A bug in AllocationSite::GetMode(from, to) meant that we didn't update

boilerplates for SMI to SMI_HOLEY transitions.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/18917003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15617 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects-inl.h

@@ -1335,7 +1335,7 @@ AllocationSiteMode AllocationSite::GetMode(ElementsKind from,
                                            ElementsKind to) {
   if (FLAG_track_allocation_sites &&
       IsFastSmiElementsKind(from) &&
-      (IsFastObjectElementsKind(to) || IsFastDoubleElementsKind(to))) {
+      IsMoreGeneralElementsKindTransition(from, to)) {
     return TRACK_ALLOCATION_SITE;
   }
 

test/mjsunit/allocation-site-info.js

@@ -175,6 +175,20 @@ if (support_smi_only_arrays) {
   obj = fastliteralcase_smifast(2);
   assertKind(elements_kind.fast, obj);
 
+  // Case: make sure transitions from packed to holey are tracked
+  function fastliteralcase_smiholey(index, value) {
+    var literal = [1, 2, 3, 4];
+    literal[index] = value;
+    return literal;
+  }
+
+  obj = fastliteralcase_smiholey(5, 1);
+  assertKind(elements_kind.fast_smi_only, obj);
+  assertHoley(obj);
+  obj = fastliteralcase_smiholey(0, 1);
+  assertKind(elements_kind.fast_smi_only, obj);
+  assertHoley(obj);
+
   function newarraycase_smidouble(value) {
     var a = new Array();
     a[0] = value;