If profiling tells us that the access may be out of bounds, then we shouldn't speculate that it's in bounds.
Created attachment 161981 [details]
Landed in http://trac.webkit.org/changeset/127503
This seems to have caused some failures in fast/js tests; see http://build.webkit.org/results/Apple%20MountainLion%20Release%20WK1%20(Tests)/r127507%20(567)/results.html
Per pizlo, I'm going to roll it out.
Re-opened since this is blocked by 95788
Relanded with fixes in http://trac.webkit.org/changeset/127536