Transitions from DOUBLE to FAST were not checking for allocation site info.

test/mjsunit/allocation-site-info.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 132 matching lines @@
     assertKind(elements_kind.fast_double, obj);
     obj = fastliteralcase([3, 6, 2], 1.5);
     assertKind(elements_kind.fast_double, obj);
     obj = fastliteralcase([2, 6, 3], 2);
     assertKind(elements_kind.fast_smi_only, obj);
   }
 
   // Verify that we will not pretransition the double->fast path.
   obj = fastliteralcase(get_standard_literal(), "elliot");
   assertKind(elements_kind.fast, obj);
-  // This fails until we turn off optimistic transitions to the
-  // most general elements kind seen on keyed stores. It's a goal
-  // to turn it off, but for now we need it.
-  // obj = fastliteralcase(3);
-  // assertKind(elements_kind.fast_double, obj);
+  obj = fastliteralcase(get_standard_literal(), 3);
+  assertKind(elements_kind.fast, obj);
 
   // Make sure this works in crankshafted code too.
   %OptimizeFunctionOnNextCall(get_standard_literal);
   get_standard_literal();
   obj = get_standard_literal();
-  assertKind(elements_kind.fast_double, obj);
+  assertKind(elements_kind.fast, obj);
 
   function fastliteralcase_smifast(value) {
     var literal = [1, 2, 3, 4];
     literal[0] = value;
     return literal;
   }
 
   obj = fastliteralcase_smifast(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = fastliteralcase_smifast("carter");
@@ skipping 50 matching lines @@
   }
 
   // Case: new Array(length) as allocation site
   obj = newarraycase_length_smidouble(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = newarraycase_length_smidouble(1.5);
   assertKind(elements_kind.fast_double, obj);
   obj = newarraycase_length_smidouble(2);
   assertKind(elements_kind.fast_double, obj);
 
-  // Try to continue the transition to fast object, but
-  // we will not pretransition from double->fast, because
-  // it may hurt performance ("poisoning").
+  // Try to continue the transition to fast object. This won't work for
+  // constructed arrays because constructor dispatch is done on the
+  // elements kind, and a DOUBLE array constructor won't create an allocation
+  // memento.
   obj = newarraycase_length_smidouble("coates");
   assertKind(elements_kind.fast, obj);
-  obj = newarraycase_length_smidouble(2.5);
-  // However, because of optimistic transitions, we will
-  // transition to the most general kind of elements kind found,
-  // therefore I can't count on this assert yet.
-  // assertKind(elements_kind.fast_double, obj);
+  obj = newarraycase_length_smidouble(2);
+  assertKind(elements_kind.fast_double, obj);
 
   function newarraycase_length_smiobj(value) {
     var a = new Array(3);
     a[0] = value;
     return a;
   }
 
   // Case: new Array(<length>) as allocation site, smi->fast
   obj = newarraycase_length_smiobj(1);
   assertKind(elements_kind.fast_smi_only, obj);
@@ skipping 119 matching lines @@
   %ClearFunctionTypeFeedback(instanceof_check);
   instanceof_check(Array);
   instanceof_check(Array);
   %OptimizeFunctionOnNextCall(instanceof_check);
   instanceof_check(Array);
   assertOptimized(instanceof_check);
 
   instanceof_check(realmBArray);
   assertUnoptimized(instanceof_check);
 }