Instead of having a separate table of JSWatchPoint structures, js::Shape should acquire a new field, a JSObject * referring to the handler passed to Object.prototype.watch. The presence and identity of this handler should be treated as part of the shape identity, so that setting a watchpoint on a property alerts the tracer and ICs that special treatment is needed. Thus, the watchpoint handler field would only need to be checked on the slow paths: property cache misses; generating code in the tracer; IC misses in JM. Bug 602139 adds a host of new tests for watchpoints that demonstrate the foibles of our current design. Some blockers of bug 609924 point out other troubles.

This is going to bloat shapes from 8 to 9 words on 64-bit systems, from 10 to 11 on 32-bit. Just in case a property is being watched. Seems excessive unless you can find a way to union harder. /be