[turbofan] Fix double object allocation when inlining a construct call of a derived class....

test/cctest/test-inobject-slack-tracking.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <sstream>
 #include <utility>
 
 #include "src/api.h"
 #include "src/objects.h"
@@ skipping 594 matching lines @@
     CHECK_EQ(Map::kSlackTrackingCounterStart - 1,
              initial_map->construction_counter());
     CHECK(initial_map->IsInobjectSlackTrackingInProgress());
 
     // Create several instances to complete the tracking.
     for (int i = 1; i < Map::kGenerousAllocationCount; i++) {
       CHECK(initial_map->IsInobjectSlackTrackingInProgress());
       Handle<JSObject> tmp = Run<JSObject>(new_script);
       CHECK_EQ(initial_map->IsInobjectSlackTrackingInProgress(),
                IsObjectShrinkable(*tmp));
+      CHECK_EQ(Map::kSlackTrackingCounterStart - i - 1,
+               initial_map->construction_counter());
     }
     CHECK(!initial_map->IsInobjectSlackTrackingInProgress());
     CHECK(!IsObjectShrinkable(*obj));
 
     // No slack left.
     CHECK_EQ(fields_count, obj->map()->GetInObjectProperties());
   }
 }
 
 
@@ skipping 477 matching lines @@
   TestSubclassBuiltin("A1", JS_PROMISE_TYPE, "Promise",
                       "function(resolve, reject) { resolve('ok'); }",
                       first_field);
 }
 
 
 TEST(SubclassPromiseBuiltinNoInlineNew) {
   FLAG_inline_new = false;
   TestSubclassPromiseBuiltin();
 }