;
 
     MapWord map_word = object->map_word();
     DCHECK(map_word.IsForwardingAddress());

src/objects-body-descriptors-inl.h

@@ -116,10 +116,7 @@ class JSFunction::BodyDescriptorImpl final : public BodyDescriptorBase {
 
   static bool IsValidSlot(HeapObject* obj, int offset) {
     if (offset < kSize) return true;
-    // TODO(ishell): v8:4531, fix when JFunctions are allowed to have
-    // in-object properties
-    // return IsValidSlotImpl(obj, offset);
-    return true;
+    return IsValidSlotImpl(obj, offset);
   }
 
   template <typename ObjectVisitor>
@@ -134,10 +131,7 @@ class JSFunction::BodyDescriptorImpl final : public BodyDescriptorBase {
     if (body_visiting_policy & kVisitNextFunction) {
       IteratePointers(obj, kNextFunctionLinkOffset, kSize, v);
     }
-
-    // TODO(ishell): v8:4531, fix when JFunctions are allowed to have in-object
-    // properties
-    // IterateBodyImpl(obj, kSize, object_size, v);
+    IterateBodyImpl(obj, kSize, object_size, v);
   }
 
   template <typename StaticVisitor>
@@ -154,16 +148,11 @@ class JSFunction::BodyDescriptorImpl final : public BodyDescriptorBase {
     if (body_visiting_policy & kVisitNextFunction) {
       IteratePointers<StaticVisitor>(heap, obj, kNextFunctionLinkOffset, kSize);
     }
-
-    // TODO(ishell): v8:4531, fix when JFunctions are allowed to have in-object
-    // properties
-    // IterateBodyImpl<StaticVisitor>(heap, obj, kSize, object_size);
+    IterateBodyImpl<StaticVisitor>(heap, obj, kSize, object_size);
   }
 
   static inline int SizeOf(Map* map, HeapObject* object) {
-    // TODO(ishell): v8:4531, fix when JFunctions are allowed to have in-object
-    // properties
-    return JSFunction::kSize;
+    return map->instance_size();
   }
 };
 
@@ -555,14 +544,14 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3) {
 template <typename ObjectVisitor>
 void HeapObject::IterateFast(ObjectVisitor* v) {
   BodyDescriptorBase::IteratePointer(this, kMapOffset, v);
-  IterateBody(v);
+  IterateBodyFast(v);
 }
 
 
 template <typename ObjectVisitor>
 void HeapObject::IterateBodyFast(ObjectVisitor* v) {
   Map* m = map();
-  IterateBody(m->instance_type(), SizeFromMap(m), v);
+  IterateBodyFast(m->instance_type(), SizeFromMap(m), v);
 }
 
 

src/objects.cc

@@ -11960,6 +11960,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case JS_MAP_ITERATOR_TYPE:
     case JS_ITERATOR_RESULT_TYPE:
     case JS_PROMISE_TYPE:
+    case JS_FUNCTION_TYPE:
       return true;
 
     case JS_TYPED_ARRAY_TYPE:
@@ -11972,7 +11973,6 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case JS_WEAK_MAP_TYPE:
     case JS_WEAK_SET_TYPE:
     case JS_ARRAY_BUFFER_TYPE:
-    case JS_FUNCTION_TYPE:
       return false;
 
     case JS_GLOBAL_PROXY_TYPE: