Don't clear map word when dominator and dominated HAllocate belong to the same basic block.

src/hydrogen-instructions.cc

Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index 22a7586a9996047708ae5c69edd242cc3839f550..fd95ea2600872c165d604090a83fdd2ec6c6e7bd 100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -3804,12 +3804,12 @@ bool HAllocate::HandleSideEffectDominator(GVNFlag side_effect,
   } else {
     // TODO(hpayer): This is a short-term hack to make allocation mementos
     // work again in new space.
-    dominator_allocate->ClearNextMapWord(original_object_size);
+    dominator_allocate->ClearNextMapWord(this, original_object_size);
   }
 #else
   // TODO(hpayer): This is a short-term hack to make allocation mementos
   // work again in new space.
-  dominator_allocate->ClearNextMapWord(original_object_size);
+  dominator_allocate->ClearNextMapWord(this, original_object_size);
 #endif
 
   dominator_allocate->UpdateClearNextMapWord(MustClearNextMapWord());
@@ -3956,8 +3956,12 @@ void HAllocate::CreateFreeSpaceFiller(int32_t free_space_size) {
 }
 
 
-void HAllocate::ClearNextMapWord(int offset) {
-  if (MustClearNextMapWord()) {
+void HAllocate::ClearNextMapWord(HAllocate* dominated, int offset) {
+  // If dominator and dominated allocate operations belong to the same basic
+  // block we can guarantee that there is no fragmentation. Hence, we do not
+  // have to clear the map word of the dominated allocation operation.
+  if (MustClearNextMapWord() &&
+      block()->block_id() != dominated->block()->block_id()) {

[titzer, 2014/04/17 12:41:46]

I don't think this is true, because if you have a deopt in-between, then the GC
can still observe the unitialized map word. This is the same as the condition
for store elimination.

     Zone* zone = block()->zone();
     HObjectAccess access =
         HObjectAccess::ForObservableJSObjectOffset(offset);