MIPS: Fix in-object memory slack tracking bug.

src/mips/builtins-mips.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_MIPS
 
@@ skipping 415 matching lines @@
         // Decrease generous allocation count.
         __ Subu(t0, t0, Operand(1 << Map::Counter::kShift));
         __ Branch(USE_DELAY_SLOT, &allocate, ne, t2,
                   Operand(Map::kSlackTrackingCounterEnd));
         __ sw(t0, bit_field3);  // In delay slot.
 
         __ Push(a1, a2, a1);  // a1 = Constructor.
         __ CallRuntime(Runtime::kFinalizeInstanceSize, 1);
 
         __ Pop(a1, a2);
-        // Slack tracking counter is Map::kSlackTrackingCounterEnd after runtime
-        // call.
-        __ li(t2, Map::kSlackTrackingCounterEnd);
+        __ li(t2, Operand(Map::kSlackTrackingCounterEnd - 1));
 
         __ bind(&allocate);
       }
 
       // Now allocate the JSObject on the heap.
       // a1: constructor function
       // a2: initial map
       __ lbu(a3, FieldMemOperand(a2, Map::kInstanceSizeOffset));
       if (create_memento) {
         __ Addu(a3, a3, Operand(AllocationMemento::kSize / kPointerSize));
@@ skipping 1360 matching lines @@
     __ break_(0xCC);
   }
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_MIPS