[turbofan] Fix Array.p.find handling of holes in double elements

Bug: chromium:791045, v8:1956
Change-Id: I1400fc95b78e0f4771867d136377b14aed5bd4f4
Reviewed-on: https://chromium-review.googlesource.com/819510Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50061}

src/compiler/js-call-reducer.cc

@@ -1400,6 +1400,12 @@ Reduction JSCallReducer::ReduceArrayFind(Handle<JSFunction> function,
   if (receiver_maps.size() == 0) return NoChange();
 
   const ElementsKind kind = receiver_maps[0]->elements_kind();
+
+  // TODO(pwong): Handle holey double elements kinds.
+  if (IsDoubleElementsKind(kind) && IsHoleyElementsKind(kind)) {
+    return NoChange();
+  }
+
   for (Handle<Map> receiver_map : receiver_maps) {
     if (!CanInlineArrayIteratingBuiltin(receiver_map)) return NoChange();
     // We can handle different maps, as long as their elements kind are the

test/mjsunit/optimized-array-find.js

@@ -392,3 +392,19 @@
   %OptimizeFunctionOnNextCall(withHoles);
   assertArrayEquals([1, 2, undefined, 3, 4], withHoles());
 })();
+
+(() => {
+  const a = [1.5, 2.5, , 3.5, 4.5];
+  function withHoles() {
+    const callback_values = [];
+    a.find(v => {
+      callback_values.push(v);
+      return false;
+    });
+    return callback_values;
+  }
+  withHoles();
+  withHoles();
+  %OptimizeFunctionOnNextCall(withHoles);
+  assertArrayEquals([1.5, 2.5, undefined, 3.5, 4.5], withHoles());
+})();