Don't allow copying holes to fields.

test/mjsunit/regress/regress-copy-hole-to-field.js

Index: test/mjsunit/regress/regress-copy-hole-to-field.js
diff --git a/test/mjsunit/elide-double-hole-check-4.js b/test/mjsunit/regress/regress-copy-hole-to-field.js
similarity index 79%
copy from test/mjsunit/elide-double-hole-check-4.js
copy to test/mjsunit/regress/regress-copy-hole-to-field.js
index e2a55055710d6aa222ca4c4aecfbe3926d9c5cca..fa3db92928a6ca2683aa8c8a02f972e1ee4df962 100644
--- a/test/mjsunit/elide-double-hole-check-4.js
+++ b/test/mjsunit/regress/regress-copy-hole-to-field.js
@@ -27,13 +27,31 @@
 
 // Flags: --allow-natives-syntax
 
-function f1(a, i) {
-  return a[i] + 0.5;
+// Copy a hole from HOLEY_DOUBLE to double field.
+var a = [1.5,,1.7];
+var o = {a:1.8};
+
+function f1(o,a,i) {
+  o.a = a[i];
 }
-var arr = [0.0,,2.5];
-assertEquals(0.5, f1(arr, 0));
-assertEquals(0.5, f1(arr, 0));
+
+f1(o,a,0);
+f1(o,a,0);
+assertEquals(1.5, o.a);
 %OptimizeFunctionOnNextCall(f1);
-assertEquals(0.5, f1(arr, 0));
-Array.prototype[1] = 1.5;
-assertEquals(2, f1(arr, 1));
+f1(o,a,1);
+assertEquals(undefined, o.a);
+
+// Copy a hole from HOLEY_SMI to smi field.
+var a = [1,,3];
+var o = {ab:5};
+
+function f2(o,a,i) {
+  o.ab = a[i];
+}
+
+f2(o,a,0);
+f2(o,a,0);
+%OptimizeFunctionOnNextCall(f2);
+f2(o,a,1);
+assertEquals(undefined, o.ab);