Patch forthcoming.
Created attachment 276016 [details] the patch
Comment on attachment 276016 [details] the patch Ugh, never mind.
Created attachment 276018 [details] the patch
Comment on attachment 276018 [details] the patch r=me
I'm still testing this, it'll be a while. I'm worried that I messed up DFG's profiling of .length, so I'll test everything.
Landed in http://trac.webkit.org/changeset/199240