Bugfix: Crankshaft array literals with incorrect values.

Bugfix: Crankshaft array literals with incorrect values.

In VisitArrayLiteral(), we stopped creating boilerplates during
 compilation. This created a bug, because we'd emit an HStoreKeyed with an
 ElementsKind based on the initial elements kind of the boilerplate. Since
 boilerplates may transition as part of elements transition feedback, this can
 lead to incorrect values (storing a smi in a double array).

BUG=chromium:606021
Committed: https://crrev.com/b71f1cc2f4fe7ff0779cc3cf95f104c2bd2c5259
Cr-Commit-Position: refs/heads/master@{#36408}

[mvstanton, 2016-05-20 12:31:36]

mvstanton@chromium.org changed reviewers:
+ jkummerow@chromium.org

[mvstanton, 2016-05-20 12:31:37]

Hi Jakob,
Here is a fix for the recent bug. It took a while to get the repro under d8. I'm
looking for any performance issues locally, and we can keep an eye on the bots.

Thanks for the look!
--Mike

[Jakob Kummerow, 2016-05-20 12:42:52]

LGTM, thanks!

[mvstanton, 2016-05-20 13:05:21]

The CQ bit was checked by mvstanton@chromium.org

[commit-bot: I haz the power, 2016-05-20 13:05:32]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2000673002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2000673002/1

[commit-bot: I haz the power, 2016-05-20 13:07:17]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-05-20 13:08:02]

Description was changed from

==========
Bugfix: Crankshaft array literals with incorrect values.

In VisitArrayLiteral(), we stopped creating boilerplates during
 compilation. This created a bug, because we'd emit an HStoreKeyed with an
 ElementsKind based on the initial elements kind of the boilerplate. Since
 boilerplates may transition as part of elements transition feedback, this can
 lead to incorrect values (storing a smi in a double array).

BUG=chromium:606021
==========

to

==========
Bugfix: Crankshaft array literals with incorrect values.

In VisitArrayLiteral(), we stopped creating boilerplates during
 compilation. This created a bug, because we'd emit an HStoreKeyed with an
 ElementsKind based on the initial elements kind of the boilerplate. Since
 boilerplates may transition as part of elements transition feedback, this can
 lead to incorrect values (storing a smi in a double array).

BUG=chromium:606021

Committed: https://crrev.com/b71f1cc2f4fe7ff0779cc3cf95f104c2bd2c5259
Cr-Commit-Position: refs/heads/master@{#36408}
==========

[commit-bot: I haz the power, 2016-05-20 13:08:03]

Patchset 1 (id:??) landed as
https://crrev.com/b71f1cc2f4fe7ff0779cc3cf95f104c2bd2c5259
Cr-Commit-Position: refs/heads/master@{#36408}