4 files changed, 24 insertions, 14 deletions
diff --git a/Source/JavaScriptCore/llint/LLIntCommon.h b/Source/JavaScriptCore/llint/LLIntCommon.h
index 6b908eae2..1797ff02e 100644
--- a/Source/JavaScriptCore/llint/LLIntCommon.h
+++ b/Source/JavaScriptCore/llint/LLIntCommon.h
@@ -36,6 +36,9 @@
 // how the GC allocates.
 #define LLINT_ALWAYS_ALLOCATE_SLOW 0
 
+// Disable inline caching of get_by_id and put_by_id.
+#define LLINT_ALWAYS_ACCESS_SLOW 0
+
 // Enable OSR into the JIT. Disabling this while the LLInt is enabled effectively
 // turns off all JIT'ing, since in LLInt's parlance, OSR subsumes any form of JIT
 // invocation.
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index fbc0146b8..d2d743e0a 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -883,7 +883,8 @@ LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
     LLINT_CHECK_EXCEPTION();
     LLINT_OP(1) = result;
 
-    if (baseValue.isCell()
+    if (!LLINT_ALWAYS_ACCESS_SLOW
+        && baseValue.isCell()
         && slot.isCacheable()
         && slot.slotBase() == baseValue
         && slot.cachedPropertyType() == PropertySlot::Value) {
@@ -935,7 +936,8 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
         baseValue.put(exec, ident, LLINT_OP_C(3).jsValue(), slot);
     LLINT_CHECK_EXCEPTION();
     
-    if (baseValue.isCell()
+    if (!LLINT_ALWAYS_ACCESS_SLOW
+        && baseValue.isCell()
         && slot.isCacheable()) {
         
         JSCell* baseCell = baseValue.asCell();
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index 513b742ee..b8115dd6b 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -921,20 +921,22 @@ _llint_op_is_string:
 
 macro loadPropertyAtVariableOffsetKnownNotFinal(propertyOffset, objectAndStorage, tag, payload)
     assert(macro (ok) bigteq propertyOffset, InlineStorageCapacity, ok end)
+    negi propertyOffset
     loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
-    loadi TagOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], tag
-    loadi PayloadOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], payload
+    loadi TagOffset + (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffset, 8], tag
+    loadi PayloadOffset + (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffset, 8], payload
 end
 
 macro loadPropertyAtVariableOffset(propertyOffset, objectAndStorage, tag, payload)
     bilt propertyOffset, InlineStorageCapacity, .isInline
     loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
+    negi propertyOffset
     jmp .ready
 .isInline:
-    addp JSFinalObject::m_inlineStorage + InlineStorageCapacity * 8, objectAndStorage
+    addp JSFinalObject::m_inlineStorage - (InlineStorageCapacity - 2) * 8, objectAndStorage
 .ready:
-    loadi TagOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], tag
-    loadi PayloadOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], payload
+    loadi TagOffset + (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffset, 8], tag
+    loadi PayloadOffset + (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffset, 8], payload
 end
 
 macro resolveGlobal(size, slow)
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index b976421f0..6e752a6d0 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -778,20 +778,23 @@ _llint_op_is_string:
     dispatch(3)
 
 
-macro loadPropertyAtVariableOffsetKnownNotFinal(propertyOffset, objectAndStorage, value)
-    assert(macro (ok) bigteq propertyOffset, InlineStorageCapacity, ok end)
+macro loadPropertyAtVariableOffsetKnownNotFinal(propertyOffsetAsPointer, objectAndStorage, value)
+    assert(macro (ok) bigteq propertyOffsetAsPointer, InlineStorageCapacity, ok end)
+    negp propertyOffsetAsPointer
     loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
-    loadp -8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], value
+    loadp (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffsetAsPointer, 8], value
 end
 
-macro loadPropertyAtVariableOffset(propertyOffset, objectAndStorage, value)
-    bilt propertyOffset, InlineStorageCapacity, .isInline
+macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
+    bilt propertyOffsetAsInt, InlineStorageCapacity, .isInline
     loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
+    negi propertyOffsetAsInt
+    sxi2p propertyOffsetAsInt, propertyOffsetAsInt
     jmp .ready
 .isInline:
-    addp JSFinalObject::m_inlineStorage + InlineStorageCapacity * 8, objectAndStorage
+    addp JSFinalObject::m_inlineStorage - (InlineStorageCapacity - 2) * 8, objectAndStorage
 .ready:
-    loadp -8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], value
+    loadp (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8], value
 end
 
 macro resolveGlobal(size, slow)