Correct handling of arrays with callbacks in the prototype chain.

test/mjsunit/allocation-site-info.js

Index: test/mjsunit/allocation-site-info.js
diff --git a/test/mjsunit/allocation-site-info.js b/test/mjsunit/allocation-site-info.js
index f32344a405331e5bdbc801ba683c637d8a07943f..626696be15828ea10f66ba2f153a71824f84c0b1 100644
--- a/test/mjsunit/allocation-site-info.js
+++ b/test/mjsunit/allocation-site-info.js
@@ -148,8 +148,12 @@ if (support_smi_only_arrays) {
     assertKind(elements_kind.fast_double, obj);
     obj = fastliteralcase([3, 6, 2], 1.5);
     assertKind(elements_kind.fast_double, obj);
+
+    // Note: thanks to pessimistic transition store stubs, we'll attempt
+    // to transition to the most general elements kind seen at a particular
+    // store site. So, the elements kind will be double.
     obj = fastliteralcase([2, 6, 3], 2);
-    assertKind(elements_kind.fast_smi_only, obj);
+    assertKind(elements_kind.fast_double, obj);
   }
 
   // Verify that we will not pretransition the double->fast path.