Specifically, look at JSInjectedScriptHostPrototype, JSJavaScriptCallFramePrototype, and JSString. If the flag is not needed, maybe we can remove it and strengthen the overridesGetOwnPropertySlot() in Structure::validateflags().