Bugfix: array constructor stub was missing a case

test/mjsunit/allocation-site-info.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 279 matching lines @@
   var realmB = Realm.create();
   assertEquals(0, realmA);
   assertEquals(1, realmB);
 
   function instanceof_check(type) {
     assertTrue(new type() instanceof type);
     assertTrue(new type(5) instanceof type);
     assertTrue(new type(1,2,3) instanceof type);
   }
 
+  function instanceof_check2(type) {
+    assertTrue(new type() instanceof type);
+    assertTrue(new type(5) instanceof type);
+    assertTrue(new type(1,2,3) instanceof type);
+  }
+
   var realmBArray = Realm.eval(realmB, "Array");
   instanceof_check(Array);
   instanceof_check(realmBArray);
+
+  // instanceof_check2 is here because the call site goes through a state.
+  // Since instanceof_check(Array) was first called with the current context
+  // Array function, it went from (uninit->Array) then (Array->megamorphic).
+  // We'll get a different state traversal if we start with realmBArray.
+  // It'll go (uninit->realmBArray) then (realmBArray->megamorphic). Recognize
+  // that state "Array" implies an AllocationSite is present, and code is
+  // configured to use it.
+  instanceof_check2(realmBArray);
+  instanceof_check2(Array);
+
   %OptimizeFunctionOnNextCall(instanceof_check);
 
   // No de-opt will occur because HCallNewArray wasn't selected, on account of
   // the call site not being monomorphic to Array.
   instanceof_check(Array);
   assertTrue(2 != %GetOptimizationStatus(instanceof_check));
   instanceof_check(realmBArray);
   assertTrue(2 != %GetOptimizationStatus(instanceof_check));
 
   // Try to optimize again, but first clear all type feedback, and allow it
   // to be monomorphic on first call. Only after crankshafting do we introduce
   // realmBArray. This should deopt the method.
   %DeoptimizeFunction(instanceof_check);
   %ClearFunctionTypeFeedback(instanceof_check);
   instanceof_check(Array);
   instanceof_check(Array);
   %OptimizeFunctionOnNextCall(instanceof_check);
   instanceof_check(Array);
   assertTrue(2 != %GetOptimizationStatus(instanceof_check));
 
   instanceof_check(realmBArray);
   assertTrue(1 != %GetOptimizationStatus(instanceof_check));
 }