Bugfix in hydrogen array literal code generation.

test/mjsunit/array-literal-feedback.js

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 26 matching lines @@
 
 // support_smi_only_arrays = %HasFastSmiElements(new Array(1,2,3,4,5,6,7,8));
 support_smi_only_arrays = true;
 
 if (support_smi_only_arrays) {
   print("Tests include smi-only arrays.");
 } else {
   print("Tests do NOT include smi-only arrays.");
 }
 
-function isHoley(obj) {
-  if (%HasFastHoleyElements(obj)) return true;
-  return false;
-}
+if (support_smi_only_arrays) {
 
-function assertHoley(obj, name_opt) {
-  assertEquals(true, isHoley(obj), name_opt);
-}
-
-function assertNotHoley(obj, name_opt) {
-  assertEquals(false, isHoley(obj), name_opt);
-}
-
-if (support_smi_only_arrays) {
-  function create_array(arg) {
-    return new Array(arg);
+  function get_literal(x) {
+    var literal = [1, 2, x];
+    return literal;
   }
 
-  obj = create_array(0);
-  assertNotHoley(obj);
-  create_array(0);
-  %OptimizeFunctionOnNextCall(create_array);
-  obj = create_array(10);
-  assertHoley(obj);
+  get_literal(3);
+  get_literal(3);
+  %OptimizeFunctionOnNextCall(get_literal);
+  a = get_literal(3);
+  assertTrue(2 != %GetOptimizationStatus(get_literal));
+  assertTrue(%HasFastSmiElements(a));
+  a[0] = 3.5;
+
+  // We should have transitioned the boilerplate array to double, and
+  // crankshafted code should de-opt on the unexpected elements kind
+  b = get_literal(3);
+  assertTrue(%HasFastDoubleElements(b));
+  assertEquals([1, 2, 3], b);
+  assertTrue(1 != %GetOptimizationStatus(get_literal));
+
+  // Optimize again
+  get_literal(3);
+  %OptimizeFunctionOnNextCall(get_literal);
+  b = get_literal(3);
+  assertTrue(%HasFastDoubleElements(b));
+  assertTrue(2 != %GetOptimizationStatus(get_literal));
 }
-
-// The code below would assert in debug or crash in release
-function f(length) {
-  return new Array(length)
-}
-
-f(0);
-f(0);
-%OptimizeFunctionOnNextCall(f);
-var a = f(10);
-
-function g(a) {
-  return a[0];
-}
-
-var b = [0];
-g(b);
-g(b);
-assertEquals(undefined, g(a));