Ensure the word after top is cleared in newspace if top < high.

src/mark-compact.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2989 matching lines @@
 
   // Store allocation range before flipping semispaces.
   Address from_bottom = new_space->bottom();
   Address from_top = new_space->top();
 
   // Flip the semispaces.  After flipping, to space is empty, from space has
   // live objects.
   new_space->Flip();
   new_space->ResetAllocationInfo();
 
+  // UpdateAllocationSiteFeedback expects that only objects at the end of
+  // newspace are not guaranteed to have the next word clear. It relies on
+  // FromSpacePageHigh to check whether an object is at the end of newspace.
+  // However, it is possible that newspace is being evacuated without it being
+  // full, e.g. to make the heap iterable, hence top will not equal high. In
+  // that case, fill up newspace with a filler to ensure the next word is
+  // cleared.
+  if (FLAG_allocation_site_pretenuring &&
+      from_top < new_space->FromSpacePageHigh()) {
+    Address limit = NewSpacePage::FromLimit(from_top)->area_end();
+    int remaining_in_page = static_cast<int>(limit - from_top);
+    heap()->CreateFillerObjectAt(from_top, remaining_in_page);
+  }
+
   int survivors_size = 0;
 
   // First pass: traverse all objects in inactive semispace, remove marks,
   // migrate live objects and write forwarding addresses.  This stage puts
   // new entries in the store buffer and may cause some pages to be marked
   // scan-on-scavenge.
   NewSpacePageIterator it(from_bottom, from_top);
   while (it.has_next()) {
     NewSpacePage* p = it.next();
     survivors_size += DiscoverAndPromoteBlackObjectsOnPage(new_space, p);
@@ skipping 1376 matching lines @@
   while (buffer != NULL) {
     SlotsBuffer* next_buffer = buffer->next();
     DeallocateBuffer(buffer);
     buffer = next_buffer;
   }
   *buffer_address = NULL;
 }
 
 
 } }  // namespace v8::internal