1 files changed, 48 insertions, 0 deletions
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index 669178804..4ab8ccb31 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -753,6 +753,9 @@ void Heap::collect(SweepToggle sweepToggle)
         m_objectSpace.resetAllocators();
     }
     
+    if (Options::useZombieMode())
+        zombifyDeadObjects();
+
     size_t currentHeapSize = size();
     if (fullGC) {
         m_sizeAfterLastCollect = currentHeapSize;
@@ -844,4 +847,49 @@ void Heap::didStartVMShutdown()
     lastChanceToFinalize();
 }
 
+class ZombifyCellFunctor : public MarkedBlock::VoidFunctor {
+public:
+    ZombifyCellFunctor(size_t cellSize)
+        : m_cellSize(cellSize)
+    {
+    }
+
+    void operator()(JSCell* cell)
+    {
+        if (Options::zombiesAreImmortal())
+            MarkedBlock::blockFor(cell)->setMarked(cell);
+
+        void** current = reinterpret_cast<void**>(cell);
+
+        // We want to maintain zapped-ness because that's how we know if we've called 
+        // the destructor.
+        if (cell->isZapped())
+            current++;
+
+        void* limit = static_cast<void*>(reinterpret_cast<char*>(cell) + m_cellSize);
+        for (; current < limit; current++)
+            *current = reinterpret_cast<void*>(0xbbadbeef);
+    }
+
+private:
+    size_t m_cellSize;
+};
+
+class ZombifyBlockFunctor : public MarkedBlock::VoidFunctor {
+public:
+    void operator()(MarkedBlock* block)
+    {
+        ZombifyCellFunctor functor(block->cellSize());
+        block->forEachDeadCell(functor);
+    }
+};
+
+void Heap::zombifyDeadObjects()
+{
+    m_objectSpace.sweep();
+
+    ZombifyBlockFunctor functor;
+    m_objectSpace.forEachBlock(functor);
+}
+
 } // namespace JSC