Revert "Customized support for feedback on calls to Array." and follow-up fixes.

test/mjsunit/array-constructor-feedback.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 132 matching lines @@
       return new Array(len);
     }
     a = bar(10);
     a[0] = "a string";
     a = bar(10);
     assertKind(elements_kind.fast, a);
     %OptimizeFunctionOnNextCall(bar);
     a = bar(10);
     assertKind(elements_kind.fast, a);
     assertOptimized(bar);
+    // bar should deopt because the length is too large.
+    a = bar(100000);
+    assertUnoptimized(bar);
+    assertKind(elements_kind.dictionary, a);
+    // The allocation site now has feedback that means the array constructor
+    // will not be inlined.
+    %OptimizeFunctionOnNextCall(bar);
     a = bar(100000);
     assertKind(elements_kind.dictionary, a);
     assertOptimized(bar);
 
-    // If the argument isn't a smi, things should still work.
+    // If the argument isn't a smi, it bails out as well
     a = bar("oops");
     assertOptimized(bar);
     assertKind(elements_kind.fast, a);
 
     function barn(one, two, three) {
       return new Array(one, two, three);
     }
 
     barn(1, 2, 3);
     barn(1, 2, 3);
     %OptimizeFunctionOnNextCall(barn);
     barn(1, 2, 3);
     assertOptimized(barn);
     a = barn(1, "oops", 3);
+    // The method should deopt, but learn from the failure to avoid inlining
+    // the array.
+    assertKind(elements_kind.fast, a);
+    assertUnoptimized(barn);
+    %OptimizeFunctionOnNextCall(barn);
+    a = barn(1, "oops", 3);
     assertOptimized(barn);
   })();
 
 
   // Test: When a method with array constructor is crankshafted, the type
   // feedback for elements kind is baked in. Verify that transitions don't
   // change it anymore
   (function() {
     function bar() {
       return new Array();
@@ skipping 26 matching lines @@
 
     var contextB = Realm.create();
     Realm.eval(contextB, "function bar2() { return new Array(); };");
     Realm.eval(contextB, "bar2(); bar2();");
     Realm.eval(contextB, "%OptimizeFunctionOnNextCall(bar2);");
     Realm.eval(contextB, "bar2();");
     assertFalse(Realm.eval(contextB, "bar2();") instanceof Array);
     assertTrue(Realm.eval(contextB, "bar2() instanceof Array"));
   })();
 
-  // Test: create array with packed feedback, then optimize function, which
-  // should deal with arguments that create holey arrays.
+  // Test: create array with packed feedback, then optimize/inline
+  // function. Verify that if we ask for a holey array then we deopt.
+  // Reoptimization will proceed with the correct feedback and we
+  // won't deopt anymore.
   (function() {
     function bar(len) { return new Array(len); }
     bar(0);
     bar(0);
     %OptimizeFunctionOnNextCall(bar);
     a = bar(0);
     assertOptimized(bar);
     assertFalse(isHoley(a));
     a = bar(1);  // ouch!
+    assertUnoptimized(bar);
+    assertTrue(isHoley(a));
+    // Try again
+    %OptimizeFunctionOnNextCall(bar);
+    a = bar(100);
     assertOptimized(bar);
     assertTrue(isHoley(a));
-    a = bar(100);
-    assertTrue(isHoley(a));
     a = bar(0);
     assertOptimized(bar);
-    // Crankshafted functions don't use mementos, so feedback still
-    // indicates a packed array is desired. (unless --nocrankshaft is in use).
-    if (4 != %GetOptimizationStatus(bar)) {
-      assertFalse(isHoley(a));
-    }
+    assertTrue(isHoley(a));
   })();
 }