Fix object initialization when slack tracking for it's map is still enabled.

src/x64/builtins-x64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/code-factory.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 208 matching lines @@
         __ leap(rcx, Operand(rbx, JSObject::kHeaderSize));
         __ LoadRoot(rdx, Heap::kUndefinedValueRootIndex);
         if (!is_api_function) {
           Label no_inobject_slack_tracking;
 
           // Check if slack tracking is enabled.
           __ cmpl(rsi, Immediate(Map::kSlackTrackingCounterEnd));
           __ j(less, &no_inobject_slack_tracking);
 
           // Allocate object with a slack.
-          __ movzxbp(
-              rsi,
-              FieldOperand(
-                  rax,
-                  Map::kInObjectPropertiesOrConstructorFunctionIndexOffset));
-          __ movzxbp(rax, FieldOperand(rax, Map::kUnusedPropertyFieldsOffset));
-          __ subp(rsi, rax);
-          __ leap(rsi,
-                  Operand(rbx, rsi, times_pointer_size, JSObject::kHeaderSize));
+          // See comment on JSObject::InitializeBody() for details.
+          __ movzxbp(rsi, FieldOperand(rax, Map::kUnusedPropertyFieldsOffset));
+          __ negp(rsi);
+          __ leap(rsi, Operand(rdi, rsi, times_pointer_size, 0));
           // rsi: offset of first field after pre-allocated fields
           if (FLAG_debug_code) {
-            __ cmpp(rsi, rdi);
+            __ cmpp(rcx, rsi);
             __ Assert(less_equal,
                       kUnexpectedNumberOfPreAllocatedPropertyFields);
           }
           __ InitializeFieldsWithFiller(rcx, rsi, rdx);
           __ LoadRoot(rdx, Heap::kOnePointerFillerMapRootIndex);
           // Fill the remaining fields with one pointer filler map.
 
           __ bind(&no_inobject_slack_tracking);
         }
 
@@ skipping 1662 matching lines @@
   __ ret(0);
 }
 
 
 #undef __
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X64