Initialize pre-allocated fields of JSObject with undefined.

src/x64/builtins-x64.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 189 matching lines @@
       // rbx: JSObject (not HeapObject tagged - the actual address).
       // rdi: start of next object
       __ movq(Operand(rbx, JSObject::kMapOffset), rax);
       __ LoadRoot(rcx, Heap::kEmptyFixedArrayRootIndex);
       __ movq(Operand(rbx, JSObject::kPropertiesOffset), rcx);
       __ movq(Operand(rbx, JSObject::kElementsOffset), rcx);
       // Set extra fields in the newly allocated object.
       // rax: initial map
       // rbx: JSObject
       // rdi: start of next object
-      { Label loop, entry;
+      { Label loop, entry, load_one_pointer_filler, continue_loop;
         // To allow for truncation.
+        __ lea(rcx, Operand(rbx, JSObject::kHeaderSize));
+        __ LoadRoot(rdx, Heap::kUndefinedValueRootIndex);
         if (count_constructions) {
+          __ movzxbq(rsi,
+                     FieldOperand(rax, Map::kPreAllocatedPropertyFieldsOffset));
+          __ incq(rsi);
+          __ jmp(&entry);
+          __ bind(&load_one_pointer_filler);
           __ LoadRoot(rdx, Heap::kOnePointerFillerMapRootIndex);
-        } else {
-          __ LoadRoot(rdx, Heap::kUndefinedValueRootIndex);
+          __ jmp(&continue_loop);
         }
-        __ lea(rcx, Operand(rbx, JSObject::kHeaderSize));
         __ jmp(&entry);
         __ bind(&loop);
         __ movq(Operand(rcx, 0), rdx);
         __ addq(rcx, Immediate(kPointerSize));
         __ bind(&entry);
+        if (count_constructions) {
+          __ decq(rsi);
+          __ j(zero, &load_one_pointer_filler);
+          __ bind(&continue_loop);
+        }
         __ cmpq(rcx, rdi);
         __ j(less, &loop);
       }
 
       // Add the object tag to make the JSObject real, so that we can continue
       // and jump into the continuation code at any time from now on. Any
       // failures need to undo the allocation, so that the heap is in a
       // consistent state and verifiable.
       // rax: initial map
       // rbx: JSObject
@@ skipping 1352 matching lines @@
   Deoptimizer::EntryGenerator generator(masm, Deoptimizer::OSR);
   generator.Generate();
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64