Handle holes in smi-untag from LoadKeyed requiring hole handling.

src/ia32/lithium-ia32.cc

Index: src/ia32/lithium-ia32.cc
diff --git a/src/ia32/lithium-ia32.cc b/src/ia32/lithium-ia32.cc
index dec5697f8769b861b8d72e2b44ec9647695e8cc5..81797534d3f093380a593e92d7c1250a17381f40 100644
--- a/src/ia32/lithium-ia32.cc
+++ b/src/ia32/lithium-ia32.cc
@@ -1929,7 +1929,16 @@ LInstruction* LChunkBuilder::DoChange(HChange* instr) {
       ASSERT(to.IsInteger32());
       if (instr->value()->type().IsSmi()) {
         LOperand* value = UseRegister(instr->value());
-        return DefineSameAsFirst(new(zone()) LSmiUntag(value, false));
+        LInstruction* result =
+            DefineSameAsFirst(new(zone()) LSmiUntag(value, false));
+        if (instr->value()->IsLoadKeyed()) {
+          HLoadKeyed* load_keyed = HLoadKeyed::cast(instr->value());
+          if (load_keyed->UsesMustHandleHole() &&
+              load_keyed->hole_mode() == NEVER_RETURN_HOLE) {
+            return AssignEnvironment(result);
+          }
+        }
+        return result;
       } else {
         bool truncating = instr->CanTruncateToInt32();
         if (CpuFeatures::IsSafeForSnapshot(SSE2)) {