Ask the array again when join meets a hole

[lahma]

ArrayHoleTraversalBenchmark.JoinHoley is the one row that can move; it runs in the release measurement block with JoinDense and the class's other rows as controls.

[0, funky, , ,].join("") where funky.toString() sets Object.prototype[3] answered "0funky" — node and the spec (Get(O, ToString(k)) per element, every iteration) answer "0funkyfnord". ArrayReadOperations.Get, the read-only fast lane, snapshotted _dense at construction and turned a hole into undefined without ever asking the array.

A null slot (or an index past the snapshot) now routes to JsArray.Get(uint), which still short-circuits to Undefined while CanUseFastAccess holds and walks the chain only after the realm's array prototype chain has actually gained an index property. A slot the snapshot holds is untouched: one bounds compare, one load, one null test — identical to before. The red matrix needed one engine per case to expose, because the first prototype index write sets a sticky realm-wide flag that clears fast access — that mechanism is exactly why the pristine-realm fast path is safe.

Siblings disclosed, deliberately not fixed here: toLocaleString reads via TryGetValue and still short-circuits (spec says Get); ArrayReadOperations.HasProperty answers existence from the same snapshot, so forEach/every/some/filter/indexOf miss an index the prototype gained mid-iteration; and a side effect that reallocates _dense leaves the snapshot itself stale — fixing that one means a per-element field load on the hot path and needs its own benchmark gate.

12 new tests, red on exactly the 4 join/toString rows, both TFMs. test262 standalone 0 / 99,744 / 157, identical.

🤖 Generated with Claude Code

[lahma]

Benchmark gate — measured, reworked once, now PASS

The first measurement caught a real cost: ArrayHoleTraversalBenchmark.JoinHoley at +54.9% — every hole paid a non-inlined JsArray.Get call even when CanUseFastAccess proves nothing can shadow it. The fix now answers a hole inline while that flag holds (re-read per hole, because a side effect during the very join is exactly what can clear it) and only falls back to the spec's chain-walking read once it is gone.

Re-gated after the rework:

Row	base	cand	Δ
JoinHoley	536.2 µs	554.7 µs	+3.4%
JoinDense	945.2 µs	949.3 µs	+0.4%
SumHoley / SumDense / InOperatorHoley / IndexOfMissHoley			−0.7% to −0.2%
IndexOfMissDense (untouched)			−6.9% (scatter)

The residual +3.4% on the hole-heavy row is the honest cost of the correctness fix — per-hole flag read and branch where there used to be nothing — disclosed rather than hidden. Allocation byte-identical everywhere. ArrayTests 167/167 on both TFMs after the rework; the amended commit is force-pushed.