Fix object initialization when slack tracking for it's map is still enabled.

src/x64/builtins-x64.cc

Index: src/x64/builtins-x64.cc
diff --git a/src/x64/builtins-x64.cc b/src/x64/builtins-x64.cc
index 947ae8d055deaad3b29e93500f0e0efadcacfecb..64bb39a2872fdf95f9da4198d9488b151e8ee5a3 100644
--- a/src/x64/builtins-x64.cc
+++ b/src/x64/builtins-x64.cc
@@ -226,18 +226,12 @@ static void Generate_JSConstructStubHelper(MacroAssembler* masm,
           __ j(less, &no_inobject_slack_tracking);
 
           // Allocate object with a slack.
-          __ movzxbp(
-              rsi,
-              FieldOperand(
-                  rax,
-                  Map::kInObjectPropertiesOrConstructorFunctionIndexOffset));
-          __ movzxbp(rax, FieldOperand(rax, Map::kUnusedPropertyFieldsOffset));
-          __ subp(rsi, rax);
-          __ leap(rsi,
-                  Operand(rbx, rsi, times_pointer_size, JSObject::kHeaderSize));
+          __ movzxbp(rsi, FieldOperand(rax, Map::kUnusedPropertyFieldsOffset));
+          __ negp(rsi);
+          __ leap(rsi, Operand(rdi, rsi, times_pointer_size, 0));
           // rsi: offset of first field after pre-allocated fields
           if (FLAG_debug_code) {
-            __ cmpp(rsi, rdi);
+            __ cmpp(rcx, rsi);
             __ Assert(less_equal,
                       kUnexpectedNumberOfPreAllocatedPropertyFields);
           }