new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testIncElem3.js
@@ -0,0 +1,6 @@
+var arr;
+for (var j = 0; j < 2 * RUNLOOP; ++j ) {
+    arr = [,];
+    ++arr[0];
+}
+assertEq(isNaN(arr[0]), true);

--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -13897,16 +13897,20 @@ TraceRecorder::propTail(JSObject* obj, L
         *slotp = slot;
         *v_insp = v_ins;
     }
     if (outp)
         set(outp, v_ins);
     return RECORD_CONTINUE;
 }
 
+/*
+ * When we end up with a hole, read it as undefined, and make sure to set
+ * addr_ins to null.
+ */
 JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::denseArrayElement(Value& oval, Value& ival, Value*& vp, LIns*& v_ins,
                                  LIns*& addr_ins, VMSideExit* branchExit)
 {
     JS_ASSERT(oval.isObject() && ival.isInt32());
 
     JSObject* obj = &oval.toObject();
     LIns* obj_ins = get(&oval);
@@ -13925,17 +13929,16 @@ TraceRecorder::denseArrayElement(Value& 
     jsuint capacity = obj->getDenseArrayCapacity();
     bool within = (jsuint(idx) < capacity);
     if (!within) {
         /* If not idx < capacity, stay on trace (and read value as undefined). */
         guard(true, w.geui(idx_ins, capacity_ins), branchExit);
 
         CHECK_STATUS(guardPrototypeHasNoIndexedProperties(obj, obj_ins, snapshot(MISMATCH_EXIT)));
 
-        // Return undefined and indicate that we didn't actually read this (addr_ins).
         v_ins = w.immiUndefined();
         addr_ins = NULL;
         return RECORD_CONTINUE;
     }
 
     /* Guard that index is within capacity. */
     guard(true, w.name(w.ltui(idx_ins, capacity_ins), "inRange"), branchExit);
 
@@ -13944,16 +13947,17 @@ TraceRecorder::denseArrayElement(Value& 
 	JS_ASSERT(sizeof(Value) == 8); // The |3| in the following statement requires this.
     addr_ins = w.name(w.getDslotAddress(obj_ins, idx_ins), "elemp");
     v_ins = unbox_value(*vp, DSlotsAddress(addr_ins), branchExit);
 
     /* Don't let the hole value escape. Turn it into an undefined. */
     if (vp->isMagic()) {
         CHECK_STATUS(guardPrototypeHasNoIndexedProperties(obj, obj_ins, snapshot(MISMATCH_EXIT)));
         v_ins = w.immiUndefined();
+        addr_ins = NULL;
     }
     return RECORD_CONTINUE;
 }
 
 /* See comments in TypedArrayTemplate<double>::copyIndexToValue. */
 LIns *
 TraceRecorder::canonicalizeNaNs(LIns *dval_ins)
 {