[map] Normalize hole for formatting an exception

The first element of a given iterable argument can be a hole. Thus,
normalize the first element so that we can correctly format the
exception message with "undefined" for a hole element, instead of "NaN".

Bug: v8:7715
Change-Id: I62edd09e361ebeebab642bb82db29b73a2c7b193
Reviewed-on: https://chromium-review.googlesource.com/1038951Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52917}

src/builtins/builtins-collections-gen.cc

@@ -262,12 +262,11 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromFastJSArray(
     // A Map constructor requires entries to be arrays (ex. [key, value]),
     // so a FixedDoubleArray can never succeed.
     if (variant == kMap || variant == kWeakMap) {
-      TNode<Float64T> element =
-          UncheckedCast<Float64T>(LoadFixedDoubleArrayElement(
-              elements, IntPtrConstant(0), MachineType::Float64(), 0,
-              INTPTR_PARAMETERS));
+      CSA_ASSERT(this, IntPtrGreaterThan(length, IntPtrConstant(0)));
+      TNode<Object> element =
+          LoadAndNormalizeFixedDoubleArrayElement(elements, IntPtrConstant(0));
       ThrowTypeError(context, MessageTemplate::kIteratorValueNotAnObject,
-                     AllocateHeapNumberWithValue(element));
+                     element);
     } else {
       DCHECK(variant == kSet || variant == kWeakSet);
       auto set_entry = [&](Node* index) {

test/mjsunit/messages.js

@@ -290,6 +290,20 @@ test(function() {
   new Map([1]);
 }, "Iterator value 1 is not an entry object", TypeError);
 
+test(function() {
+  let holeyDoubleArray = [, 123.123];
+  assertTrue(%HasDoubleElements(holeyDoubleArray));
+  assertTrue(%HasHoleyElements(holeyDoubleArray));
+  new Map(holeyDoubleArray);
+}, "Iterator value undefined is not an entry object", TypeError);
+
+test(function() {
+  let holeyDoubleArray = [, 123.123];
+  assertTrue(%HasDoubleElements(holeyDoubleArray));
+  assertTrue(%HasHoleyElements(holeyDoubleArray));
+  new WeakMap(holeyDoubleArray);
+}, "Iterator value undefined is not an entry object", TypeError);
+
 // kNotConstructor
 test(function() {
   new Symbol();