Initialize pre-allocated fields of JSObject with undefined.

src/ia32/builtins-ia32.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 186 matching lines @@
       // edi: start of next object
       __ mov(Operand(ebx, JSObject::kMapOffset), eax);
       Factory* factory = masm->isolate()->factory();
       __ mov(ecx, factory->empty_fixed_array());
       __ mov(Operand(ebx, JSObject::kPropertiesOffset), ecx);
       __ mov(Operand(ebx, JSObject::kElementsOffset), ecx);
       // Set extra fields in the newly allocated object.
       // eax: initial map
       // ebx: JSObject
       // edi: start of next object
-      { Label loop, entry;
+      { Label loop, entry, load_one_pointer_filler, continue_loop;
         // To allow for truncation.
+        __ lea(ecx, Operand(ebx, JSObject::kHeaderSize));
+        __ mov(edx, factory->undefined_value());
         if (count_constructions) {
+          __ movzx_b(esi,
+                     FieldOperand(eax, Map::kPreAllocatedPropertyFieldsOffset));
+          __ inc(esi);
+          __ jmp(&entry);
+          __ bind(&load_one_pointer_filler);
           __ mov(edx, factory->one_pointer_filler_map());
-        } else {
-          __ mov(edx, factory->undefined_value());
+          __ jmp(&continue_loop);
         }
-        __ lea(ecx, Operand(ebx, JSObject::kHeaderSize));
         __ jmp(&entry);
         __ bind(&loop);
         __ mov(Operand(ecx, 0), edx);
         __ add(Operand(ecx), Immediate(kPointerSize));
         __ bind(&entry);
+        if (count_constructions) {
+          __ dec(esi);
+          __ j(zero, &load_one_pointer_filler);
+          __ bind(&continue_loop);
+        }

[Vyacheslav Egorov (Chromium), 2011/09/16 15:33:05]

The control flow here looks too complicated.

Consider refactoring into: make function that generates loop code to fill memory
from [ecx, reg) with value of the edx. 
Load into esi = ecx + kPointerSize * esi
Call function twice with esi then with edx.

         __ cmp(ecx, Operand(edi));
         __ j(less, &loop);
       }
 
       // Add the object tag to make the JSObject real, so that we can continue
       // and jump into the continuation code at any time from now on. Any
       // failures need to undo the allocation, so that the heap is in a
       // consistent state and verifiable.
       // eax: initial map
       // ebx: JSObject
@@ skipping 1448 matching lines @@
   Deoptimizer::EntryGenerator generator(masm, Deoptimizer::OSR);
   generator.Generate();
 }
 
 
 #undef __
 }
 }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32