[deoptimizer] Initialize array iterator index to zero to make heap-verify happy.

src/deoptimizer.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/deoptimizer.h"
 
 #include <memory>
 
 #include "src/accessors.h"
 #include "src/ast/prettyprinter.h"
@@ skipping 3706 matching lines @@
     case JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE:
     case JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE:
     case JS_FAST_ARRAY_VALUE_ITERATOR_TYPE:
     case JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE:
     case JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE:
     case JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE:
     case JS_GENERIC_ARRAY_VALUE_ITERATOR_TYPE: {
       Handle<JSArrayIterator> object = Handle<JSArrayIterator>::cast(
           isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
       slot->value_ = object;
+      // Initialize the index to zero to make the heap verifier happy.
+      object->set_index(Smi::FromInt(0));
       Handle<Object> properties = materializer.FieldAt(value_index);
       Handle<Object> elements = materializer.FieldAt(value_index);
       Handle<Object> iterated_object = materializer.FieldAt(value_index);
       Handle<Object> next_index = materializer.FieldAt(value_index);
       Handle<Object> iterated_object_map = materializer.FieldAt(value_index);
       object->set_properties(FixedArray::cast(*properties));
       object->set_elements(FixedArrayBase::cast(*elements));
       object->set_object(*iterated_object);
       object->set_index(*next_index);
       object->set_object_map(*iterated_object_map);
@@ skipping 429 matching lines @@
       CHECK(value_info->IsMaterializedObject());
 
       value_info->value_ =
           Handle<Object>(previously_materialized_objects->get(i), isolate_);
     }
   }
 }
 
 }  // namespace internal
 }  // namespace v8