PPC: Fix inobject slack tracking for both subclassing and non-subclassing cases.

src/ppc/builtins-ppc.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_PPC
 
 #include "src/codegen.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 367 matching lines @@
 
         // Check that the constructor is not constructing a JSFunction (see
         // comments in Runtime_NewObject in runtime.cc). In which case the
         // initial map's instance type would be JS_FUNCTION_TYPE.
         // r4: constructor function
         // r5: initial map
         // r6: new target
         __ CompareInstanceType(r5, r8, JS_FUNCTION_TYPE);
         __ beq(&rt_call);
 
-        if (!is_api_function) {
-          Label allocate;
-          MemOperand bit_field3 = FieldMemOperand(r5, Map::kBitField3Offset);
-          // Check if slack tracking is enabled.
-          __ lwz(r7, bit_field3);
-          __ DecodeField<Map::Counter>(r3, r7);
-          __ cmpi(r3, Operand(Map::kSlackTrackingCounterEnd));
-          __ blt(&allocate);
-          // Decrease generous allocation count.
-          __ Add(r7, r7, -(1 << Map::Counter::kShift), r0);
-          __ stw(r7, bit_field3);
-          __ cmpi(r3, Operand(Map::kSlackTrackingCounterEnd));
-          __ bne(&allocate);
-
-          // Push the constructor, new target and map to the stack, and
-          // the map again as an argument to the runtime call.
-          __ Push(r4, r6, r5, r5);
-
-          __ CallRuntime(Runtime::kFinalizeInstanceSize, 1);
-
-          __ Pop(r4, r6, r5);
-          __ li(r3, Operand(Map::kSlackTrackingCounterEnd - 1));
-
-          __ bind(&allocate);
-        }
-
         // Now allocate the JSObject on the heap.
         // r4: constructor function
         // r5: initial map
         // r6: new target
-        // r3: slack tracking counter (non-API function case)
         __ lbz(r10, FieldMemOperand(r5, Map::kInstanceSizeOffset));
 
         __ Allocate(r10, r7, r10, r9, &rt_call, SIZE_IN_WORDS);
 
         // Allocated the JSObject, now initialize the fields. Map is set to
         // initial map and properties and elements are set to empty fixed array.
         // r4: constructor function
         // r5: initial map
         // r6: new target
-        // r7: JSObject (not tagged)
+        // r7: JSObject (not HeapObject tagged - the actual address).
         // r10: start of next object
-        // r3: slack tracking counter (non-API function case)
         __ LoadRoot(r9, Heap::kEmptyFixedArrayRootIndex);
         __ StoreP(r5, MemOperand(r7, JSObject::kMapOffset));
         __ StoreP(r9, MemOperand(r7, JSObject::kPropertiesOffset));
         __ StoreP(r9, MemOperand(r7, JSObject::kElementsOffset));
         __ addi(r8, r7, Operand(JSObject::kElementsOffset + kPointerSize));
 
+        // Add the object tag to make the JSObject real, so that we can continue
+        // and jump into the continuation code at any time from now on.
+        __ addi(r7, r7, Operand(kHeapObjectTag));
+
         // Fill all the in-object properties with the appropriate filler.
+        // r7: JSObject (tagged)
         // r8: First in-object property of JSObject (not tagged)
         __ LoadRoot(r9, Heap::kUndefinedValueRootIndex);
 
         if (!is_api_function) {
           Label no_inobject_slack_tracking;
 
           // Check if slack tracking is enabled.

[Igor Sheludko, 2015/12/03 16:47:02]

This comment should be removed.

[MTBrandyberry, 2015/12/03 18:39:54]

Done.

-          __ cmpi(r3, Operand(Map::kSlackTrackingCounterEnd));
+          MemOperand bit_field3 = FieldMemOperand(r5, Map::kBitField3Offset);
+          // Check if slack tracking is enabled.
+          __ lwz(r3, bit_field3);
+          __ DecodeField<Map::Counter>(r0, r3);
+          // r0: slack tracking counter
+          __ cmpi(r0, Operand(Map::kSlackTrackingCounterEnd));
           __ blt(&no_inobject_slack_tracking);
+          __ push(r0);  // Save allocation count value.

[Igor Sheludko, 2015/12/03 16:47:02]

It looks like there are enough registers and r0 is not trashed till line 450. So
we can avoid push/pop-ing like in mips ports.

[MTBrandyberry, 2015/12/03 18:39:54]

Done.

+          // Decrease generous allocation count.
+          __ Add(r3, r3, -(1 << Map::Counter::kShift), r0);
+          __ stw(r3, bit_field3);
 
           // Allocate object with a slack.
           __ lbz(r3, FieldMemOperand(r5, Map::kUnusedPropertyFieldsOffset));
           __ ShiftLeftImm(r3, r3, Operand(kPointerSizeLog2));
           __ sub(r3, r10, r3);
           // r3: offset of first field after pre-allocated fields
           if (FLAG_debug_code) {
             __ cmp(r8, r3);
             __ Assert(le, kUnexpectedNumberOfPreAllocatedPropertyFields);
           }
           __ InitializeFieldsWithFiller(r8, r3, r9);
 
           // To allow truncation fill the remaining fields with one pointer
           // filler map.
           __ LoadRoot(r9, Heap::kOnePointerFillerMapRootIndex);
+          __ InitializeFieldsWithFiller(r8, r10, r9);
+
+          __ pop(r3);  // Restore allocation count value before decreasing.

[Igor Sheludko, 2015/12/03 16:47:02]

Ditto. Remove pop and...

[MTBrandyberry, 2015/12/03 18:39:53]

Done.

+          __ cmpi(r3, Operand(Map::kSlackTrackingCounterEnd));

[Igor Sheludko, 2015/12/03 16:47:02]

use r0 instead of r3 here.

[MTBrandyberry, 2015/12/03 18:39:54]

Done.

+          __ bne(&allocated);
+
+          // Push the constructor, new target and map to the stack, and

[Igor Sheludko, 2015/12/03 16:47:02]

Please update this comment.

[MTBrandyberry, 2015/12/03 18:39:54]

Done.

+          // the map again as an argument to the runtime call.
+          __ Push(r4, r6, r7, r5);
+          __ CallRuntime(Runtime::kFinalizeInstanceSize, 1);
+          __ Pop(r4, r6, r7);
+
+          // Continue with JSObject being successfully allocated
+          // r4: constructor function
+          // r6: new target
+          // r7: JSObject
+          __ b(&allocated);
 
           __ bind(&no_inobject_slack_tracking);
         }
 
         __ InitializeFieldsWithFiller(r8, r10, r9);
 
-        // Add the object tag to make the JSObject real, so that we can continue
-        // and jump into the continuation code at any time from now on.
-        __ addi(r7, r7, Operand(kHeapObjectTag));
-
         // Continue with JSObject being successfully allocated
         // r4: constructor function
         // r6: new target
         // r7: JSObject
         __ b(&allocated);
       }
 
       // Allocate the new receiver object using the runtime call.
       // r4: constructor function
       // r6: new target
@@ skipping 1498 matching lines @@
     __ bkpt(0);
   }
 }
 
 
 #undef __
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_PPC