As they're prime targets for privilege escalation, achieving code control, etc, etc we should harden how we allocate JSFunctions and related objects by pushing them all into a separate subspace that is never used for any other object type. Targets are JFSunction and subclasses and *Executable*. This means that it will be marginally harder for an attacker to overwrite the executable linkage (still achievable, but would a bit more work to achieve control) Not super high priority as i'm not sure how useful this would be -- attacker would need to pivot from a separate object class to the function. The question is whether we consider that to be a meaningful increase in attack complexity.