[tests] Fix mjsunit/getters-on-elements

test/mjsunit/getters-on-elements.js

Index: test/mjsunit/getters-on-elements.js
diff --git a/test/mjsunit/getters-on-elements.js b/test/mjsunit/getters-on-elements.js
index 264de6c5bc6b5d2063e1444c3c348e058e602e9d..ffd4be071439f52922d568be97d150c7b8f7cb20 100644
--- a/test/mjsunit/getters-on-elements.js
+++ b/test/mjsunit/getters-on-elements.js
@@ -88,17 +88,38 @@ function base_getter_test(create_func) {
 
   foo(a);
   assertUnoptimized(foo);
+  // Smi and Double elements transition the KeyedLoadIC to Generic state
+  // here, because they miss twice with the same map when loading the hole.
+  // For FAST_HOLEY_ELEMENTS, however, the IC knows how to convert the hole
+  // to undefined if the prototype is the original array prototype, so it
+  // stays monomorphic for now...
   foo(a);
   foo(a);
   delete a[0];
 
   assertEquals(0, calls);
   a.__proto__ = ap;
+  // ...and later becomes polymorphic when it sees a second map. Optimized
+  // code will therefore inline the elements access, and deopt right away
+  // when it loads the hole from index [0].
+  // Possible solutions:
+  // - remove the convert_hole_to_undefined flag from the IC, to force it
+  //   into generic state for all elements kinds. Cost: slower ICs in code
+  //   that doesn't get optimized.
+  // - teach Turbofan about the same trick: for holey elements with the
+  //   original array prototype, convert hole to undefined inline. Cost:
+  //   larger optimized code size, because the loads for different maps with
+  //   the same elements kind can no longer be consolidated if they handle
+  //   the hole differently.
+  // - call "foo" twice after setting a.__proto__ and before optimizing it;
+  //   this is the simplest fix so let's do that for now.
   foo(a);
   assertEquals(1, calls);
-  optimize(foo);
   foo(a);
   assertEquals(2, calls);
+  optimize(foo);
+  foo(a);
+  assertEquals(3, calls);
   assertOptimized(foo);
 
   // Testcase: getter "deep" in prototype chain.