Hydrogen array constructor cleanup and improvements

test/mjsunit/allocation-site-info.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 71 matching lines @@
 
 function assertHoley(obj, name_opt) {
   assertEquals(true, isHoley(obj), name_opt);
 }
 
 function assertNotHoley(obj, name_opt) {
   assertEquals(false, isHoley(obj), name_opt);
 }
 
 if (support_smi_only_arrays) {
-
   obj = [];
   assertNotHoley(obj);
   assertKind(elements_kind.fast_smi_only, obj);
 
   obj = [1, 2, 3];
   assertNotHoley(obj);
   assertKind(elements_kind.fast_smi_only, obj);
 
   obj = new Array();
   assertNotHoley(obj);
@@ skipping 195 matching lines @@
 
   function instanceof_check(type) {
     assertTrue(new type() instanceof type);
     assertTrue(new type(5) instanceof type);
     assertTrue(new type(1,2,3) instanceof type);
   }
 
   var realmBArray = Realm.eval(realmB, "Array");
   instanceof_check(Array);
   instanceof_check(realmBArray);
-    %OptimizeFunctionOnNextCall(instanceof_check);
+  %OptimizeFunctionOnNextCall(instanceof_check);
+
+  // No de-opt will occur because HCallNewArray wasn't selected, on account of
+  // the call site not being monomorphic to Array.
   instanceof_check(Array);
   assertTrue(2 != %GetOptimizationStatus(instanceof_check));
   instanceof_check(realmBArray);
+  assertTrue(2 != %GetOptimizationStatus(instanceof_check));
+
+  // Try to optimize again, but first clear all type feedback, and allow it
+  // to be monomorphic on first call. Only after crankshafting do we introduce
+  // realmBArray. This should deopt the method.
+  %DeoptimizeFunction(instanceof_check);
+  %ClearFunctionTypeFeedback(instanceof_check);
+  instanceof_check(Array);
+  instanceof_check(Array);
+  %OptimizeFunctionOnNextCall(instanceof_check);
+  instanceof_check(Array);
+  assertTrue(2 != %GetOptimizationStatus(instanceof_check));
+
+  instanceof_check(realmBArray);
   assertTrue(1 != %GetOptimizationStatus(instanceof_check));
 }