MIPS: Fix in-object memory slack tracking bug.

src/mips64/builtins-mips64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_MIPS64
 
@@ skipping 416 matching lines @@
         // Decrease generous allocation count.
         __ Dsubu(a4, a4, Operand(1 << Map::Counter::kShift));
         __ Branch(USE_DELAY_SLOT, &allocate, ne, a6,
                   Operand(Map::kSlackTrackingCounterEnd));
         __ sw(a4, bit_field3);  // In delay slot.
 
         __ Push(a1, a2, a1);  // a1 = Constructor.
         __ CallRuntime(Runtime::kFinalizeInstanceSize, 1);
 
         __ Pop(a1, a2);
-        // Slack tracking counter is Map::kSlackTrackingCounterEnd after runtime
-        // call.
-        __ li(a6, Map::kSlackTrackingCounterEnd);
+        __ li(a6, Operand(Map::kSlackTrackingCounterEnd - 1));
 
         __ bind(&allocate);
       }
 
       // Now allocate the JSObject on the heap.
       // a1: constructor function
       // a2: initial map
       __ lbu(a3, FieldMemOperand(a2, Map::kInstanceSizeOffset));
       if (create_memento) {
         __ Daddu(a3, a3, Operand(AllocationMemento::kSize / kPointerSize));
@@ skipping 1368 matching lines @@
     __ break_(0xCC);
   }
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_MIPS64