Elide hole checks on KeyedLoads of holey double arrays.

test/mjsunit/elide-double-hole-check-6.js

Index: test/mjsunit/elide-double-hole-check-6.js
diff --git a/test/mjsunit/regress/regress-171641.js b/test/mjsunit/elide-double-hole-check-6.js
similarity index 86%
copy from test/mjsunit/regress/regress-171641.js
copy to test/mjsunit/elide-double-hole-check-6.js
index 8db6781821325f8f6253eb2df4abb2b362b001c0..01a8096f85c2381d400d436198daa59fe7ca9ce0 100644
--- a/test/mjsunit/regress/regress-171641.js
+++ b/test/mjsunit/elide-double-hole-check-6.js
@@ -27,14 +27,13 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(k, p) {
-  for (var i = 0; i < 1; i++) {
-    p = Math.min(p, i);
-  }
-  m = Math.floor((k | 0) / p);
+function f1(a, i) {
+  return a[i] + 0.5;
 }
-
-foo(0, 1);
-foo(0, 1);
-%OptimizeFunctionOnNextCall(foo);
-foo(0, 1);
+var arr = [0.0,,2.5];
+assertEquals(0.5, f1(arr, 0));
+assertEquals(0.5, f1(arr, 0));
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(0.5, f1(arr, 0));
+Array.prototype.__proto__[1] = 1.5;
+assertEquals(2, f1(arr, 1));