Reorder short-circuit tests in ApplySpecialization to run cheapest first. Specifically, the Global.isBuiltinFunctionPrototypeApply() should come after all flag checks. Another cheap flag test that can short circuit more costly traversal (hasApply) is FunctionNode.needsArguments()