It's a confusion between heuristics in DFG::ArrayMode that are assuming that you'll use ForceExit if array profiles are empty, the JIT creating empty profiles sometimes for typed array length accesses, and the FixupPhase assuming that a ForceExit ArrayMode means that it should continue using a generic GetById.
Created attachment 208870 [details] the patch
Comment on attachment 208870 [details] the patch r=me to fwiw.
Landed in http://trac.webkit.org/changeset/154157