Initialize pre-allocated fields of JSObject with undefined.

src/arm/builtins-arm.cc

Index: src/arm/builtins-arm.cc
diff --git a/src/arm/builtins-arm.cc b/src/arm/builtins-arm.cc
index 24e1b90f4b4be9b5b0cab552fb02e14cb899ee17..ee12bfd23038d1697b02fdda11ba9160301fcccf 100644
--- a/src/arm/builtins-arm.cc
+++ b/src/arm/builtins-arm.cc
@@ -750,20 +750,21 @@ static void Generate_JSConstructStubHelper(MacroAssembler* masm,
       // r5: First in-object property of JSObject (not tagged)
       __ add(r6, r4, Operand(r3, LSL, kPointerSizeLog2));  // End of object.
       ASSERT_EQ(3 * kPointerSize, JSObject::kHeaderSize);
-      { Label loop, entry;
-        if (count_constructions) {
-          // To allow for truncation.
-          __ LoadRoot(r7, Heap::kOnePointerFillerMapRootIndex);
-        } else {
-          __ LoadRoot(r7, Heap::kUndefinedValueRootIndex);
+      __ LoadRoot(r7, Heap::kUndefinedValueRootIndex);
+      if (count_constructions) {
+        __ ldr(r0, FieldMemOperand(r2, Map::kInstanceSizesOffset));
+        __ Ubfx(r0, r0, Map::kPreAllocatedPropertyFieldsByte * 8, 8);
+        __ add(r0, r5, Operand(r0, LSL, kPointerSizeLog2));
+        // r0: offset of first field after pre-allocated fields
+        if (FLAG_debug_code) {
+          __ cmp(r0, r6);
+          __ Assert(le, "Unexpected number of pre-allocated property fields.");
         }
-        __ b(&entry);
-        __ bind(&loop);
-        __ str(r7, MemOperand(r5, kPointerSize, PostIndex));
-        __ bind(&entry);
-        __ cmp(r5, r6);
-        __ b(lt, &loop);
+        __ InitializeFieldsWithFiller(r5, r0, r7);
+        // To allow for truncation.
+        __ LoadRoot(r7, Heap::kOnePointerFillerMapRootIndex);
       }
+      __ InitializeFieldsWithFiller(r5, r6, r7);
 
       // Add the object tag to make the JSObject real, so that we can continue
       // and jump into the continuation code at any time from now on. Any