Don't clear map word when dominator and dominated HAllocate belong to the same basic block.

src/hydrogen-instructions.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3786 matching lines @@
       Representation::None(),
       dominator_allocate);
   dominator_allocate->UpdateSize(new_dominator_size_constant);
 
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap && dominator_allocate->IsNewSpaceAllocation()) {
     dominator_allocate->MakePrefillWithFiller();
   } else {
     // TODO(hpayer): This is a short-term hack to make allocation mementos
     // work again in new space.
-    dominator_allocate->ClearNextMapWord(original_object_size);
+    dominator_allocate->ClearNextMapWord(this, original_object_size);
   }
 #else
   // TODO(hpayer): This is a short-term hack to make allocation mementos
   // work again in new space.
-  dominator_allocate->ClearNextMapWord(original_object_size);
+  dominator_allocate->ClearNextMapWord(this, original_object_size);
 #endif
 
   dominator_allocate->UpdateClearNextMapWord(MustClearNextMapWord());
 
   // After that replace the dominated allocate instruction.
   HInstruction* inner_offset = HConstant::CreateAndInsertBefore(
       zone,
       context(),
       dominator_size_constant,
       Representation::None(),
@@ skipping 126 matching lines @@
                                      FreeSpace::kSizeOffset,
                                      Representation::Smi());
   HStoreNamedField* store_size = HStoreNamedField::New(zone, context(),
       free_space_instr, access, filler_size);
   store_size->SetFlag(HValue::kHasNoObservableSideEffects);
   store_size->InsertAfter(filler_size);
   filler_free_space_size_ = store_size;
 }
 
 
-void HAllocate::ClearNextMapWord(int offset) {
-  if (MustClearNextMapWord()) {
+void HAllocate::ClearNextMapWord(HAllocate* dominated, int offset) {
+  // If dominator and dominated allocate operations belong to the same basic
+  // block we can guarantee that there is no fragmentation. Hence, we do not
+  // have to clear the map word of the dominated allocation operation.
+  if (MustClearNextMapWord() &&
+      block()->block_id() != dominated->block()->block_id()) {

[titzer, 2014/04/17 12:41:46]

I don't think this is true, because if you have a deopt in-between, then the GC
can still observe the unitialized map word. This is the same as the condition
for store elimination.

     Zone* zone = block()->zone();
     HObjectAccess access =
         HObjectAccess::ForObservableJSObjectOffset(offset);
     HStoreNamedField* clear_next_map =
         HStoreNamedField::New(zone, context(), this, access,
             block()->graph()->GetConstant0());
     clear_next_map->ClearAllSideEffects();
     clear_next_map->InsertAfter(this);
   }
 }
@@ skipping 751 matching lines @@
       break;
     case kExternalMemory:
       stream->Add("[external-memory]");
       break;
   }
 
   stream->Add("@%d", offset());
 }
 
 } }  // namespace v8::internal