Fix bogus deopt in BuildEmitDeepCopy for holey arrays.

src/hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 10994 matching lines @@
 
     BuildInitializeElements(object_elements, kind, object_elements_length);
 
     // Copy elements backing store content.
     if (elements->IsFixedDoubleArray()) {
       for (int i = 0; i < elements_length; i++) {
         HValue* key_constant =
             AddInstruction(new(zone) HConstant(i, Representation::Integer32()));
         HInstruction* value_instruction =
             AddInstruction(new(zone) HLoadKeyed(
-                boilerplate_elements, key_constant, NULL, kind));
-        AddInstruction(new(zone) HStoreKeyed(
+                boilerplate_elements, key_constant, NULL, kind,
+                ALLOW_RETURN_HOLE));
+        HInstruction* store = AddInstruction(new(zone) HStoreKeyed(
                 object_elements, key_constant, value_instruction, kind));
+        store->ClearFlag(HValue::kDeoptimizeOnUndefined);
       }
     } else if (elements->IsFixedArray()) {
       Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
       Handle<FixedArray> original_fast_elements =
           Handle<FixedArray>::cast(original_elements);
       for (int i = 0; i < elements_length; i++) {
         Handle<Object> value(fast_elements->get(i), isolate());
         HValue* key_constant =
             AddInstruction(new(zone) HConstant(i, Representation::Integer32()));
         if (value->IsJSObject()) {
           Handle<JSObject> value_object = Handle<JSObject>::cast(value);
           Handle<JSObject> original_value_object = Handle<JSObject>::cast(
               Handle<Object>(original_fast_elements->get(i), isolate()));
           HInstruction* value_instruction =
               AddInstruction(new(zone) HInnerAllocatedObject(target, *offset));
           AddInstruction(new(zone) HStoreKeyed(
               object_elements, key_constant, value_instruction, kind));
           BuildEmitDeepCopy(value_object, original_value_object, target,
               offset, DONT_TRACK_ALLOCATION_SITE);
         } else {
           HInstruction* value_instruction =
               AddInstruction(new(zone) HLoadKeyed(
-                  boilerplate_elements, key_constant, NULL, kind));
+                  boilerplate_elements, key_constant, NULL, kind,
+                  ALLOW_RETURN_HOLE));
           AddInstruction(new(zone) HStoreKeyed(
               object_elements, key_constant, value_instruction, kind));
         }
       }
     } else {
       UNREACHABLE();
     }
   }
 }
 
@@ skipping 1420 matching lines @@
     }
   }
 
 #ifdef DEBUG
   if (graph_ != NULL) graph_->Verify(false);  // No full verify.
   if (allocator_ != NULL) allocator_->Verify();
 #endif
 }
 
 } }  // namespace v8::internal