Version 5.2.361.42 (cherry-pick)

src/s390/macro-assembler-s390.cc

Index: src/s390/macro-assembler-s390.cc
diff --git a/src/s390/macro-assembler-s390.cc b/src/s390/macro-assembler-s390.cc
index f2a0c799c34af625164ee7567f969d50523cb41b..9257e64f36d263b1f68b55524f040afbdeb1228f 100644
--- a/src/s390/macro-assembler-s390.cc
+++ b/src/s390/macro-assembler-s390.cc
@@ -3655,7 +3655,7 @@ void MacroAssembler::TestJSArrayForAllocationMemento(Register receiver_reg,
                                                      Label* no_memento_found) {
   Label map_check;
   Label top_check;
-  ExternalReference new_space_allocation_top =
+  ExternalReference new_space_allocation_top_adr =
       ExternalReference::new_space_allocation_top_address(isolate());
   const int kMementoMapOffset = JSArray::kSize - kHeapObjectTag;
   const int kMementoEndOffset = kMementoMapOffset + AllocationMemento::kSize;
@@ -3666,11 +3666,13 @@ void MacroAssembler::TestJSArrayForAllocationMemento(Register receiver_reg,
   JumpIfNotInNewSpace(receiver_reg, scratch_reg, no_memento_found);
 
   DCHECK((~Page::kPageAlignmentMask & 0xffff) == 0);
-  AddP(scratch_reg, receiver_reg, Operand(kMementoEndOffset));
 
   // If the object is in new space, we need to check whether it is on the same
   // page as the current top.
-  XorP(r0, scratch_reg, Operand(new_space_allocation_top));
+  AddP(scratch_reg, receiver_reg, Operand(kMementoEndOffset));
+  mov(ip, Operand(new_space_allocation_top_adr));
+  LoadP(ip, MemOperand(ip));
+  XorP(r0, scratch_reg, ip);
   AndP(r0, r0, Operand(~Page::kPageAlignmentMask));
   beq(&top_check, Label::kNear);
   // The object is on a different page than allocation top. Bail out if the
@@ -3684,7 +3686,7 @@ void MacroAssembler::TestJSArrayForAllocationMemento(Register receiver_reg,
   // If top is on the same page as the current object, we need to check whether
   // we are below top.
   bind(&top_check);
-  CmpP(scratch_reg, Operand(new_space_allocation_top));
+  CmpP(scratch_reg, ip);
   bgt(no_memento_found);
   // Memento map check.
   bind(&map_check);