[stubs] Fix allocation memento detection.

src/x87/macro-assembler-x87.cc

Index: src/x87/macro-assembler-x87.cc
diff --git a/src/x87/macro-assembler-x87.cc b/src/x87/macro-assembler-x87.cc
index e20fe7cec0386a5f8ba42f6f7efd7ca2728fb56f..ee81a680e4a904a24d0aba9ceacdf7c0a66dc7df 100644
--- a/src/x87/macro-assembler-x87.cc
+++ b/src/x87/macro-assembler-x87.cc
@@ -2977,20 +2977,21 @@ void MacroAssembler::TestJSArrayForAllocationMemento(
   ExternalReference new_space_allocation_top =
       ExternalReference::new_space_allocation_top_address(isolate());
   const int kMementoMapOffset = JSArray::kSize - kHeapObjectTag;
-  const int kMementoEndOffset = kMementoMapOffset + AllocationMemento::kSize;
+  const int kMementoLastWordOffset =
+      kMementoMapOffset + AllocationMemento::kSize - kPointerSize;
 
   // Bail out if the object is not in new space.
   JumpIfNotInNewSpace(receiver_reg, scratch_reg, no_memento_found);
   // If the object is in new space, we need to check whether it is on the same
   // page as the current top.
-  lea(scratch_reg, Operand(receiver_reg, kMementoEndOffset));
+  lea(scratch_reg, Operand(receiver_reg, kMementoLastWordOffset));
   xor_(scratch_reg, Operand::StaticVariable(new_space_allocation_top));
   test(scratch_reg, Immediate(~Page::kPageAlignmentMask));
   j(zero, &top_check);
   // The object is on a different page than allocation top. Bail out if the
   // object sits on the page boundary as no memento can follow and we cannot
   // touch the memory following it.
-  lea(scratch_reg, Operand(receiver_reg, kMementoEndOffset));
+  lea(scratch_reg, Operand(receiver_reg, kMementoLastWordOffset));
   xor_(scratch_reg, receiver_reg);
   test(scratch_reg, Immediate(~Page::kPageAlignmentMask));
   j(not_zero, no_memento_found);
@@ -2999,9 +3000,9 @@ void MacroAssembler::TestJSArrayForAllocationMemento(
   // If top is on the same page as the current object, we need to check whether
   // we are below top.
   bind(&top_check);
-  lea(scratch_reg, Operand(receiver_reg, kMementoEndOffset));
+  lea(scratch_reg, Operand(receiver_reg, kMementoLastWordOffset));
   cmp(scratch_reg, Operand::StaticVariable(new_space_allocation_top));
-  j(greater, no_memento_found);
+  j(greater_equal, no_memento_found);
   // Memento map check.
   bind(&map_check);
   mov(scratch_reg, Operand(receiver_reg, kMementoMapOffset));