Initialize pre-allocated fields of JSObject with undefined.

Initialize pre-allocated fields of JSObject with undefined.

BUG=94873
Committed: http://code.google.com/p/v8/source/detail?r=9335

[Yang, 2011-09-16 13:41:05]

Fixed this issue for ia32 and x64 for now. Arm will follow in a second CL.
However, I have yet to find a way to create a test case for this except for
compiling this into Chromium and try to reproduce this problem as described in
the issue.

I tried to write a cctest that would define the constructor with a 'debugger'
statement before the initializing and then use the constructor. The debug event
handler would then get the 'this' object and call GetOwnPropertyNames(). The
list of property names however is empty.

Any ideas?

[Vyacheslav Egorov (Chromium), 2011-09-16 15:33:05]

I think you can create a test case if you'll use JavaScript debugger API
(--expose-debug-as)

http://codereview.chromium.org/7929001/diff/1/src/heap.cc
File src/heap.cc (right):

http://codereview.chromium.org/7929001/diff/1/src/heap.cc#newcode3358
src/heap.cc:3358: obj->InitializeBody(map, Heap::undefined_value(),
Heap::undefined_value());
Can be moved outside of the if to avoid code duplication:

obj->InitializeBody(map, Heap::undefined_value(), filler);

http://codereview.chromium.org/7929001/diff/1/src/ia32/builtins-ia32.cc
File src/ia32/builtins-ia32.cc (right):

http://codereview.chromium.org/7929001/diff/1/src/ia32/builtins-ia32.cc#newco...
src/ia32/builtins-ia32.cc:229: }
The control flow here looks too complicated.

Consider refactoring into: make function that generates loop code to fill memory
from [ecx, reg) with value of the edx. 
Load into esi = ecx + kPointerSize * esi
Call function twice with esi then with edx.

[Vyacheslav Egorov (Chromium), 2011-09-16 15:33:59]

> Call function twice with esi then with edx.

Should read: Call function twice with esi then with edi.

[Yang, 2011-09-19 10:46:51]

Changed according to suggestions.

I tried to write a test case with --expose-debug-as, breaking inside the
constructor to use the object mirror. However, neither the "this" object nor the
object by name refer to the object currently being created in the constructor.
Bottom line is that I still wasn't able to reproduce the bug as a test case.

[Vyacheslav Egorov (Chromium), 2011-09-19 11:30:39]

lgtm

Please don't commit without testcase 

I've sent you one, please verify that your CL fixes segfault on it.

http://codereview.chromium.org/7929001/diff/7001/src/objects.h
File src/objects.h (right):

http://codereview.chromium.org/7929001/diff/7001/src/objects.h#newcode1937
src/objects.h:1937: // reponsibility to ensure that *v* can be collected without
WB here.
update comment (it references *v*)

[Yang, 2011-09-19 13:20:51]

Added test case (it passes now) and ARM port, fixed one copy&paste bug in ia32.
Please take another look.

[Vyacheslav Egorov (Chromium), 2011-09-20 09:28:31]

LGTM!