MSan: mark any memory allocated from the JS heap as uninitialized.

src/heap/spaces.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/base/platform/platform.h"
 #include "src/full-codegen.h"
 #include "src/heap/mark-compact.h"
 #include "src/macro-assembler.h"
@@ skipping 2857 matching lines @@
   uintptr_t limit = base + (page->size() - 1) / MemoryChunk::kAlignment;
   for (uintptr_t key = base; key <= limit; key++) {
     HashMap::Entry* entry = chunk_map_.Lookup(reinterpret_cast<void*>(key),
                                               static_cast<uint32_t>(key), true);
     DCHECK(entry != NULL);
     entry->value = page;
   }
 
   HeapObject* object = page->GetObject();
 
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(object->address(), object_size);
+
   if (Heap::ShouldZapGarbage()) {
     // Make the object consistent so the heap can be verified in OldSpaceStep.
     // We only need to do this in debug builds or if verify_heap is on.
     reinterpret_cast<Object**>(object->address())[0] =
         heap()->fixed_array_map();
     reinterpret_cast<Object**>(object->address())[1] = Smi::FromInt(0);
   }
 
   heap()->incremental_marking()->OldSpaceStep(object_size);
   return object;
@@ skipping 211 matching lines @@
     object->ShortPrint();
     PrintF("\n");
   }
   printf(" --------------------------------------\n");
   printf(" Marked: %x, LiveCount: %x\n", mark_size, LiveBytes());
 }
 
 #endif  // DEBUG
 }
 }  // namespace v8::internal