Fast-to-slow migration should wipe out in-object space if it exists in the object after migration.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index bd0c2fd4bef0b7f764edd3a178ba024a8dc553c0..f002406c86eb72d627763318c54d675ec771c0e4 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4418,6 +4418,14 @@ void JSObject::MigrateFastToSlow(Handle<JSObject> object,
 
   object->set_properties(*dictionary);
 
+  // Ensure that in-object space of slow-mode object does not contain random
+  // garbage.
+  int inobject_properties = new_map->inobject_properties();
+  for (int i = 0; i < inobject_properties; i++) {
+    FieldIndex index = FieldIndex::ForPropertyIndex(*new_map, i);
+    object->RawFastPropertyAtPut(index, Smi::FromInt(0));
+  }
+
   isolate->counters()->props_to_dictionary()->Increment();
 
 #ifdef DEBUG