Don't MISS if you read the hole from certain FastHoley arrays.

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/bailout-reason.h"
 #include "src/code-stubs.h"
 #include "src/field-index.h"
 #include "src/hydrogen.h"
@@ skipping 560 matching lines @@
 }
 
 
 Handle<Code> StoreScriptContextFieldStub::GenerateCode() {
   return DoGenerateCode(this);
 }
 
 
 template <>
 HValue* CodeStubGraphBuilder<LoadFastElementStub>::BuildCodeStub() {
+  LoadKeyedHoleMode hole_mode = NEVER_RETURN_HOLE;
+  if (casted_stub()->elements_kind() == FAST_HOLEY_ELEMENTS &&

[Jakob Kummerow, 2015/04/23 13:40:00]

Why do we need to check for elements kind again? The IC/handler compilers
already do that when computing the convert_hole_to_undefined flag, no?

[mvstanton, 2015/04/27 07:57:12]

Indeed, good catch, fixed.

+      casted_stub()->convert_hole_to_undefined()) {
+    hole_mode = CONVERT_HOLE_TO_UNDEFINED;
+  }
+
   HInstruction* load = BuildUncheckedMonomorphicElementAccess(
       GetParameter(LoadDescriptor::kReceiverIndex),
       GetParameter(LoadDescriptor::kNameIndex), NULL,
       casted_stub()->is_js_array(), casted_stub()->elements_kind(), LOAD,
-      NEVER_RETURN_HOLE, STANDARD_STORE);
+      hole_mode, STANDARD_STORE);
   return load;
 }
 
 
 Handle<Code> LoadFastElementStub::GenerateCode() {
   return DoGenerateCode(this);
 }
 
 
 HLoadNamedField* CodeStubGraphBuilderBase::BuildLoadNamedField(
@@ skipping 1437 matching lines @@
   // need.
   info()->MarkMustNotHaveEagerFrame();
 
   // Probe the stub cache.
   Add<HTailCallThroughMegamorphicCache>(receiver, name);
 
   // We never continue.
   return graph()->GetConstant0();
 }
 } }  // namespace v8::internal