CopyPackedSmiToDoubleElements should fill the FixedDoubleArray with holes

src/elements.cc

Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index ae5c7de04ac55712be64baf6e69be7b546934b29..3e9624259f4d6bc5919d5157d83b041c743c031c 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -374,7 +374,7 @@ static void CopyPackedSmiToDoubleElements(FixedArray* from,
   if (raw_copy_size < 0) {
     ASSERT(raw_copy_size == ElementsAccessor::kCopyToEnd ||
            raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
-    copy_size = from->length() - from_start;
+    copy_size = packed_size - from_start;
     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
       to_end = to->length();
       for (uint32_t i = to_start + copy_size; i < to_end; ++i) {