Don't pass the hole to SetElement when creating Array.observe change records

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index c764b33e6793ee169d0866318e19483a888e4b08..55e3b810979d1fad9ad53b0035eb496f553d7562 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -11407,6 +11407,9 @@ Handle<Object> JSArray::SetElementsLength(Handle<JSArray> array,
   BeginPerformSplice(array);
 
   for (int i = 0; i < indices.length(); ++i) {
+    // For deletions where the property was an accessor, old_values[i]
+    // will be the hole, which instructs EnqueueChangeRecord to elide
+    // the "oldValue" property.
     JSObject::EnqueueChangeRecord(
         array, "delete", isolate->factory()->Uint32ToString(indices[i]),
         old_values[i]);
@@ -11423,6 +11426,9 @@ Handle<Object> JSArray::SetElementsLength(Handle<JSArray> array,
   Handle<JSArray> deleted = isolate->factory()->NewJSArray(0);
   if (delete_count > 0) {
     for (int i = indices.length() - 1; i >= 0; i--) {
+      // Skip deletions where the property was an accessor, leaving holes
+      // in the array of old values.
+      if (old_values[i]->IsTheHole()) continue;
       JSObject::SetElement(deleted, indices[i] - index, old_values[i], NONE,
                            SLOPPY);
     }