PPC: Fix object initialization when slack tracking for it's map is still enabled.

src/ppc/builtins-ppc.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_PPC
 
 #include "src/codegen.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 420 matching lines @@
 
           __ bind(&allocate);
         }
 
         // Now allocate the JSObject on the heap.
         // r4: constructor function
         // r5: initial map
         Label rt_call_reload_new_target;
         __ lbz(r6, FieldMemOperand(r5, Map::kInstanceSizeOffset));
 
-        __ Allocate(r6, r7, r8, r9, &rt_call_reload_new_target, SIZE_IN_WORDS);
+        __ Allocate(r6, r7, r6, r9, &rt_call_reload_new_target, SIZE_IN_WORDS);
 
         // Allocated the JSObject, now initialize the fields. Map is set to
         // initial map and properties and elements are set to empty fixed array.
         // r4: constructor function
         // r5: initial map
-        // r6: object size
+        // r6: start of next object
         // r7: JSObject (not tagged)
         __ LoadRoot(r9, Heap::kEmptyFixedArrayRootIndex);
-        __ mr(r8, r7);
-        __ StoreP(r5, MemOperand(r8, JSObject::kMapOffset));
-        __ StoreP(r9, MemOperand(r8, JSObject::kPropertiesOffset));
-        __ StoreP(r9, MemOperand(r8, JSObject::kElementsOffset));
-        __ addi(r8, r8, Operand(JSObject::kElementsOffset + kPointerSize));
-
-        __ ShiftLeftImm(r9, r6, Operand(kPointerSizeLog2));
-        __ add(r9, r7, r9);  // End of object.
+        __ StoreP(r5, MemOperand(r7, JSObject::kMapOffset));
+        __ StoreP(r9, MemOperand(r7, JSObject::kPropertiesOffset));
+        __ StoreP(r9, MemOperand(r7, JSObject::kElementsOffset));
+        __ addi(r8, r7, Operand(JSObject::kElementsOffset + kPointerSize));
 
         // Fill all the in-object properties with the appropriate filler.
         // r4: constructor function
         // r5: initial map
-        // r6: object size
+        // r6: start of next object
         // r7: JSObject (not tagged)
         // r8: First in-object property of JSObject (not tagged)
-        // r9: End of object
         DCHECK_EQ(3 * kPointerSize, JSObject::kHeaderSize);
-        __ LoadRoot(r10, Heap::kUndefinedValueRootIndex);
+        __ LoadRoot(r9, Heap::kUndefinedValueRootIndex);
 
         if (!is_api_function) {
           Label no_inobject_slack_tracking;
 
           // Check if slack tracking is enabled.
           __ cmpi(r11, Operand(Map::kSlackTrackingCounterEnd));
           __ blt(&no_inobject_slack_tracking);
 
           // Allocate object with a slack.
-          __ lbz(r3,
-                 FieldMemOperand(
-                     r5,
-                     Map::kInObjectPropertiesOrConstructorFunctionIndexOffset));
-          __ lbz(r5, FieldMemOperand(r5, Map::kUnusedPropertyFieldsOffset));
-          __ sub(r3, r3, r5);
+          __ lbz(r3, FieldMemOperand(r5, Map::kUnusedPropertyFieldsOffset));
+          __ ShiftLeftImm(r3, r3, Operand(kPointerSizeLog2));
+          __ sub(r3, r6, r3);
+          // r3: offset of first field after pre-allocated fields
           if (FLAG_debug_code) {
-            __ ShiftLeftImm(r0, r3, Operand(kPointerSizeLog2));
-            __ add(r0, r8, r0);
-            // r0: offset of first field after pre-allocated fields
-            __ cmp(r0, r9);
+            __ cmp(r8, r3);
             __ Assert(le, kUnexpectedNumberOfPreAllocatedPropertyFields);
           }
-          {
-            Label done;
-            __ cmpi(r3, Operand::Zero());
-            __ beq(&done);
-            __ InitializeNFieldsWithFiller(r8, r3, r10);
-            __ bind(&done);
-          }
+          __ InitializeFieldsWithFiller(r8, r3, r9);
           // To allow for truncation.
-          __ LoadRoot(r10, Heap::kOnePointerFillerMapRootIndex);
+          __ LoadRoot(r9, Heap::kOnePointerFillerMapRootIndex);
           // Fill the remaining fields with one pointer filler map.
 
           __ bind(&no_inobject_slack_tracking);
         }
 
-        __ InitializeFieldsWithFiller(r8, r9, r10);
+        __ InitializeFieldsWithFiller(r8, r6, r9);
 
         // Add the object tag to make the JSObject real, so that we can continue
         // and jump into the continuation code at any time from now on.
         __ addi(r7, r7, Operand(kHeapObjectTag));
 
         // Continue with JSObject being successfully allocated
         // r7: JSObject
         __ b(&allocated);
 
         // Reload the new target and fall-through.
@@ skipping 1364 matching lines @@
     __ bkpt(0);
   }
 }
 
 
 #undef __
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_PPC