1 files changed, 32 insertions, 47 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
index 000e1a938..2f535ba22 100644
--- a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
@@ -145,7 +145,7 @@ public:
         }
         
         // Figure out which variables alias the arguments and nothing else, and are
-        // used only for GetByVal and GetArgumentsLength accesses. At the same time,
+        // used only for GetByVal and GetArrayLength accesses. At the same time,
         // identify uses of CreateArguments that are not consistent with the arguments
         // being aliased only to variables that satisfy these constraints.
         for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
@@ -277,34 +277,25 @@ public:
                 }
                     
                 case GetByVal: {
-                    if (!node.prediction()
-                        || !m_graph[node.child1()].prediction()
-                        || !m_graph[node.child2()].prediction()) {
+                    if (node.arrayMode() != Array::Arguments) {
                         observeBadArgumentsUses(node);
                         break;
                     }
+
+                    // That's so awful and pretty much impossible since it would
+                    // imply that the arguments were predicted integer, but it's
+                    // good to be defensive and thorough.
+                    observeBadArgumentsUse(node.child2());
+                    observeProperArgumentsUse(node, node.child1());
+                    break;
+                }
                     
-                    if (!isActionableArraySpeculation(m_graph[node.child1()].prediction())
-                        || !m_graph[node.child2()].shouldSpeculateInteger()) {
+                case GetArrayLength: {
+                    if (node.arrayMode() != Array::Arguments) {
                         observeBadArgumentsUses(node);
                         break;
                     }
-                    
-                    if (m_graph[node.child1()].shouldSpeculateArguments()) {
-                        // If arguments is used as an index, then it's an escaping use.
-                        // That's so awful and pretty much impossible since it would
-                        // imply that the arguments were predicted integer, but it's
-                        // good to be defensive and thorough.
-                        observeBadArgumentsUse(node.child2());
-                        observeProperArgumentsUse(node, node.child1());
-                        break;
-                    }
-                    
-                    observeBadArgumentsUses(node);
-                    break;
-                }
-                    
-                case GetArgumentsLength: {
+                        
                     observeProperArgumentsUse(node, node.child1());
                     break;
                 }
@@ -496,38 +487,32 @@ public:
                 }
                     
                 case GetByVal: {
-                    if (!node.prediction()
-                        || !m_graph[node.child1()].prediction()
-                        || !m_graph[node.child2()].prediction())
+                    if (node.arrayMode() != Array::Arguments)
                         break;
+
+                    // This can be simplified to GetMyArgumentByVal if we know that
+                    // it satisfies either condition (1) or (2):
+                    // 1) Its first child is a valid ArgumentsAliasingData and the
+                    //    InlineCallFrame* is not marked as creating arguments.
+                    // 2) Its first child is CreateArguments and its InlineCallFrame*
+                    //    is not marked as creating arguments.
                     
-                    if (!isActionableArraySpeculation(m_graph[node.child1()].prediction())
-                        || !m_graph[node.child2()].shouldSpeculateInteger())
+                    if (!isOKToOptimize(m_graph[node.child1()]))
                         break;
                     
-                    if (m_graph[node.child1()].shouldSpeculateArguments()) {
-                        // This can be simplified to GetMyArgumentByVal if we know that
-                        // it satisfies either condition (1) or (2):
-                        // 1) Its first child is a valid ArgumentsAliasingData and the
-                        //    InlineCallFrame* is not marked as creating arguments.
-                        // 2) Its first child is CreateArguments and its InlineCallFrame*
-                        //    is not marked as creating arguments.
-                        
-                        if (!isOKToOptimize(m_graph[node.child1()]))
-                            break;
-                        
-                        m_graph.deref(node.child1());
-                        node.children.child1() = node.children.child2();
-                        node.children.child2() = Edge();
-                        node.setOpAndDefaultFlags(GetMyArgumentByVal);
-                        changed = true;
-                        --indexInBlock; // Force reconsideration of this op now that it's a GetMyArgumentByVal.
-                        break;
-                    }
+                    m_graph.deref(node.child1());
+                    node.children.child1() = node.children.child2();
+                    node.children.child2() = Edge();
+                    node.setOpAndDefaultFlags(GetMyArgumentByVal);
+                    changed = true;
+                    --indexInBlock; // Force reconsideration of this op now that it's a GetMyArgumentByVal.
                     break;
                 }
                     
-                case GetArgumentsLength: {
+                case GetArrayLength: {
+                    if (node.arrayMode() != Array::Arguments)
+                        break;
+                    
                     if (!isOKToOptimize(m_graph[node.child1()]))
                         break;