Fix object initialization when slack tracking for it's map is still enabled.

src/objects-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Review notes:
 //
 // - The use of macros in these inline functions may seem superfluous
 // but it is absolutely needed to make sure gcc generates optimal
 // code. gcc is not happy when attempting to inline too deep.
 //
@@ skipping 2268 matching lines @@
                                         Object* value,
                                         WriteBarrierMode mode) {
   // Adjust for the number of properties stored in the object.
   int offset = GetInObjectPropertyOffset(index);
   WRITE_FIELD(this, offset, value);
   CONDITIONAL_WRITE_BARRIER(GetHeap(), this, offset, value, mode);
   return value;
 }
 
 
-
+//
+// The layout of JSObject created from initial map:
+//
+// ----------------------
+//   map                 \   \
+//   properties           |   | - JSObject header.
+//   elements             |  /
+//                        |
+//   header field 1       | - Extended header (see for example JSDate).
+//   ...                  |
+//   header field K      /
+// ----------------------
+//   internal field 1    \
+//   ...                  | - internal fields
+//   internal field M    /
+// ----------------------
+//   in-object property  \                            \
+//     field 1            |                            |
+//   ...                  | - pre-allocated            |
+//   in-object property   |                            |
+//     field P           /                             | - in-object properties
+//   in-object property  \                             |
+//     field P + 1        |                            |
+//   ...                  | - unused property fields   |
+//   in-object property   |                            |
+//     field P + U       /                            /
+// ----------------------
+//
+// where
+//   K - number of extra header fields
+//   M - number of internal fields
+//   P - number of pre-allocated fields
+//   U - number of unused fields
+//
+// The following values are stored in the Map:
+//   |inobject_properties|, |instance_size|, U := |unused_property_fields| and
+//   |extended_header_size| (computable via |instance_type|).
+//
+// The other values are calculated as follows:
+//   P := |inobject_properties| - |unused_property_fields|
+//   M := (|instance_size| - |extended_header_size|) / kPointerSize -
+//            |inobject_properties|
+//   K := (|extended_header_size| - JSObject::kHeaderSize) / kPointerSize
+//
+// When in-object slack tracking is enabled for the map, the unused fields
+// are initialized with one-word fillers.
+//
 void JSObject::InitializeBody(Map* map,
                               Object* pre_allocated_value,
                               Object* filler_value) {
   DCHECK(!filler_value->IsHeapObject() ||
          !GetHeap()->InNewSpace(filler_value));
   DCHECK(!pre_allocated_value->IsHeapObject() ||
          !GetHeap()->InNewSpace(pre_allocated_value));
   int size = map->instance_size();
   int offset = kHeaderSize;
   if (filler_value != pre_allocated_value) {
-    int pre_allocated =
-        map->GetInObjectProperties() - map->unused_property_fields();
-    DCHECK(pre_allocated * kPointerSize + kHeaderSize <= size);
-    for (int i = 0; i < pre_allocated; i++) {
+    int end_of_pre_allocated_offset =
+        size - (map->unused_property_fields() << kPointerSizeLog2);

[Toon Verwaest, 2015/11/20 10:55:55]

What about just * kPointerSize? :)

[Igor Sheludko, 2015/11/20 11:26:14]

Done.

+    DCHECK_LE(kHeaderSize, end_of_pre_allocated_offset);
+    while (offset < end_of_pre_allocated_offset) {
       WRITE_FIELD(this, offset, pre_allocated_value);
       offset += kPointerSize;
     }
   }
   while (offset < size) {
     WRITE_FIELD(this, offset, filler_value);
     offset += kPointerSize;
   }
 }
 
@@ skipping 5568 matching lines @@
 #undef WRITE_INT64_FIELD
 #undef READ_BYTE_FIELD
 #undef WRITE_BYTE_FIELD
 #undef NOBARRIER_READ_BYTE_FIELD
 #undef NOBARRIER_WRITE_BYTE_FIELD
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_OBJECTS_INL_H_