Array() in optimized code can create with wrong ElementsKind in corner cases.

test/mjsunit/array-feedback.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 73 matching lines @@
   create1(0);
   a = create1(0);
   assertFalse(isHoley(a));
   assertKind(elements_kind.fast_smi_only, a);
   a[0] = "hello";
   b = create1(10);
   assertTrue(isHoley(b));
   assertKind(elements_kind.fast, b);
 
   a = create1(100000);
-  assertKind(elements_kind.fast_smi_only, a);
+  assertKind(elements_kind.fast, a);
 
   function create3(arg1, arg2, arg3) {
     return Array(arg1, arg2, arg3);
   }
 
   create3(1,2,3);
   create3(1,2,3);
   a = create3(1,2,3);
   a[0] = 3.035;
   assertKind(elements_kind.fast_double, a);
@@ skipping 94 matching lines @@
   }
 
   var realmBArray = Realm.eval(realmB, "Array");
   instanceof_check(Array);
   instanceof_check(Array);
   instanceof_check(Array);
   instanceof_check(realmBArray);
   instanceof_check(realmBArray);
   instanceof_check(realmBArray);
 })();