Bug 673017 - Fix use of uninitialized data. r=wmccloskey.

The chunk's bitmap was being cleared at the first GC cycle, but it could be
read before that. Clear it early to fix that.

--HG--
extra : rebase_source : 09b1fb28e8e03ca6798f767426e4b423eb716d4d

js/src/jsgc.cpp

@@ -339,10 +339,11 @@ Chunk::init(JSRuntime *rt)
     for (size_t i = 0; i != JS_ARRAY_LENGTH(markingDelay); ++i)
         markingDelay[i].init();
 
-    /*
-     * The rest of info fields is initailzied in PickChunk. We do not clear
-     * the mark bitmap as that is done at the start of the next GC.
-     */
+    /* We clear the bitmap to guard against xpc_IsGrayGCThing being called on
+       uninitialized data, which would happen before the first GC cycle. */
+    bitmap.clear();
+
+    /* The rest of info fields are initialized in PickChunk. */
 }
 
 inline Chunk **