Commit caeb9004 authored by mvstanton's avatar mvstanton Committed by Commit bot
Browse files

Don't MISS if you read the hole from certain FastHoley arrays.

If the array's map is the initial FastHoley array map, and the array prototype
chain is undisturbed and empty of elements, then keyed loads can convert the
load of a hole to undefined.

BUG=

Review URL: https://codereview.chromium.org/1100083002

Cr-Commit-Position: refs/heads/master@{#28056}
parent ae0bc416
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment