Created attachment 552318 [details] [diff] [review] WIP 1 This patch goes on top of a bunch of other stuff. It works! ...when the JSNative follows the rules. Unfortunately the very first native function I wrote a test for, Array.prototype.join, doesn't. I've talked to Luke and I think I have a decent plan for detecting when a function overwrites the callee too soon, but it'll be a week or two.