Inline array constructor.

test/mjsunit/array-constructor-feedback.js

Index: test/mjsunit/array-constructor-feedback.js
diff --git a/test/mjsunit/array-constructor-feedback.js b/test/mjsunit/array-constructor-feedback.js
index 72ff12c08f0f04c28a7bffa1f3311c173a2d24fd..70d163f45f6ef25d3ad3540ead3002cb7623618b 100644
--- a/test/mjsunit/array-constructor-feedback.js
+++ b/test/mjsunit/array-constructor-feedback.js
@@ -138,8 +138,8 @@ if (support_smi_only_arrays) {
   })();
 
 
-  // Test: Ensure that bailouts from the stub don't deopt a crankshafted
-  // method with a call to that stub.
+  // Test: Ensure that inlined array calls in crankshaft learn from deopts
+  // based on the move to a dictionary for the array.
   (function() {
     function bar(len) {
       return new Array(len);
@@ -152,10 +152,16 @@ if (support_smi_only_arrays) {
     a = bar(10);
     assertKind(elements_kind.fast, a);
     assertOptimized(bar);
-    // The stub bails out, but the method call should be fine.
+    // bar should deopt because the length is too large.
+    a = bar(100000);
+    assertUnoptimized(bar);
+    assertKind(elements_kind.dictionary, a);
+    // The allocation site now has feedback that means the array constructor
+    // will not be inlined.
+    %OptimizeFunctionOnNextCall(bar);
     a = bar(100000);
-    assertOptimized(bar);
     assertKind(elements_kind.dictionary, a);
+    assertOptimized(bar);
 
     // If the argument isn't a smi, it bails out as well
     a = bar("oops");
@@ -172,8 +178,12 @@ if (support_smi_only_arrays) {
     barn(1, 2, 3);
     assertOptimized(barn);
     a = barn(1, "oops", 3);
-    // The stub should bail out but the method should remain optimized.
+    // The method should deopt, but learn from the failure to avoid inlining
+    // the array.
     assertKind(elements_kind.fast, a);
+    assertUnoptimized(barn);
+    %OptimizeFunctionOnNextCall(barn);
+    a = barn(1, "oops", 3);
     assertOptimized(barn);
   })();