These can all be de-virtualized by augmenting JSType with additional types.
Created attachment 112732 [details]
Comment on attachment 112732 [details]
View in context: https://bugs.webkit.org/attachment.cgi?id=112732&action=review
Seems like TypeInfo should eventually move to being specified in ClassInfo, even if a copy is cached in Structure. More elegant to specify TypeInfo declaratively, instead of through a bunch of function call arguments.
> + // VariableObjectType must be greater than all of the types of its subclasses.
Committed r98747: <http://trac.webkit.org/changeset/98747>