Reverting 2768.

src/ia32/builtins-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 115 matching lines @@
 
     // Now allocate the JSObject on the heap.
     // edi: constructor
     // eax: initial map
     __ movzx_b(edi, FieldOperand(eax, Map::kInstanceSizeOffset));
     __ shl(edi, kPointerSizeLog2);
     // Make sure that the maximum heap object size will never cause us
     // problem here, because it is always greater than the maximum
     // instance size that can be represented in a byte.
     ASSERT(Heap::MaxObjectSizeInPagedSpace() >= JSObject::kMaxInstanceSize);
-    __ AllocateObjectInNewSpace(edi, ebx, edi, no_reg, &rt_call, false);
+    ExternalReference new_space_allocation_top =
+        ExternalReference::new_space_allocation_top_address();
+    __ mov(ebx, Operand::StaticVariable(new_space_allocation_top));
+    __ add(edi, Operand(ebx));  // Calculate new top
+    ExternalReference new_space_allocation_limit =
+        ExternalReference::new_space_allocation_limit_address();
+    __ cmp(edi, Operand::StaticVariable(new_space_allocation_limit));
+    __ j(above_equal, &rt_call);
     // Allocated the JSObject, now initialize the fields.
     // eax: initial map
     // ebx: JSObject
     // edi: start of next object
     __ mov(Operand(ebx, JSObject::kMapOffset), eax);
     __ mov(ecx, Factory::empty_fixed_array());
     __ mov(Operand(ebx, JSObject::kPropertiesOffset), ecx);
     __ mov(Operand(ebx, JSObject::kElementsOffset), ecx);
     // Set extra fields in the newly allocated object.
     // eax: initial map
@@ skipping 12 matching lines @@
     }
 
     // Mostly done with the JSObject. Add the heap tag and store the new top, so
     // that we can continue and jump into the continuation code at any time from
     // now on. Any failures need to undo the setting of the new top, so that the
     // heap is in a consistent state and verifiable.
     // eax: initial map
     // ebx: JSObject
     // edi: start of next object
     __ or_(Operand(ebx), Immediate(kHeapObjectTag));
+    __ mov(Operand::StaticVariable(new_space_allocation_top), edi);
 
     // Check if a non-empty properties array is needed.
     // Allocate and initialize a FixedArray if it is.
     // eax: initial map
     // ebx: JSObject
     // edi: start of next object
     // Calculate the total number of properties described by the map.
     __ movzx_b(edx, FieldOperand(eax, Map::kUnusedPropertyFieldsOffset));
     __ movzx_b(ecx, FieldOperand(eax, Map::kPreAllocatedPropertyFieldsOffset));
     __ add(edx, Operand(ecx));
     // Calculate unused properties past the end of the in-object properties.
     __ movzx_b(ecx, FieldOperand(eax, Map::kInObjectPropertiesOffset));
     __ sub(edx, Operand(ecx));
     // Done if no extra properties are to be allocated.
     __ j(zero, &allocated);
     __ Assert(positive, "Property allocation count failed.");
 
     // Scale the number of elements by pointer size and add the header for
     // FixedArrays to the start of the next object calculation from above.
     // ebx: JSObject
     // edi: start of next object (will be start of FixedArray)
     // edx: number of elements in properties array
     ASSERT(Heap::MaxObjectSizeInPagedSpace() >
            (FixedArray::kHeaderSize + 255*kPointerSize));
-    __ AllocateObjectInNewSpace(FixedArray::kHeaderSize,
-                                times_pointer_size,
-                                edx,
-                                edi,
-                                ecx,
-                                no_reg,
-                                &undo_allocation,
-                                true);
+    __ lea(ecx, Operand(edi, edx, times_pointer_size, FixedArray::kHeaderSize));
+    __ cmp(ecx, Operand::StaticVariable(new_space_allocation_limit));
+    __ j(above_equal, &undo_allocation);
+    __ mov(Operand::StaticVariable(new_space_allocation_top), ecx);
 
     // Initialize the FixedArray.
     // ebx: JSObject
     // edi: FixedArray
     // edx: number of elements
     // ecx: start of next object
     __ mov(eax, Factory::fixed_array_map());
     __ mov(Operand(edi, JSObject::kMapOffset), eax);  // setup the map
     __ mov(Operand(edi, Array::kLengthOffset), edx);  // and length
 
@@ skipping 23 matching lines @@
 
     // Continue with JSObject being successfully allocated
     // ebx: JSObject
     __ jmp(&allocated);
 
     // Undo the setting of the new top so that the heap is verifiable. For
     // example, the map's unused properties potentially do not match the
     // allocated objects unused properties.
     // ebx: JSObject (previous new top)
     __ bind(&undo_allocation);
-    __ UndoAllocationInNewSpace(ebx);
+    __ xor_(Operand(ebx), Immediate(kHeapObjectTag));  // clear the heap tag
+    __ mov(Operand::StaticVariable(new_space_allocation_top), ebx);
   }
 
   // Allocate the new receiver object using the runtime call.
   // edi: function (constructor)
   __ bind(&rt_call);
   // Must restore edi (constructor) before calling runtime.
   __ mov(edi, Operand(esp, 0));
   __ push(edi);
   __ CallRuntime(Runtime::kNewObject, 1);
   __ mov(ebx, Operand(eax));  // store result in ebx
@@ skipping 514 matching lines @@
   // Dont adapt arguments.
   // -------------------------------------------
   __ bind(&dont_adapt_arguments);
   __ jmp(Operand(edx));
 }
 
 
 #undef __
 
 } }  // namespace v8::internal