How Javascript Engines access/lookup property names?

Question

How Javascript Engines access/lookup property names? what kind of associative array (data structure or search/lookup algorithm) did they use? (for V8, TraceMonkey, JSC, and Rhino)

For example, in C++ there are map and unordered_map that uses (mostly) RB-Tree and Hash Table, but what for JavaScript Object/{} what kind of associative array did the use for each engine?

Or maybe more specific, how they store a JSON object internally?

Some answers that I've found, in V8, they use additional Hash Table (slide 45)

Answer 1

JIT compilation tracing techniques often make "hot" objects transformed into instances of hidden (and dynamically created) classes or structures, for which property access becomes as fast as field access in a C struct