Bugfix: array constructor stub was missing a case

Bugfix: The general array constructor stub did not handle the case
properly when it is called with a function pointer in the type cell,
instead assuming that an AllocationSite object should be present. The
case where this can happen is if the cell is uninitialized, then the
first constructor call made is to the Array function of a different
context. In that case, we'll store the function pointer in the cell,
and then go ahead and call the array constructor stub too. The bug is
fixed by checking for the AllocationSite object map. If not found, the
constructor stub goes forward with a default ElementsKind, just as in
several other cases.

A test in allocation-site-info.js was beefed up to make sure the state
chain described above is traversed.

BUG=
R=hpayer@chromium.org, hpayer@google.com

Committed: https://code.google.com/p/v8/source/detail?r=15555

[mvstanton, 2013-07-08 14:32:14]

Here is the change we discussed. ArrayConstructorStub::Generate was not handling
the case where the type cell had a function pointer in it. The test was updated
to provoke the missing case, as well.
Thanks,
--Michael

[payer, 2013-07-08 14:37:47]

LGTM

[Hannes Payer (out of office), 2013-07-08 14:39:19]

lgtm

[mvstanton, 2013-07-08 14:42:02]

Committed patchset #2 manually as r15555 (presubmit successful).