Allow loading holes from holey smi arrays

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/v8.h"
 
@@ skipping 7080 matching lines @@
                                    PREMONOMORPHIC);
   }
 }
 
 
 LoadKeyedHoleMode HOptimizedGraphBuilder::BuildKeyedHoleMode(Handle<Map> map) {
   // Loads from a "stock" fast holey double arrays can elide the hole check.
   // Loads from a "stock" fast holey array can convert the hole to undefined
   // with impunity.
   LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
+  bool holey_smi_elements =
+      *map == isolate()->get_initial_js_array_map(FAST_HOLEY_SMI_ELEMENTS);
   bool holey_double_elements =
       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS);
   bool holey_elements =
       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_ELEMENTS);
-  if ((holey_double_elements || holey_elements) &&
+  if ((holey_smi_elements || holey_double_elements || holey_elements) &&
       isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
     load_mode =
         holey_double_elements ? ALLOW_RETURN_HOLE : CONVERT_HOLE_TO_UNDEFINED;
 
     Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
     Handle<JSObject> object_prototype = isolate()->initial_object_prototype();
     BuildCheckPrototypeMaps(prototype, object_prototype);
     graph()->MarkDependsOnEmptyArrayProtoElements();
   }
   return load_mode;
@@ skipping 6034 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal