Don't MISS if you read the hole from certain FastHoley arrays.

src/code-stubs-hydrogen.cc

Index: src/code-stubs-hydrogen.cc
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
index 3ca301ca6c3a6c215097d6f0afbfa575e5df08e7..5df894375e7c95bb211feedc8baaf0f64ef3ace5 100644
--- a/src/code-stubs-hydrogen.cc
+++ b/src/code-stubs-hydrogen.cc
@@ -578,11 +578,17 @@ Handle<Code> StoreScriptContextFieldStub::GenerateCode() {
 
 template <>
 HValue* CodeStubGraphBuilder<LoadFastElementStub>::BuildCodeStub() {
+  LoadKeyedHoleMode hole_mode = NEVER_RETURN_HOLE;
+  if (casted_stub()->elements_kind() == FAST_HOLEY_ELEMENTS &&

[Jakob Kummerow, 2015/04/23 13:40:00]

Why do we need to check for elements kind again? The IC/handler compilers
already do that when computing the convert_hole_to_undefined flag, no?

[mvstanton, 2015/04/27 07:57:12]

Indeed, good catch, fixed.

+      casted_stub()->convert_hole_to_undefined()) {
+    hole_mode = CONVERT_HOLE_TO_UNDEFINED;
+  }
+
   HInstruction* load = BuildUncheckedMonomorphicElementAccess(
       GetParameter(LoadDescriptor::kReceiverIndex),
       GetParameter(LoadDescriptor::kNameIndex), NULL,
       casted_stub()->is_js_array(), casted_stub()->elements_kind(), LOAD,
-      NEVER_RETURN_HOLE, STANDARD_STORE);
+      hole_mode, STANDARD_STORE);
   return load;
 }