Elide hole checks on KeyedLoads of holey double arrays.

test/mjsunit/elide-double-hole-check-1.js

Index: test/mjsunit/elide-double-hole-check-1.js
diff --git a/test/mjsunit/regress/regress-crbug-147475.js b/test/mjsunit/elide-double-hole-check-1.js
similarity index 74%
copy from test/mjsunit/regress/regress-crbug-147475.js
copy to test/mjsunit/elide-double-hole-check-1.js
index 180744c730f5c53b68df7fb4746809d54c42b35e..63569df294816ae355f92f678b2a5fad1d72c7dd 100644
--- a/test/mjsunit/regress/regress-crbug-147475.js
+++ b/test/mjsunit/elide-double-hole-check-1.js
@@ -1,4 +1,4 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
+// Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -27,22 +27,26 @@
 
 // Flags: --allow-natives-syntax
 
-function worker1(ignored) {
-  return 100;
+function f1(a, i) {
+  return a[i]
 }
 
-function factory(worker) {
-  return function(call_depth) {
-    if (call_depth == 0) return 10;
-    return 1 + worker(call_depth - 1);
-  }
-}
-
-var f1 = factory(worker1);
-var f2 = factory(f1);
-assertEquals(11, f2(1));
+var a1 = [,,,,,,,,,,,,,,,,,,0.5];
+assertEquals(undefined, f1(a1, 1));
+assertEquals(undefined, f1(a1, 1));
 %OptimizeFunctionOnNextCall(f1);
-assertEquals(10, f1(0));
+assertEquals(undefined, f1(a1, 1));
+assertEquals(undefined, f1(a1, 1));
+
+function f2(a, i) {
+  return a[i] + 0.5;
+}
+var a2_b = [0.0,,];
+assertEquals(0.5, f2(a2_b, 0));
+assertEquals(0.5, f2(a2_b, 0));
 %OptimizeFunctionOnNextCall(f2);
-assertEquals(102, f2(2));
-assertEquals(102, f2(2));
+assertEquals(0.5, f2(a2_b, 0));
+assertEquals(NaN, f2(a2_b, 1));
+a2_b.__proto__ = [1.5,1.5,1.5];
+assertEquals(2, f2(a2_b, 1));
+assertEquals(0.5, f2(a2_b, 0));