Don't pre-initialise block contexts with holes

Respective declarations will explicitly initialise slots
with the hole anyway, so this always was unnecessary.
With varblocks it even became wrong, because block contexts
may now host var bindings, which want undefined.

Fixes the hole leaking when accessing an unitialised,
block-context-allocated var.

R=neis@chromium.org
BUG=571149
LOG=N

Review URL: https://codereview.chromium.org/1584243002

Cr-Commit-Position: refs/heads/master@{#33309}

src/compiler/js-typed-lowering.cc

@@ -2068,7 +2068,7 @@ Reduction JSTypedLowering::ReduceJSCreateBlockContext(Node* node) {
     a.Store(AccessBuilder::ForContextSlot(Context::NATIVE_CONTEXT_INDEX),
             native_context);
     for (int i = Context::MIN_CONTEXT_SLOTS; i < context_length; ++i) {
-      a.Store(AccessBuilder::ForContextSlot(i), jsgraph()->TheHoleConstant());
+      a.Store(AccessBuilder::ForContextSlot(i), jsgraph()->UndefinedConstant());
     }
     RelaxControls(node);
     a.FinishAndChange(node);

src/factory.cc

@@ -831,8 +831,7 @@ Handle<Context> Factory::NewWithContext(Handle<JSFunction> function,
 Handle<Context> Factory::NewBlockContext(Handle<JSFunction> function,
                                          Handle<Context> previous,
                                          Handle<ScopeInfo> scope_info) {
-  Handle<FixedArray> array =
-      NewFixedArrayWithHoles(scope_info->ContextLength());
+  Handle<FixedArray> array = NewFixedArray(scope_info->ContextLength());
   array->set_map_no_write_barrier(*block_context_map());
   Handle<Context> context = Handle<Context>::cast(array);
   context->set_closure(*function);

test/mjsunit/harmony/regress/regress-crbug-571149.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+(function(a = 0){
+  var x;  // allocated in a var block, due to use of default parameter
+  (function() { return !x })();
+})();
+
+(function({a}){
+  var x;  // allocated in a var block, due to use of parameter destructuring
+  (function() { return !x })();
+})({});
+
+(function(...a){
+  var x;  // allocated in a var block, due to use of rest parameter
+  (function() { return !x })();
+})();