On the path to de-virtualizing the JSCell hierarchy, we come to isDynamicScope. This can be de-virtualized by using the type info contained in Structure.
Created attachment 114356 [details] Patch
Comment on attachment 114356 [details] Patch r=me
Comment on attachment 114356 [details] Patch Clearing flags on attachment: 114356 Committed r99768: <http://trac.webkit.org/changeset/99768>
All reviewed patches have been landed. Closing bug.