Missing type cell on ia32 from bindings.

test/mjsunit/allocation-site-info.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 19 matching lines @@
 
 // Test element kind of objects.
 // Since --smi-only-arrays affects builtins, its default setting at compile
 // time sticks if built with snapshot.  If --smi-only-arrays is deactivated
 // by default, only a no-snapshot build actually has smi-only arrays enabled
 // in this test case.  Depending on whether smi-only arrays are actually
 // enabled, this test takes the appropriate code path to check smi-only arrays.
 
 // support_smi_only_arrays = %HasFastSmiElements(new Array(1,2,3,4,5,6,7,8));
 support_smi_only_arrays = true;
-optimize_constructed_arrays = false;
+optimize_constructed_arrays = true;
 
 if (support_smi_only_arrays) {
   print("Tests include smi-only arrays.");
 } else {
   print("Tests do NOT include smi-only arrays.");
 }
 
 if (optimize_constructed_arrays) {
   print("Tests include constructed array optimizations.");
 } else {
@@ skipping 244 matching lines @@
 
     var realmBArray = Realm.eval(realmB, "Array");
     instanceof_check(Array);
     instanceof_check(realmBArray);
     %OptimizeFunctionOnNextCall(instanceof_check);
     instanceof_check(Array);
     instanceof_check(realmBArray);
     assertTrue(2 != %GetOptimizationStatus(instanceof_check));
   }
 }