This optimization has no effect if Spectre mitigations are enabled, due to MSpectreMaskIndex.

Furthermore, it doesn't know about MInt32ToIntPtr. I tried to fix this and it works on a local test case, but I couldn't get it to trigger on any jit-tests (tested with MOZ_CRASH + running jit-tests with various shell flags) or Octane. All of this with Spectre mitigations off.

It's possible this optimization was more valuable with IonBuilder/TI because it was able to bake in the array length for asm.js style workloads.

The WIP patch works for this test case, with --spectre-mitigations=off:

function f(ta) {
    var res = 0;
    for (var i = 0; i < 3000; i++) {
        res += ta[i + 1] + ta[i + 2] + ta[i + 3];
    }
    return res;

}
var ta = new Int16Array(4 * 1024);
f(ta);