Synchronize with r15701.

test/mjsunit/allocation-site-info.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 157 matching lines @@
     return literal;
   }
 
   obj = fastliteralcase_smifast(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = fastliteralcase_smifast("carter");
   assertKind(elements_kind.fast, obj);
   obj = fastliteralcase_smifast(2);
   assertKind(elements_kind.fast, obj);
 
+  // Case: make sure transitions from packed to holey are tracked
+  function fastliteralcase_smiholey(index, value) {
+    var literal = [1, 2, 3, 4];
+    literal[index] = value;
+    return literal;
+  }
+
+  obj = fastliteralcase_smiholey(5, 1);
+  assertKind(elements_kind.fast_smi_only, obj);
+  assertHoley(obj);
+  obj = fastliteralcase_smiholey(0, 1);
+  assertKind(elements_kind.fast_smi_only, obj);
+  assertHoley(obj);
+
   function newarraycase_smidouble(value) {
     var a = new Array();
     a[0] = value;
     return a;
   }
 
   // Case: new Array() as allocation site, smi->double
   obj = newarraycase_smidouble(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = newarraycase_smidouble(1.5);
@@ skipping 73 matching lines @@
     return a;
   }
 
   obj = newarraycase_list_smiobj(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = newarraycase_list_smiobj("coates");
   assertKind(elements_kind.fast, obj);
   obj = newarraycase_list_smiobj(2);
   assertKind(elements_kind.fast, obj);
 
+  // Case: array constructor calls with out of date feedback.
+  // The boilerplate should incorporate all feedback, but the input array
+  // should be minimally transitioned based on immediate need.
+  (function() {
+    function foo(i) {
+      // We have two cases, one for literals one for constructed arrays.
+      var a = (i == 0)
+        ? [1, 2, 3]
+        : new Array(1, 2, 3);
+      return a;
+    }
+
+    for (i = 0; i < 2; i++) {
+      a = foo(i);
+      b = foo(i);
+      b[5] = 1;  // boilerplate goes holey
+      assertHoley(foo(i));
+      a[0] = 3.5;  // boilerplate goes holey double
+      assertKind(elements_kind.fast_double, a);
+      assertNotHoley(a);
+      c = foo(i);
+      assertKind(elements_kind.fast_double, c);
+      assertHoley(c);
+    }
+  })();
+
   function newarraycase_onearg(len, value) {
     var a = new Array(len);
     a[0] = value;
     return a;
   }
 
   obj = newarraycase_onearg(5, 3.5);
   assertKind(elements_kind.fast_double, obj);
   obj = newarraycase_onearg(10, 5);
   assertKind(elements_kind.fast_double, obj);
@@ skipping 52 matching lines @@
   %ClearFunctionTypeFeedback(instanceof_check);
   instanceof_check(Array);
   instanceof_check(Array);
   %OptimizeFunctionOnNextCall(instanceof_check);
   instanceof_check(Array);
   assertTrue(2 != %GetOptimizationStatus(instanceof_check));
 
   instanceof_check(realmBArray);
   assertTrue(1 != %GetOptimizationStatus(instanceof_check));
 }