Fix missing hole check for loads from Smi arrays when all uses are changes

test/mjsunit/regress/regress-crbug-233737.js

Index: test/mjsunit/regress/regress-crbug-233737.js
diff --git a/test/mjsunit/regress/regress-2671.js b/test/mjsunit/regress/regress-crbug-233737.js
similarity index 86%
copy from test/mjsunit/regress/regress-2671.js
copy to test/mjsunit/regress/regress-crbug-233737.js
index 8da1b8f07f69c487fe9913e485c60f3e257e0986..835726b22429ec3cca68df956255d47c53fcfd25 100644
--- a/test/mjsunit/regress/regress-2671.js
+++ b/test/mjsunit/regress/regress-crbug-233737.js
@@ -27,19 +27,16 @@
 
 // Flags: --allow-natives-syntax
 
-var y;
-function f() {
-  var a = [];
-  a[20] = 0;
-  y = 3;
-  var i = 7 * (y + -0);
-  a[i] = 1/y;
-  assertFalse(isNaN(a[i]));
-}
+var a = new Array(2);
+a[0] = 1;
+assertTrue(%HasFastSmiElements(a));
+assertTrue(%HasFastHoleyElements(a));
 
-f();
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
+function hole(i) {
+  return a[i] << 0;
+}
 
+assertEquals(1, hole(0));
+assertEquals(1, hole(0));
+%OptimizeFunctionOnNextCall(hole);
+assertEquals(0, hole(1));