Don't MISS if you read the hole from certain FastHoley arrays.

src/hydrogen-instructions.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HYDROGEN_INSTRUCTIONS_H_
 #define V8_HYDROGEN_INSTRUCTIONS_H_
 
 #include <cstring>
 #include <iosfwd>
 
@@ skipping 6443 matching lines @@
     return r.IsInteger32() || SmiValuesAre32Bits()
         ? Representation::Integer32() : Representation::Smi();
   }
 };
 
 
 static const int kDefaultKeyedHeaderOffsetSentinel = -1;
 
 enum LoadKeyedHoleMode {
   NEVER_RETURN_HOLE,
-  ALLOW_RETURN_HOLE
+  ALLOW_RETURN_HOLE,
+  CONVERT_HOLE_TO_UNDEFINED
 };
 
 
 class HLoadKeyed final : public HTemplateInstruction<3>,
                          public ArrayInstructionInterface {
  public:
   DECLARE_INSTRUCTION_FACTORY_P4(HLoadKeyed, HValue*, HValue*, HValue*,
                                  ElementsKind);
   DECLARE_INSTRUCTION_FACTORY_P5(HLoadKeyed, HValue*, HValue*, HValue*,
                                  ElementsKind, LoadKeyedHoleMode);
@@ skipping 66 matching lines @@
  protected:
   bool DataEquals(HValue* other) override {
     if (!other->IsLoadKeyed()) return false;
     HLoadKeyed* other_load = HLoadKeyed::cast(other);
 
     if (base_offset() != other_load->base_offset()) return false;
     return elements_kind() == other_load->elements_kind();
   }
 
  private:
-  HLoadKeyed(HValue* obj,
-             HValue* key,
-             HValue* dependency,
+  HLoadKeyed(HValue* obj, HValue* key, HValue* dependency,
              ElementsKind elements_kind,
              LoadKeyedHoleMode mode = NEVER_RETURN_HOLE,
              int offset = kDefaultKeyedHeaderOffsetSentinel)
       : bit_field_(0) {
     offset = offset == kDefaultKeyedHeaderOffsetSentinel
         ? GetDefaultHeaderSizeForElementsKind(elements_kind)
         : offset;
     bit_field_ = ElementsKindField::encode(elements_kind) |
         HoleModeField::encode(mode) |
         BaseOffsetField::encode(offset);
@@ skipping 49 matching lines @@
     }
 
     SetFlag(kUseGVN);
   }
 
   bool IsDeletable() const override { return !RequiresHoleCheck(); }
 
   // Establish some checks around our packed fields
   enum LoadKeyedBits {
     kBitsForElementsKind = 5,
-    kBitsForHoleMode = 1,
-    kBitsForBaseOffset = 25,
+    kBitsForHoleMode = 2,
+    kBitsForBaseOffset = 24,
     kBitsForIsDehoisted = 1,
 
     kStartElementsKind = 0,
     kStartHoleMode = kStartElementsKind + kBitsForElementsKind,
     kStartBaseOffset = kStartHoleMode + kBitsForHoleMode,
     kStartIsDehoisted = kStartBaseOffset + kBitsForBaseOffset
   };
 
   STATIC_ASSERT((kBitsForElementsKind + kBitsForHoleMode + kBitsForBaseOffset +
                  kBitsForIsDehoisted) <= sizeof(uint32_t) * 8);
@@ skipping 1189 matching lines @@
 };
 
 
 
 #undef DECLARE_INSTRUCTION
 #undef DECLARE_CONCRETE_INSTRUCTION
 
 } }  // namespace v8::internal
 
 #endif  // V8_HYDROGEN_INSTRUCTIONS_H_