MSan: mark any memory allocated from the JS heap as uninitialized.

src/heap/spaces-inl.h

Index: src/heap/spaces-inl.h
diff --git a/src/heap/spaces-inl.h b/src/heap/spaces-inl.h
index 56c2bad70c5dd6f73d3033b14e95be87bc58dc87..d81d253e1b214e89ab2f4d6664f931cdc9c1d5b2 100644
--- a/src/heap/spaces-inl.h
+++ b/src/heap/spaces-inl.h
@@ -8,6 +8,7 @@
 #include "src/heap/spaces.h"
 #include "src/heap-profiler.h"
 #include "src/isolate.h"
+#include "src/msan.h"
 #include "src/v8memory.h"
 
 namespace v8 {
@@ -258,6 +259,7 @@ AllocationResult PagedSpace::AllocateRaw(int size_in_bytes) {
     if (identity() == CODE_SPACE) {
       SkipList::Update(object->address(), size_in_bytes);
     }
+    MSAN_ALLOCATED_UNINITIALIZED_MEMORY(object->address(), size_in_bytes);
     return object;
   }
 
@@ -280,6 +282,9 @@ AllocationResult NewSpace::AllocateRaw(int size_in_bytes) {
   allocation_info_.set_top(allocation_info_.top() + size_in_bytes);
   DCHECK_SEMISPACE_ALLOCATION_INFO(allocation_info_, to_space_);
 
+  // The slow path above ultimately goes through AllocateRaw, so this suffices.
+  MSAN_ALLOCATED_UNINITIALIZED_MEMORY(obj->address(), size_in_bytes);
+
   return obj;
 }