Don't allow copying holes to fields.

test/mjsunit/regress/regress-copy-hole-to-field.js

Index: test/mjsunit/regress/regress-copy-hole-to-field.js
diff --git a/test/mjsunit/regress/regress-2489.js b/test/mjsunit/regress/regress-copy-hole-to-field.js
similarity index 82%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-copy-hole-to-field.js
index 882c4f794a88e24d1d64e86a466b27c39f51e625..2cd9c860053203e62db7a7fb4465726442b6ee91 100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-copy-hole-to-field.js
@@ -27,24 +27,30 @@
 
 // Flags: --allow-natives-syntax
 
-"use strict";
+// Copy a hole from HOLEY_DOUBLE to double field.
+var a = [1.5,,1.7];
+var o = {a:1.8};
 
-function f(a, b) {
-  return g("c", "d");
+function f(o,a,i) {
+  o.a = a[i];
 }
 
-function g(a, b) {
-  g.constructor.apply(this, arguments);
-}
+f(o,a,0);
+f(o,a,0);
+%OptimizeFunctionOnNextCall(f);
+f(o,a,1);
+print(o.a);

[Jakob Kummerow, 2013/05/22 15:28:09]

I think you want to assertEquals(undefined, o.a) here, not just print the value.

+
+// Copy a hole from HOLEY_SMI to smi field.
+var a = [1,,3];
+var o = {ab:5};
 
-g.constructor = function(a, b) {
-  assertEquals("c", a);
-  assertEquals("d", b);
+function f(o,a,i) {
+  o.ab = a[i];
 }
 
-f("a", "b");
-f("a", "b");
+f(o,a,0);
+f(o,a,0);
 %OptimizeFunctionOnNextCall(f);
-f("a", "b");
-g.x = "deopt";
-f("a", "b");
+f(o,a,1);
+print(o.ab);

[Jakob Kummerow, 2013/05/22 15:28:09]

again