Support fast-path allocation for subclass constructors with correctly initialized initial maps.

src/mips64/builtins-mips64.cc

Index: src/mips64/builtins-mips64.cc
diff --git a/src/mips64/builtins-mips64.cc b/src/mips64/builtins-mips64.cc
index 1fcb6790da063673859a09a6d328aaf5cbfcacff..fc81e712d20162f6626c3d833da76e1193a13cfa 100644
--- a/src/mips64/builtins-mips64.cc
+++ b/src/mips64/builtins-mips64.cc
@@ -393,16 +393,22 @@ static void Generate_JSConstructStubHelper(MacroAssembler* masm,
       __ ld(a2, MemOperand(a2));
       __ Branch(&rt_call, ne, a2, Operand(zero_reg));
 
-      // Fall back to runtime if the original constructor and function differ.
-      __ Branch(&rt_call, ne, a1, Operand(a3));
+      // Verify that the original constructor is a JSFunction.
+      __ GetObjectType(a3, a5, a4);
+      __ Branch(&rt_call, ne, a4, Operand(JS_FUNCTION_TYPE));
 
       // Load the initial map and verify that it is in fact a map.
-      // a1: constructor function
-      __ ld(a2, FieldMemOperand(a1, JSFunction::kPrototypeOrInitialMapOffset));
+      // a3: original constructor
+      __ ld(a2, FieldMemOperand(a3, JSFunction::kPrototypeOrInitialMapOffset));
       __ JumpIfSmi(a2, &rt_call);
       __ GetObjectType(a2, t1, t0);
       __ Branch(&rt_call, ne, t0, Operand(MAP_TYPE));
 
+      // Fall back to runtime if the expected base constructor and base
+      // constructor differ.
+      __ ld(a5, FieldMemOperand(a2, Map::kConstructorOrBackPointerOffset));
+      __ Branch(&rt_call, ne, a1, Operand(a5));
+
       // Check that the constructor is not constructing a JSFunction (see
       // comments in Runtime_NewObject in runtime.cc). In which case the
       // initial map's instance type would be JS_FUNCTION_TYPE.
@@ -425,7 +431,7 @@ static void Generate_JSConstructStubHelper(MacroAssembler* masm,
                   Operand(Map::kSlackTrackingCounterEnd));
         __ sw(a4, bit_field3);  // In delay slot.
 
-        __ Push(a1, a2, a1);  // a1 = Constructor.
+        __ Push(a1, a2, a2);  // a2 = Initial map.
         __ CallRuntime(Runtime::kFinalizeInstanceSize, 1);
 
         __ Pop(a1, a2);