Don't MISS if you read the hole from certain FastHoley arrays.

src/hydrogen-instructions.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HYDROGEN_INSTRUCTIONS_H_
 #define V8_HYDROGEN_INSTRUCTIONS_H_
 
 #include <cstring>
 #include <iosfwd>
 
@@ skipping 6438 matching lines @@
     return r.IsInteger32() || SmiValuesAre32Bits()
         ? Representation::Integer32() : Representation::Smi();
   }
 };
 
 
 static const int kDefaultKeyedHeaderOffsetSentinel = -1;
 
 enum LoadKeyedHoleMode {
   NEVER_RETURN_HOLE,
-  ALLOW_RETURN_HOLE
+  ALLOW_RETURN_HOLE,
+  CONVERT_HOLE_TO_UNDEFINED
 };
 
 
 class HLoadKeyed final : public HTemplateInstruction<3>,
                          public ArrayInstructionInterface {
  public:
   DECLARE_INSTRUCTION_FACTORY_P4(HLoadKeyed, HValue*, HValue*, HValue*,
                                  ElementsKind);
   DECLARE_INSTRUCTION_FACTORY_P5(HLoadKeyed, HValue*, HValue*, HValue*,
                                  ElementsKind, LoadKeyedHoleMode);
@@ skipping 13 matching lines @@
   HValue* key() const { return OperandAt(1); }
   HValue* dependency() const {
     DCHECK(HasDependency());
     return OperandAt(2);
   }
   bool HasDependency() const { return OperandAt(0) != OperandAt(2); }
   uint32_t base_offset() const { return BaseOffsetField::decode(bit_field_); }
   bool TryIncreaseBaseOffset(uint32_t increase_by_value) override;
   HValue* GetKey() override { return key(); }
   void SetKey(HValue* key) override { SetOperandAt(1, key); }
-  bool IsDehoisted() const override {
-    return IsDehoistedField::decode(bit_field_);
-  }
-  void SetDehoisted(bool is_dehoisted) override {
-    bit_field_ = IsDehoistedField::update(bit_field_, is_dehoisted);
-  }
+  bool IsDehoisted() const override { return dehoisted_; }
+  void SetDehoisted(bool is_dehoisted) override { dehoisted_ = is_dehoisted; }
   ElementsKind elements_kind() const override {
     return ElementsKindField::decode(bit_field_);
   }
   LoadKeyedHoleMode hole_mode() const {
     return HoleModeField::decode(bit_field_);
   }
 
   Representation RequiredInputRepresentation(int index) override {
     // kind_fast:                 tagged[int32] (none)
     // kind_double:               tagged[int32] (none)
@@ skipping 27 matching lines @@
  protected:
   bool DataEquals(HValue* other) override {
     if (!other->IsLoadKeyed()) return false;
     HLoadKeyed* other_load = HLoadKeyed::cast(other);
 
     if (base_offset() != other_load->base_offset()) return false;
     return elements_kind() == other_load->elements_kind();
   }
 
  private:
-  HLoadKeyed(HValue* obj,
-             HValue* key,
-             HValue* dependency,
+  HLoadKeyed(HValue* obj, HValue* key, HValue* dependency,
              ElementsKind elements_kind,
              LoadKeyedHoleMode mode = NEVER_RETURN_HOLE,
              int offset = kDefaultKeyedHeaderOffsetSentinel)
-      : bit_field_(0) {
+      : bit_field_(0), dehoisted_(false) {
     offset = offset == kDefaultKeyedHeaderOffsetSentinel
         ? GetDefaultHeaderSizeForElementsKind(elements_kind)
         : offset;
     bit_field_ = ElementsKindField::encode(elements_kind) |
         HoleModeField::encode(mode) |
         BaseOffsetField::encode(offset);
 
     SetOperandAt(0, obj);
     SetOperandAt(1, key);
     SetOperandAt(2, dependency != NULL ? dependency : obj);
@@ skipping 45 matching lines @@
     }
 
     SetFlag(kUseGVN);
   }
 
   bool IsDeletable() const override { return !RequiresHoleCheck(); }
 
   // Establish some checks around our packed fields
   enum LoadKeyedBits {
     kBitsForElementsKind = 5,
-    kBitsForHoleMode = 1,
+    kBitsForHoleMode = 2,
     kBitsForBaseOffset = 25,

[Jakob Kummerow, 2015/04/23 13:40:00]

I think instead of moving |dehoisted| out of this bitfield, I'd rather shrink
the base offset field to 24 bits. Is there a reason not to do that?

[mvstanton, 2015/04/27 07:57:12]

Okay, this is done. I was just being cautious (at the expense of memory :p).

-    kBitsForIsDehoisted = 1,
 
     kStartElementsKind = 0,
     kStartHoleMode = kStartElementsKind + kBitsForElementsKind,
     kStartBaseOffset = kStartHoleMode + kBitsForHoleMode,
-    kStartIsDehoisted = kStartBaseOffset + kBitsForBaseOffset
   };
 
-  STATIC_ASSERT((kBitsForElementsKind + kBitsForHoleMode + kBitsForBaseOffset +
-                 kBitsForIsDehoisted) <= sizeof(uint32_t) * 8);
+  STATIC_ASSERT((kBitsForElementsKind + kBitsForHoleMode +
+                 kBitsForBaseOffset) <= sizeof(uint32_t) * 8);
   STATIC_ASSERT(kElementsKindCount <= (1 << kBitsForElementsKind));
   class ElementsKindField:
     public BitField<ElementsKind, kStartElementsKind, kBitsForElementsKind>
     {};  // NOLINT
   class HoleModeField:
     public BitField<LoadKeyedHoleMode, kStartHoleMode, kBitsForHoleMode>
     {};  // NOLINT
   class BaseOffsetField:
     public BitField<uint32_t, kStartBaseOffset, kBitsForBaseOffset>
     {};  // NOLINT
-  class IsDehoistedField:
-    public BitField<bool, kStartIsDehoisted, kBitsForIsDehoisted>
-    {};  // NOLINT
   uint32_t bit_field_;
+  bool dehoisted_;
 };
 
 
 class HLoadKeyedGeneric final : public HTemplateInstruction<3> {
  public:
   DECLARE_INSTRUCTION_WITH_CONTEXT_FACTORY_P3(HLoadKeyedGeneric, HValue*,
                                               HValue*, InlineCacheState);
   HValue* object() const { return OperandAt(0); }
   HValue* key() const { return OperandAt(1); }
   HValue* context() const { return OperandAt(2); }
@@ skipping 1165 matching lines @@
 };
 
 
 
 #undef DECLARE_INSTRUCTION
 #undef DECLARE_CONCRETE_INSTRUCTION
 
 } }  // namespace v8::internal
 
 #endif  // V8_HYDROGEN_INSTRUCTIONS_H_