Clear next map word when folding allocations into js arrays.

src/hydrogen-instructions.cc

Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index b0045b8751b06258f0a241416e54615924ea910f..9f9bd59d233c093fc56ec3080a53035ea8b297e5 100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -3207,8 +3207,9 @@ void HAllocate::HandleSideEffectDominator(GVNFlag side_effect,
   }
 
   // First update the size of the dominator allocate instruction.
-  int32_t dominator_size_constant =
+  int32_t original_object_size =
       HConstant::cast(dominator_size)->GetInteger32Constant();
+  int32_t dominator_size_constant = original_object_size;
   int32_t current_size_constant =
       HConstant::cast(current_size)->GetInteger32Constant();
   int32_t new_dominator_size = dominator_size_constant + current_size_constant;
@@ -3242,6 +3243,19 @@ void HAllocate::HandleSideEffectDominator(GVNFlag side_effect,
   if (FLAG_verify_heap) {
     dominator_allocate_instr->MakePrefillWithFiller();
   }
+#else

[Michael Starzinger, 2013/08/27 08:41:24]

The #ifdef is not entirely correct. If we compile with the heap verifier but
don't enable it, nobody will smash garbage.

[Hannes Payer (out of office), 2013/08/27 12:50:54]

Done.

+  // TODO(hpayer): This is a short-term hack to make allocation mementos
+  // work again in new space.
+  if (dominator_allocate_instr->clear_next_map_word_) {
+    HObjectAccess access =
+        HObjectAccess::ForJSObjectOffset(original_object_size);
+    HStoreNamedField* clear_next_map =
+        HStoreNamedField::New(zone, context(), dominator_allocate_instr, access,
+            block->graph()->GetConstantNull());
+    clear_next_map->ClearAllSideEffects();
+    clear_next_map->InsertAfter(dominator_allocate_instr);
+  }
+  dominator_allocate_instr->clear_next_map_word_ = clear_next_map_word_;
 #endif
 
   // After that replace the dominated allocate instruction.