| Index: src/ia32/code-stubs-ia32.cc
 | 
| diff --git a/src/ia32/code-stubs-ia32.cc b/src/ia32/code-stubs-ia32.cc
 | 
| index eddd571e6638ca55c503c9b6673edd23696831af..fa5a707ae8a5905fbb04110c2faf78cf6b50f7f1 100644
 | 
| --- a/src/ia32/code-stubs-ia32.cc
 | 
| +++ b/src/ia32/code-stubs-ia32.cc
 | 
| @@ -107,16 +107,6 @@ void FastCloneShallowObjectStub::InitializeInterfaceDescriptor(
 | 
|  }
 | 
|  
 | 
|  
 | 
| -void CreateAllocationSiteStub::InitializeInterfaceDescriptor(
 | 
| -    Isolate* isolate,
 | 
| -    CodeStubInterfaceDescriptor* descriptor) {
 | 
| -  static Register registers[] = { ebx, edx };
 | 
| -  descriptor->register_param_count_ = 2;
 | 
| -  descriptor->register_params_ = registers;
 | 
| -  descriptor->deoptimization_handler_ = NULL;
 | 
| -}
 | 
| -
 | 
| -
 | 
|  void KeyedLoadFastElementStub::InitializeInterfaceDescriptor(
 | 
|      Isolate* isolate,
 | 
|      CodeStubInterfaceDescriptor* descriptor) {
 | 
| @@ -2343,23 +2333,6 @@ static void GenerateRecordCallTarget(MacroAssembler* masm) {
 | 
|    __ cmp(ecx, Immediate(TypeFeedbackInfo::MegamorphicSentinel(isolate)));
 | 
|    __ j(equal, &done, Label::kFar);
 | 
|  
 | 
| -  // If we came here, we need to see if we are the array function.
 | 
| -  // If we didn't have a matching function, and we didn't find the megamorph
 | 
| -  // sentinel, then we have in the slot either some other function or an
 | 
| -  // AllocationSite. Do a map check on the object in ecx.
 | 
| -  Handle<Map> allocation_site_map =
 | 
| -      masm->isolate()->factory()->allocation_site_map();
 | 
| -  __ cmp(FieldOperand(ecx, 0), Immediate(allocation_site_map));
 | 
| -  __ j(not_equal, &miss);
 | 
| -
 | 
| -  // Load the global or builtins object from the current context
 | 
| -  __ LoadGlobalContext(ecx);
 | 
| -  // Make sure the function is the Array() function
 | 
| -  __ cmp(edi, Operand(ecx,
 | 
| -                      Context::SlotOffset(Context::ARRAY_FUNCTION_INDEX)));
 | 
| -  __ j(not_equal, &megamorphic);
 | 
| -  __ jmp(&done, Label::kFar);
 | 
| -
 | 
|    __ bind(&miss);
 | 
|  
 | 
|    // A monomorphic miss (i.e, here the cache is not uninitialized) goes
 | 
| @@ -2377,36 +2350,6 @@ static void GenerateRecordCallTarget(MacroAssembler* masm) {
 | 
|    // An uninitialized cache is patched with the function or sentinel to
 | 
|    // indicate the ElementsKind if function is the Array constructor.
 | 
|    __ bind(&initialize);
 | 
| -  __ LoadGlobalContext(ecx);
 | 
| -  // Make sure the function is the Array() function
 | 
| -  __ cmp(edi, Operand(ecx,
 | 
| -                      Context::SlotOffset(Context::ARRAY_FUNCTION_INDEX)));
 | 
| -  __ j(not_equal, ¬_array_function);
 | 
| -
 | 
| -  // The target function is the Array constructor,
 | 
| -  // Create an AllocationSite if we don't already have it, store it in the slot.
 | 
| -  {
 | 
| -    FrameScope scope(masm, StackFrame::INTERNAL);
 | 
| -
 | 
| -    // Arguments register must be smi-tagged to call out.
 | 
| -    __ SmiTag(eax);
 | 
| -    __ push(eax);
 | 
| -    __ push(edi);
 | 
| -    __ push(edx);
 | 
| -    __ push(ebx);
 | 
| -
 | 
| -    CreateAllocationSiteStub create_stub;
 | 
| -    __ CallStub(&create_stub);
 | 
| -
 | 
| -    __ pop(ebx);
 | 
| -    __ pop(edx);
 | 
| -    __ pop(edi);
 | 
| -    __ pop(eax);
 | 
| -    __ SmiUntag(eax);
 | 
| -  }
 | 
| -  __ jmp(&done);
 | 
| -
 | 
| -  __ bind(¬_array_function);
 | 
|    __ mov(FieldOperand(ebx, edx, times_half_pointer_size,
 | 
|                        FixedArray::kHeaderSize),
 | 
|           edi);
 | 
| @@ -2441,6 +2384,10 @@ void CallFunctionStub::Generate(MacroAssembler* masm) {
 | 
|  
 | 
|      if (RecordCallTarget()) {
 | 
|        GenerateRecordCallTarget(masm);
 | 
| +      // Type information was updated. Because we may call Array, which
 | 
| +      // expects either undefined or an AllocationSite in ebx we need
 | 
| +      // to set ebx to undefined.
 | 
| +      __ mov(ebx, Immediate(isolate->factory()->undefined_value()));
 | 
|      }
 | 
|    }
 | 
|  
 | 
| @@ -2544,6 +2491,11 @@ void CallConstructStub::Generate(MacroAssembler* masm) {
 | 
|  
 | 
|    if (RecordCallTarget()) {
 | 
|      GenerateRecordCallTarget(masm);
 | 
| +    // Put the AllocationSite from the feedback vector into ebx.
 | 
| +    __ add(edx, Immediate(Smi::FromInt(1)));
 | 
| +    __ mov(ebx, FieldOperand(ebx, edx, times_half_pointer_size,
 | 
| +                             FixedArray::kHeaderSize));
 | 
| +    __ AssertUndefinedOrAllocationSite(ebx);
 | 
|    }
 | 
|  
 | 
|    // Jump to the function-specific construct stub.
 | 
| @@ -2586,7 +2538,6 @@ void CodeStub::GenerateStubsAheadOfTime(Isolate* isolate) {
 | 
|    StubFailureTrampolineStub::GenerateAheadOfTime(isolate);
 | 
|    // It is important that the store buffer overflow stubs are generated first.
 | 
|    ArrayConstructorStubBase::GenerateStubsAheadOfTime(isolate);
 | 
| -  CreateAllocationSiteStub::GenerateAheadOfTime(isolate);
 | 
|    if (Serializer::enabled()) {
 | 
|      PlatformFeatureScope sse2(SSE2);
 | 
|      BinaryOpICStub::GenerateAheadOfTime(isolate);
 | 
| @@ -5155,8 +5106,7 @@ void ArrayConstructorStub::GenerateDispatchToArrayStub(
 | 
|  void ArrayConstructorStub::Generate(MacroAssembler* masm) {
 | 
|    // ----------- S t a t e -------------
 | 
|    //  -- eax : argc (only if argument_count_ == ANY)
 | 
| -  //  -- ebx : feedback vector (fixed array or undefined)
 | 
| -  //  -- edx : slot index (if ebx is fixed array)
 | 
| +  //  -- ebx : AllocationSite or undefined
 | 
|    //  -- edi : constructor
 | 
|    //  -- esp[0] : return address
 | 
|    //  -- esp[4] : last argument
 | 
| @@ -5177,18 +5127,8 @@ void ArrayConstructorStub::Generate(MacroAssembler* masm) {
 | 
|      __ CmpObjectType(ecx, MAP_TYPE, ecx);
 | 
|      __ Assert(equal, kUnexpectedInitialMapForArrayFunction);
 | 
|  
 | 
| -    // We should either have undefined in ebx or a valid fixed array.
 | 
| -    Label okay_here;
 | 
| -    Handle<Map> fixed_array_map = masm->isolate()->factory()->fixed_array_map();
 | 
| -    __ cmp(ebx, Immediate(undefined_sentinel));
 | 
| -    __ j(equal, &okay_here);
 | 
| -    __ cmp(FieldOperand(ebx, 0), Immediate(fixed_array_map));
 | 
| -    __ Assert(equal, kExpectedFixedArrayInRegisterEbx);
 | 
| -
 | 
| -    // edx should be a smi if we don't have undefined in ebx.
 | 
| -    __ AssertSmi(edx);
 | 
| -
 | 
| -    __ bind(&okay_here);
 | 
| +    // We should either have undefined in ebx or a valid AllocationSite
 | 
| +    __ AssertUndefinedOrAllocationSite(ebx);
 | 
|    }
 | 
|  
 | 
|    Label no_info;
 | 
| @@ -5196,11 +5136,6 @@ void ArrayConstructorStub::Generate(MacroAssembler* masm) {
 | 
|    // AllocationSite, call an array constructor that doesn't use AllocationSites.
 | 
|    __ cmp(ebx, Immediate(undefined_sentinel));
 | 
|    __ j(equal, &no_info);
 | 
| -  __ mov(ebx, FieldOperand(ebx, edx, times_half_pointer_size,
 | 
| -                           FixedArray::kHeaderSize));
 | 
| -  __ cmp(FieldOperand(ebx, 0), Immediate(
 | 
| -      masm->isolate()->factory()->allocation_site_map()));
 | 
| -  __ j(not_equal, &no_info);
 | 
|  
 | 
|    // Only look at the lower 16 bits of the transition info.
 | 
|    __ mov(edx, FieldOperand(ebx, AllocationSite::kTransitionInfoOffset));
 | 
| 
 |