In the case where we have a non-Value cacheable property, we set the StructureStubInfo accessType to get_by_id_self, but then we don't patch self and instead patch in a get_by_id_self_fail. This leads to incorrect profiling data so when the DFG compiles the function, it uses a GetByOffset rather than a GetById, which leads to loading a GetterSetter directly out of an object.
Created attachment 196694 [details]
Comment on attachment 196694 [details]
(In reply to comment #3)
> (From update of attachment 196694 [details])
> Layout test!
Working on it :-(
Created attachment 196696 [details]
Comment on attachment 196696 [details]
Grr, forgot the commit queue was run by Google...now I can't un-cq+. Oh well!
Committed r147816: <http://trac.webkit.org/changeset/147816>