JavaScript Core Butterfly & StorageType

   +-------------------------------------------------------------+
   | Type                   | Elements	 | Properties  | Inlines |
   +-------------------------------------------------------------+
   | ArrayWithContiguous    | JSValue    | JSValue     | None    |
   | ArrayWithInt32         | JSValue    | JSValue     | None    |
   | ArrayWithDouble        | Double     | JSValue     | None    |
   | NonArrayWithDouble	    | Double     | JSValue     | JSValue |
   | NonArrayWithInt32      | JSValue    | JSValue     | JSValue |
   | NonArrayWithContiguous | JSValue    | JSValue     | JSValue |
   +-------------------------------------------------------------+


     64bit         64bit                 64bit         64bit
+-------------+-------------+       +-------------+-------------+
| JSCell      | Butterfly   +---+   | property[2] | property[1] |
+---------------------------+   |   +---------------------------+
| inline[0]   | inline[1]   |   |   | property[0] | length *    |
+---------------------------+   |   +---------------------------+
| inline[2]   | inline[3]   |   +-->+ element[0]  | element[1]  |
+---------------------------+       +---------------------------+
| inline[4]   | inline[5]   |       | element[2]  | element[3]  |
+-------------+-------------+       +-------------+-------------+

                                                   * of elements
JSCell:
+---------------+
|7|6|5|4|3|2|1|0| <--+ 4bytes: StructureID
++-+-+-+--------+
 | | | |
 | | | |            +-------------------------------------------+
 | | | +----------->+ IndexingType                              |
 | | |              +-------------------------------------------+
 | | |              |   Bit[0]:	  isArray                       |
 | | |              |   Bit[1-3]: shape (Double, Contiguous, …) |
 | | |              |   Bit[4]:   CopyOnWrite                   |
 | | |              |   Bit[6-7]: cellLockBits                  |
 | | |              |   Bit[5]:	  mayHaveIndexedAccessors       |
 | | |              +-------------------------------------------+
 | | |
 | | |              +----------------------------------+
 | | +------------->+ JSType                           |
 | |                +----------------------------------+
 | |                |   enum { kJSTypeUndefined,       |
 | |                |   kJSTypeNull, kJSTypeBoolean,   |
 | |                |   kJSTypeNumber, kJSTypeString,  |
 | |                |   kJSTypeObject, kJSTypeSymbol } |
 | |                +----------------------------------+
 | |
 | |                +----------------------------------------+
 | +--------------->+ Inline flags                           |
 |                  +----------------------------------------+
 |                  |   Bit[0]: MasqueradeAsUndefined        |
 |                  |   Bit[1]: ImplementsDefaultHasInstance |
 |                  |   Bit[2]: OverridesGetCallData         |
 |                  |   Bit[3]: OverridesGetOwnPropertySlot  |
 |                  |   Bit[4]: OverridesToThis              |
 |                  |   Bit[5]: HasStaticPropertyTable       |
 |                  |   Bit[6]: undefined                    |
 |                  |   Bit[7]: TypeInfoMayBeProdotoype      |
 |                  +----------------------------------------+
 |
 |                  +-----------------------+
 +----------------->+ CellState             |
                    +-----------------------+
                    |   PossiblyBlack   = 0 |
                    |   DefinitelyWhite = 1 |
                    +-----------------------+