This will make it wrong. However, the reason I think it's correct just by the skin of its teeth today because we'll end up always flattening all structures in the prototype chain. Looking at normalizePrototypeChain, things might break with a JSProxy in the prototype chain. The reason things barely work today is I think that "hasBeenFlattenedBefore()" will always return false when you're a dictionary. The reason being, when we create a structure via its transition constructor, we don't propagate forward the "hasBeenFlattenedBefore" bit. The only way to make a dictionary structure is via a transition, hence, it'll never have that bit set. So, every time we ask a dictionary structure "hasBeenFlattenedBefore", it'll say no.
I'm testing this hypothesis now by running all JSC stress tests with a CRASH() if hasBeenFlattenedBefore() ever returns true.
Created attachment 321996 [details] patch
I'm going to run benchmarks before landing
Comment on attachment 321996 [details] patch r=me
Created attachment 322027 [details] perf results Neutral or perhaps 0.5% progressed.
Comment on attachment 321996 [details] patch Clearing flags on attachment: 321996 Committed r222590: <http://trac.webkit.org/changeset/222590>
All reviewed patches have been landed. Closing bug.
<rdar://problem/34702967>