Elide hole checks on KeyedLoads of holey double arrays.

test/mjsunit/elide-double-hole-check-8.js

Index: test/mjsunit/elide-double-hole-check-8.js
diff --git a/test/mjsunit/regress/regress-171641.js b/test/mjsunit/elide-double-hole-check-8.js
similarity index 84%
copy from test/mjsunit/regress/regress-171641.js
copy to test/mjsunit/elide-double-hole-check-8.js
index 8db6781821325f8f6253eb2df4abb2b362b001c0..35cc91fa8e977c2ac1cb37ac0c03410c5b34bf21 100644
--- a/test/mjsunit/regress/regress-171641.js
+++ b/test/mjsunit/elide-double-hole-check-8.js
@@ -27,14 +27,14 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(k, p) {
-  for (var i = 0; i < 1; i++) {
-    p = Math.min(p, i);
-  }
-  m = Math.floor((k | 0) / p);
+function f1(a, i) {
+  return a[i] + 0.5;
 }
-
-foo(0, 1);
-foo(0, 1);
-%OptimizeFunctionOnNextCall(foo);
-foo(0, 1);
+var arr = [0.0,,2.5];
+assertEquals(0.5, f1(arr, 0));
+assertEquals(0.5, f1(arr, 0));
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(0.5, f1(arr, 0));
+Array.prototype.__proto__ = new Object();
+Array.prototype.__proto__[1] = 1.5;
+assertEquals(2, f1(arr, 1));