Correct handling of arrays with callbacks in the prototype chain.

test/mjsunit/allocation-site-info.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 130 matching lines @@
   assertKind(elements_kind.fast_double, obj);
 
   // The test below is in a loop because arrays that live
   // at global scope without the chance of being recreated
   // don't have allocation site information attached.
   for (i = 0; i < 2; i++) {
     obj = fastliteralcase([5, 3, 2], 1.5);
     assertKind(elements_kind.fast_double, obj);
     obj = fastliteralcase([3, 6, 2], 1.5);
     assertKind(elements_kind.fast_double, obj);
+
+    // Note: thanks to pessimistic transition store stubs, we'll attempt
+    // to transition to the most general elements kind seen at a particular
+    // store site. So, the elements kind will be double.
     obj = fastliteralcase([2, 6, 3], 2);
-    assertKind(elements_kind.fast_smi_only, obj);
+    assertKind(elements_kind.fast_double, obj);
   }
 
   // Verify that we will not pretransition the double->fast path.
   obj = fastliteralcase(get_standard_literal(), "elliot");
   assertKind(elements_kind.fast, obj);
   obj = fastliteralcase(get_standard_literal(), 3);
   assertKind(elements_kind.fast, obj);
 
   // Make sure this works in crankshafted code too.
   %OptimizeFunctionOnNextCall(get_standard_literal);
@@ skipping 320 matching lines @@
     obj[0][0] = 3.5;
     obj[1][0][0] = "goodbye";
     assertKind(elements_kind.fast_double, obj[0]);
     assertKind(elements_kind.fast, obj[1][0]);
 
     obj = get_deep_nested_literal();
     assertKind(elements_kind.fast_double, obj[0]);
     assertKind(elements_kind.fast, obj[1][0]);
   })();
 }