[V8OnInstance] means that the method should be defined (not on a prototype chain but) on a DOM object. It is the same meaning as [V8Unforgeable]. We can replace [V8OnInstance] with [V8Unforgeable].
Created attachment 127576 [details] Patch
Comment on attachment 127576 [details] Patch Clearing flags on attachment: 127576 Committed r108149: <http://trac.webkit.org/changeset/108149>
All reviewed patches have been landed. Closing bug.