Fix inobject slack tracking for both subclassing and non-subclassing cases.

src/ia32/builtins-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/code-factory.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 166 matching lines @@
         __ j(not_equal, &rt_call);
 
         // Check that the constructor is not constructing a JSFunction (see
         // comments in Runtime_NewObject in runtime.cc). In which case the
         // initial map's instance type would be JS_FUNCTION_TYPE.
         // edi: constructor
         // eax: initial map
         __ CmpInstanceType(eax, JS_FUNCTION_TYPE);
         __ j(equal, &rt_call);
 
-        if (!is_api_function) {
-          Label allocate;
-          // The code below relies on these assumptions.
-          STATIC_ASSERT(Map::Counter::kShift + Map::Counter::kSize == 32);
-          // Check if slack tracking is enabled.
-          __ mov(esi, FieldOperand(eax, Map::kBitField3Offset));
-          __ shr(esi, Map::Counter::kShift);
-          __ cmp(esi, Map::kSlackTrackingCounterEnd);
-          __ j(less, &allocate);
-          // Decrease generous allocation count.
-          __ sub(FieldOperand(eax, Map::kBitField3Offset),
-                 Immediate(1 << Map::Counter::kShift));
-
-          __ cmp(esi, Map::kSlackTrackingCounterEnd);
-          __ j(not_equal, &allocate);
-
-          __ push(eax);
-          __ push(edx);
-          __ push(edi);
-
-          __ push(eax);  // initial map
-          __ CallRuntime(Runtime::kFinalizeInstanceSize, 1);
-
-          __ pop(edi);
-          __ pop(edx);
-          __ pop(eax);
-          __ mov(esi, Map::kSlackTrackingCounterEnd - 1);
-
-          __ bind(&allocate);
-        }
-
         // Now allocate the JSObject on the heap.
         // edi: constructor
         // eax: initial map
         __ movzx_b(edi, FieldOperand(eax, Map::kInstanceSizeOffset));
         __ shl(edi, kPointerSizeLog2);
 
         __ Allocate(edi, ebx, edi, no_reg, &rt_call, NO_ALLOCATION_FLAGS);
 
         Factory* factory = masm->isolate()->factory();
 
         // Allocated the JSObject, now initialize the fields.
         // eax: initial map
-        // ebx: JSObject
+        // ebx: JSObject (not HeapObject tagged - the actual address).
         // edi: start of next object
         __ mov(Operand(ebx, JSObject::kMapOffset), eax);
         __ mov(ecx, factory->empty_fixed_array());
         __ mov(Operand(ebx, JSObject::kPropertiesOffset), ecx);
         __ mov(Operand(ebx, JSObject::kElementsOffset), ecx);
-        // Set extra fields in the newly allocated object.
-        // eax: initial map
-        // ebx: JSObject
-        // edi: start of next object
-        // esi: slack tracking counter (non-API function case)
+        __ lea(ecx, Operand(ebx, JSObject::kHeaderSize));
+
+        // Add the object tag to make the JSObject real, so that we can continue
+        // and jump into the continuation code at any time from now on.
+        __ or_(ebx, Immediate(kHeapObjectTag));
+
+        // Fill all the in-object properties with the appropriate filler.
+        // ebx: JSObject (tagged)
+        // ecx: First in-object property of JSObject (not tagged)
         __ mov(edx, factory->undefined_value());
-        __ lea(ecx, Operand(ebx, JSObject::kHeaderSize));
+
         if (!is_api_function) {
           Label no_inobject_slack_tracking;
 
+          // The code below relies on these assumptions.
+          STATIC_ASSERT(Map::Counter::kShift + Map::Counter::kSize == 32);
           // Check if slack tracking is enabled.
+          __ mov(esi, FieldOperand(eax, Map::kBitField3Offset));
+          __ shr(esi, Map::Counter::kShift);
           __ cmp(esi, Map::kSlackTrackingCounterEnd);
           __ j(less, &no_inobject_slack_tracking);
+          __ push(esi);  // Save allocation count value.
+          // Decrease generous allocation count.
+          __ sub(FieldOperand(eax, Map::kBitField3Offset),
+                 Immediate(1 << Map::Counter::kShift));
 
           // Allocate object with a slack.
           __ movzx_b(esi, FieldOperand(eax, Map::kUnusedPropertyFieldsOffset));
           __ neg(esi);
           __ lea(esi, Operand(edi, esi, times_pointer_size, 0));
           // esi: offset of first field after pre-allocated fields
           if (FLAG_debug_code) {
             __ cmp(ecx, esi);
             __ Assert(less_equal,
                       kUnexpectedNumberOfPreAllocatedPropertyFields);
           }
           __ InitializeFieldsWithFiller(ecx, esi, edx);
 
           // To allow truncation fill the remaining fields with one pointer
           // filler map.
           __ mov(edx, factory->one_pointer_filler_map());
+          __ InitializeFieldsWithFiller(ecx, edi, edx);
+
+          __ pop(esi);  // Restore allocation count value before decreasing.
+          __ cmp(esi, Map::kSlackTrackingCounterEnd);
+          __ j(not_equal, &allocated);
+
+          // Push the object to the stack, and then the initial map as
+          // an argument to the runtime call.
+          __ push(ebx);
+          __ push(eax);  // initial map
+          __ CallRuntime(Runtime::kFinalizeInstanceSize, 1);
+          __ pop(ebx);
+
+          // Continue with JSObject being successfully allocated
+          // ebx: JSObject (tagged)
+          __ jmp(&allocated);
 
           __ bind(&no_inobject_slack_tracking);
         }
 
         __ InitializeFieldsWithFiller(ecx, edi, edx);
 
-        // Add the object tag to make the JSObject real, so that we can continue
-        // and jump into the continuation code at any time from now on.
-        // ebx: JSObject (untagged)
-        __ or_(ebx, Immediate(kHeapObjectTag));
-
         // Continue with JSObject being successfully allocated
         // ebx: JSObject (tagged)
         __ jmp(&allocated);
       }
 
       // Allocate the new receiver object using the runtime call.
       // edx: new target
       __ bind(&rt_call);
       int offset = kPointerSize;
 
@@ skipping 1707 matching lines @@
 
   __ bind(&ok);
   __ ret(0);
 }
 
 #undef __
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_IA32