Don't MISS if you read the hole from certain FastHoley arrays.

src/hydrogen-instructions.h

Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index 0e84a6e9597b10775276f9511f9107c5077de308..557909d5fa0303a65d76e7fc192df49547e657c7 100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -6456,7 +6456,8 @@ static const int kDefaultKeyedHeaderOffsetSentinel = -1;
 
 enum LoadKeyedHoleMode {
   NEVER_RETURN_HOLE,
-  ALLOW_RETURN_HOLE
+  ALLOW_RETURN_HOLE,
+  CONVERT_HOLE_TO_UNDEFINED
 };
 
 
@@ -6490,12 +6491,8 @@ class HLoadKeyed final : public HTemplateInstruction<3>,
   bool TryIncreaseBaseOffset(uint32_t increase_by_value) override;
   HValue* GetKey() override { return key(); }
   void SetKey(HValue* key) override { SetOperandAt(1, key); }
-  bool IsDehoisted() const override {
-    return IsDehoistedField::decode(bit_field_);
-  }
-  void SetDehoisted(bool is_dehoisted) override {
-    bit_field_ = IsDehoistedField::update(bit_field_, is_dehoisted);
-  }
+  bool IsDehoisted() const override { return dehoisted_; }
+  void SetDehoisted(bool is_dehoisted) override { dehoisted_ = is_dehoisted; }
   ElementsKind elements_kind() const override {
     return ElementsKindField::decode(bit_field_);
   }
@@ -6543,13 +6540,11 @@ class HLoadKeyed final : public HTemplateInstruction<3>,
   }
 
  private:
-  HLoadKeyed(HValue* obj,
-             HValue* key,
-             HValue* dependency,
+  HLoadKeyed(HValue* obj, HValue* key, HValue* dependency,
              ElementsKind elements_kind,
              LoadKeyedHoleMode mode = NEVER_RETURN_HOLE,
              int offset = kDefaultKeyedHeaderOffsetSentinel)
-      : bit_field_(0) {
+      : bit_field_(0), dehoisted_(false) {
     offset = offset == kDefaultKeyedHeaderOffsetSentinel
         ? GetDefaultHeaderSizeForElementsKind(elements_kind)
         : offset;
@@ -6615,18 +6610,16 @@ class HLoadKeyed final : public HTemplateInstruction<3>,
   // Establish some checks around our packed fields
   enum LoadKeyedBits {
     kBitsForElementsKind = 5,
-    kBitsForHoleMode = 1,
+    kBitsForHoleMode = 2,
     kBitsForBaseOffset = 25,

[Jakob Kummerow, 2015/04/23 13:40:00]

I think instead of moving |dehoisted| out of this bitfield, I'd rather shrink
the base offset field to 24 bits. Is there a reason not to do that?

[mvstanton, 2015/04/27 07:57:12]

Okay, this is done. I was just being cautious (at the expense of memory :p).

-    kBitsForIsDehoisted = 1,
 
     kStartElementsKind = 0,
     kStartHoleMode = kStartElementsKind + kBitsForElementsKind,
     kStartBaseOffset = kStartHoleMode + kBitsForHoleMode,
-    kStartIsDehoisted = kStartBaseOffset + kBitsForBaseOffset
   };
 
-  STATIC_ASSERT((kBitsForElementsKind + kBitsForHoleMode + kBitsForBaseOffset +
-                 kBitsForIsDehoisted) <= sizeof(uint32_t) * 8);
+  STATIC_ASSERT((kBitsForElementsKind + kBitsForHoleMode +
+                 kBitsForBaseOffset) <= sizeof(uint32_t) * 8);
   STATIC_ASSERT(kElementsKindCount <= (1 << kBitsForElementsKind));
   class ElementsKindField:
     public BitField<ElementsKind, kStartElementsKind, kBitsForElementsKind>
@@ -6637,10 +6630,8 @@ class HLoadKeyed final : public HTemplateInstruction<3>,
   class BaseOffsetField:
     public BitField<uint32_t, kStartBaseOffset, kBitsForBaseOffset>
     {};  // NOLINT
-  class IsDehoistedField:
-    public BitField<bool, kStartIsDehoisted, kBitsForIsDehoisted>
-    {};  // NOLINT
   uint32_t bit_field_;
+  bool dehoisted_;
 };