MSan: mark any memory allocated from the JS heap as uninitialized.

src/heap/spaces-inl.h

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HEAP_SPACES_INL_H_
 #define V8_HEAP_SPACES_INL_H_
 
 #include "src/heap/spaces.h"
 #include "src/heap-profiler.h"
 #include "src/isolate.h"
+#include "src/msan.h"
 #include "src/v8memory.h"
 
 namespace v8 {
 namespace internal {
 
 
 // -----------------------------------------------------------------------------
 // Bitmap
 
 void Bitmap::Clear(MemoryChunk* chunk) {
@@ skipping 230 matching lines @@
     object = free_list_.Allocate(size_in_bytes);
     if (object == NULL) {
       object = SlowAllocateRaw(size_in_bytes);
     }
   }
 
   if (object != NULL) {
     if (identity() == CODE_SPACE) {
       SkipList::Update(object->address(), size_in_bytes);
     }
+    MSAN_ALLOCATED_UNINITIALIZED_MEMORY(object->address(), size_in_bytes);
     return object;
   }
 
   return AllocationResult::Retry(identity());
 }
 
 
 // -----------------------------------------------------------------------------
 // NewSpace
 
 
 AllocationResult NewSpace::AllocateRaw(int size_in_bytes) {
   Address old_top = allocation_info_.top();
 
   if (allocation_info_.limit() - old_top < size_in_bytes) {
     return SlowAllocateRaw(size_in_bytes);
   }
 
   HeapObject* obj = HeapObject::FromAddress(old_top);
   allocation_info_.set_top(allocation_info_.top() + size_in_bytes);
   DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
 
+  // The slow path above ultimately goes through AllocateRaw, so this suffices.
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(obj->address(), size_in_bytes);
+
   return obj;
 }
 
 
 LargePage* LargePage::Initialize(Heap* heap, MemoryChunk* chunk) {
   heap->incremental_marking()->SetOldSpacePageFlags(chunk);
   return static_cast<LargePage*>(chunk);
 }
 
 
 intptr_t LargeObjectSpace::Available() {
   return ObjectSizeFor(heap()->isolate()->memory_allocator()->Available());
 }
 
 
 bool FreeListNode::IsFreeListNode(HeapObject* object) {
   Map* map = object->map();
   Heap* heap = object->GetHeap();
   return map == heap->raw_unchecked_free_space_map() ||
          map == heap->raw_unchecked_one_pointer_filler_map() ||
          map == heap->raw_unchecked_two_pointer_filler_map();
 }
 }
 }  // namespace v8::internal
 
 #endif  // V8_HEAP_SPACES_INL_H_