Clear next map word when folding allocations into js arrays.

src/hydrogen-instructions.cc

Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index b0045b8751b06258f0a241416e54615924ea910f..bb34ca894e7442eaaa96460142fbab32c9415382 100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -3207,8 +3207,9 @@ void HAllocate::HandleSideEffectDominator(GVNFlag side_effect,
   }
 
   // First update the size of the dominator allocate instruction.
-  int32_t dominator_size_constant =
+  int32_t original_object_size =
       HConstant::cast(dominator_size)->GetInteger32Constant();
+  int32_t dominator_size_constant = original_object_size;
   int32_t current_size_constant =
       HConstant::cast(current_size)->GetInteger32Constant();
   int32_t new_dominator_size = dominator_size_constant + current_size_constant;
@@ -3242,6 +3243,21 @@ void HAllocate::HandleSideEffectDominator(GVNFlag side_effect,
   if (FLAG_verify_heap) {
     dominator_allocate_instr->MakePrefillWithFiller();
   }
+#else
+  // TODO(hpayer): This is a short-term hack to make allocation mementos
+  // work again in new space.
+  if (AllocationSite::CanTrack(dominator_allocate_instr->instance_type()) &&

[Michael Starzinger, 2013/08/26 15:03:35]

This doesn't work properly for nested JSArray objects that are all folded
together. Imagine the following sequence ...

v1 = HAllocate(JS_OBJECT_TYPE);
v2 = HAllocate(JS_ARRAY_TYPE + ALLOCATION_SITE);
v3 = HAllocate(WHATEVER);

Here "v1" isn't tracked with an allocation site, so this path never triggers. On
the other hand "v2" is tracked with an allocation site, but garbage that happens
to be at the position of "v3" is not smashed.

+      !dominator_allocate_instr->clear_next_map_word_) {
+    HObjectAccess access =
+        HObjectAccess::ForJSObjectOffset(original_object_size);
+    HStoreNamedField* clear_next_map =
+        HStoreNamedField::New(zone, context(), dominator_allocate_instr, access,
+            block->graph()->GetConstantNull());
+    clear_next_map->ClearAllSideEffects();
+    clear_next_map->InsertAfter(dominator_allocate_instr);
+    dominator_allocate_instr->clear_next_map_word_ = true;
+  }
+
 #endif
 
   // After that replace the dominated allocate instruction.