2 files changed, 12 insertions, 0 deletions
diff --git a/Source/JavaScriptCore/bytecode/ArrayProfile.cpp b/Source/JavaScriptCore/bytecode/ArrayProfile.cpp
index 9f4e1ce20..3ba974d74 100644
--- a/Source/JavaScriptCore/bytecode/ArrayProfile.cpp
+++ b/Source/JavaScriptCore/bytecode/ArrayProfile.cpp
@@ -32,6 +32,8 @@ void ArrayProfile::computeUpdatedPrediction(OperationInProgress operation)
 {
     if (m_lastSeenStructure) {
         m_observedArrayModes |= arrayModeFromStructure(m_lastSeenStructure);
+        m_mayInterceptIndexedAccesses |=
+            m_lastSeenStructure->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero();
         if (!m_structureIsPolymorphic) {
             if (!m_expectedStructure)
                 m_expectedStructure = m_lastSeenStructure;
diff --git a/Source/JavaScriptCore/bytecode/ArrayProfile.h b/Source/JavaScriptCore/bytecode/ArrayProfile.h
index 43818d77d..3b462eaba 100644
--- a/Source/JavaScriptCore/bytecode/ArrayProfile.h
+++ b/Source/JavaScriptCore/bytecode/ArrayProfile.h
@@ -54,6 +54,8 @@ public:
         , m_lastSeenStructure(0)
         , m_expectedStructure(0)
         , m_structureIsPolymorphic(false)
+        , m_mayStoreToHole(false)
+        , m_mayInterceptIndexedAccesses(false)
         , m_observedArrayModes(0)
     {
     }
@@ -63,6 +65,8 @@ public:
         , m_lastSeenStructure(0)
         , m_expectedStructure(0)
         , m_structureIsPolymorphic(false)
+        , m_mayStoreToHole(false)
+        , m_mayInterceptIndexedAccesses(false)
         , m_observedArrayModes(0)
     {
     }
@@ -71,6 +75,7 @@ public:
     
     Structure** addressOfLastSeenStructure() { return &m_lastSeenStructure; }
     ArrayModes* addressOfArrayModes() { return &m_observedArrayModes; }
+    bool* addressOfMayStoreToHole() { return &m_mayStoreToHole; }
     
     void observeStructure(Structure* structure)
     {
@@ -89,6 +94,9 @@ public:
         return !structureIsPolymorphic() && m_expectedStructure;
     }
     ArrayModes observedArrayModes() const { return m_observedArrayModes; }
+    bool mayInterceptIndexedAccesses() const { return m_mayInterceptIndexedAccesses; }
+    
+    bool mayStoreToHole() const { return m_mayStoreToHole; }
     
 private:
     friend class LLIntOffsetsExtractor;
@@ -97,6 +105,8 @@ private:
     Structure* m_lastSeenStructure;
     Structure* m_expectedStructure;
     bool m_structureIsPolymorphic;
+    bool m_mayStoreToHole; // This flag may become overloaded to indicate other special cases that were encountered during array access, as it depends on indexing type. Since we currently have basically just one indexing type (two variants of ArrayStorage), this flag for now just means exactly what its name implies.
+    bool m_mayInterceptIndexedAccesses;
     ArrayModes m_observedArrayModes;
 };