port caeb9004 (r28056)

original commit message:
    If the array's map is the initial FastHoley array map, and the array prototype
    chain is undisturbed and empty of elements, then keyed loads can convert the
    load of a hole to undefined.

BUG=

Review URL: https://codereview.chromium.org/1104073003

Cr-Commit-Position: refs/heads/master@{#28128}