The change to introduce PutByValSafe, and the change to eliminate the use of array predictions in selecting what kind of access to use, was not completely propagated to the structure check hoister or the CFA.
Created attachment 159044 [details] the patch
Comment on attachment 159044 [details] the patch r=me
Landed in http://trac.webkit.org/changeset/125959