Clear next map word when folding allocations into js arrays.

src/hydrogen-instructions.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5148 matching lines @@
     PREFILL_WITH_FILLER = 1 << 4
   };
 
   HAllocate(HValue* context,
             HValue* size,
             HType type,
             PretenureFlag pretenure_flag,
             InstanceType instance_type)
       : HTemplateInstruction<2>(type),
         dominating_allocate_(NULL),
-        filler_free_space_size_(NULL) {
+        filler_free_space_size_(NULL),
+        clear_next_map_word_(false) {
     SetOperandAt(0, context);
     SetOperandAt(1, size);
     set_representation(Representation::Tagged());
     SetFlag(kTrackSideEffectDominators);
     SetGVNFlag(kChangesNewSpacePromotion);
     SetGVNFlag(kDependsOnNewSpacePromotion);
     flags_ = pretenure_flag == TENURED
         ? (Heap::TargetSpaceId(instance_type) == OLD_POINTER_SPACE
             ? ALLOCATE_IN_OLD_POINTER_SPACE : ALLOCATE_IN_OLD_DATA_SPACE)
         : ALLOCATE_IN_NEW_SPACE;
     if (instance_type == FIXED_DOUBLE_ARRAY_TYPE) {
       flags_ = static_cast<HAllocate::Flags>(flags_ | ALLOCATE_DOUBLE_ALIGNED);
     }
     // We have to fill the allocated object with one word fillers if we do
     // not use allocation folding since some allocations may depend on each
     // other, i.e., have a pointer to each other. A GC in between these
     // allocations may leave such objects behind in a not completely initialized
     // state.
     if (!FLAG_use_gvn || !FLAG_use_allocation_folding) {
       flags_ = static_cast<HAllocate::Flags>(flags_ | PREFILL_WITH_FILLER);
     }
+    clear_next_map_word_ = pretenure_flag == NOT_TENURED &&
+        AllocationSite::CanTrack(instance_type);
   }
 
   void UpdateSize(HValue* size) {
     SetOperandAt(1, size);
   }
 
   HAllocate* GetFoldableDominator(HAllocate* dominator);
 
   void UpdateFreeSpaceFiller(int32_t filler_size);
 
   void CreateFreeSpaceFiller(int32_t filler_size);
 
   bool IsFoldable(HAllocate* allocate) {
     return (IsNewSpaceAllocation() && allocate->IsNewSpaceAllocation()) ||
         (IsOldDataSpaceAllocation() && allocate->IsOldDataSpaceAllocation()) ||
         (IsOldPointerSpaceAllocation() &&
             allocate->IsOldPointerSpaceAllocation());
   }
 
+  void ClearNextMapWord(int offset);
+
   Flags flags_;
   Handle<Map> known_initial_map_;
   HAllocate* dominating_allocate_;
   HStoreNamedField* filler_free_space_size_;
+  bool clear_next_map_word_;
 };
 
 
 class HStoreCodeEntry V8_FINAL: public HTemplateInstruction<2> {
  public:
   static HStoreCodeEntry* New(Zone* zone,
                               HValue* context,
                               HValue* function,
                               HValue* code) {
     return new(zone) HStoreCodeEntry(function, code);
@@ skipping 1703 matching lines @@
   virtual bool IsDeletable() const V8_OVERRIDE { return true; }
 };
 
 
 #undef DECLARE_INSTRUCTION
 #undef DECLARE_CONCRETE_INSTRUCTION
 
 } }  // namespace v8::internal
 
 #endif  // V8_HYDROGEN_INSTRUCTIONS_H_