Clear next map word when folding allocations into js arrays.

src/hydrogen-instructions.h

Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index 685a5e883cd4085e231cd2d2b2f99c9a8f863dde..9e51c7e5fbef08a209caae2d583e6877e5664431 100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -5105,6 +5105,10 @@ class HAllocate V8_FINAL : public HTemplateInstruction<2> {
     SetOperandAt(1, size);
   }
 
+  InstanceType instance_type() const {
+    return instance_type_;
+  }
+
   virtual void HandleSideEffectDominator(GVNFlag side_effect,
                                          HValue* dominator) V8_OVERRIDE;
 
@@ -5126,7 +5130,9 @@ class HAllocate V8_FINAL : public HTemplateInstruction<2> {
             HType type,
             PretenureFlag pretenure_flag,
             InstanceType instance_type)
-      : HTemplateInstruction<2>(type) {
+      : HTemplateInstruction<2>(type),
+        instance_type_(instance_type),
+        clear_next_map_word_(false) {
     SetOperandAt(0, context);
     SetOperandAt(1, size);
     set_representation(Representation::Tagged());
@@ -5134,10 +5140,10 @@ class HAllocate V8_FINAL : public HTemplateInstruction<2> {
     SetGVNFlag(kChangesNewSpacePromotion);
     SetGVNFlag(kDependsOnNewSpacePromotion);
     flags_ = pretenure_flag == TENURED
-        ? (Heap::TargetSpaceId(instance_type) == OLD_POINTER_SPACE
+        ? (Heap::TargetSpaceId(instance_type_) == OLD_POINTER_SPACE
             ? ALLOCATE_IN_OLD_POINTER_SPACE : ALLOCATE_IN_OLD_DATA_SPACE)
         : ALLOCATE_IN_NEW_SPACE;
-    if (instance_type == FIXED_DOUBLE_ARRAY_TYPE) {
+    if (instance_type_ == FIXED_DOUBLE_ARRAY_TYPE) {
       flags_ = static_cast<HAllocate::Flags>(flags_ |
           ALLOCATE_DOUBLE_ALIGNED);
     }
@@ -5145,6 +5151,8 @@ class HAllocate V8_FINAL : public HTemplateInstruction<2> {
 
   Flags flags_;
   Handle<Map> known_initial_map_;
+  InstanceType instance_type_;
+  bool clear_next_map_word_;
 };