Don't MISS if you read the hole from certain FastHoley arrays.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 74434cd528b9dbc95bdb7e7f17fd1acbe57981dd..e96207f44362467d6e70e214f3f50fd8ff07ccea 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -6989,16 +6989,23 @@ HInstruction* HOptimizedGraphBuilder::BuildKeyedGeneric(
 
 LoadKeyedHoleMode HOptimizedGraphBuilder::BuildKeyedHoleMode(Handle<Map> map) {
   // Loads from a "stock" fast holey double arrays can elide the hole check.
+  // Loads from a "stock" fast holey array can convert the hole to undefined
+  // with impunity.
   LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
-  if (*map == isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS) &&
+  Map* holey_double_elements =

[Jakob Kummerow, 2015/04/23 13:40:00]

Suggestion: "bool holey_double_elements = *map == ..."
That would make subsequent code look a bit cleaner; but I don't feel strongly
about it.

[mvstanton, 2015/04/27 07:57:12]

Done.

+      isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS);
+  Map* holey_elements =
+      isolate()->get_initial_js_array_map(FAST_HOLEY_ELEMENTS);
+  if ((*map == holey_double_elements || *map == holey_elements) &&
       isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
+    load_mode = *map == holey_double_elements ? ALLOW_RETURN_HOLE
+                                              : CONVERT_HOLE_TO_UNDEFINED;
+
     Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
     Handle<JSObject> object_prototype = isolate()->initial_object_prototype();
     BuildCheckPrototypeMaps(prototype, object_prototype);
-    load_mode = ALLOW_RETURN_HOLE;
     graph()->MarkDependsOnEmptyArrayProtoElements();
   }
-
   return load_mode;
 }