Don't MISS if you read the hole from certain FastHoley arrays.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/v8.h"
 
@@ skipping 6971 matching lines @@
     return result;
   } else {
     return New<HStoreKeyedGeneric>(object, key, value, function_language_mode(),
                                    PREMONOMORPHIC);
   }
 }
 
 
 LoadKeyedHoleMode HOptimizedGraphBuilder::BuildKeyedHoleMode(Handle<Map> map) {
   // Loads from a "stock" fast holey double arrays can elide the hole check.
+  // Loads from a "stock" fast holey array can convert the hole to undefined
+  // with impunity.
   LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
-  if (*map == isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS) &&
+  Map* holey_double_elements =

[Jakob Kummerow, 2015/04/23 13:40:00]

Suggestion: "bool holey_double_elements = *map == ..."
That would make subsequent code look a bit cleaner; but I don't feel strongly
about it.

[mvstanton, 2015/04/27 07:57:12]

Done.

+      isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS);
+  Map* holey_elements =
+      isolate()->get_initial_js_array_map(FAST_HOLEY_ELEMENTS);
+  if ((*map == holey_double_elements || *map == holey_elements) &&
       isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
+    load_mode = *map == holey_double_elements ? ALLOW_RETURN_HOLE
+                                              : CONVERT_HOLE_TO_UNDEFINED;
+
     Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
     Handle<JSObject> object_prototype = isolate()->initial_object_prototype();
     BuildCheckPrototypeMaps(prototype, object_prototype);
-    load_mode = ALLOW_RETURN_HOLE;
     graph()->MarkDependsOnEmptyArrayProtoElements();
   }
-
   return load_mode;
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
     HValue* object,
     HValue* key,
     HValue* val,
     HValue* dependency,
     Handle<Map> map,
@@ skipping 6011 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal