From fc5d0a1bd2d4f07361853757956f8cb926ca6ba9 Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Tue, 5 May 2020 18:48:30 +0200 Subject: [PATCH] LibJS: Switch objects to unique shape after 100 property additions At that point, it seems unlikely that the shape is gonna be shared with other objects, and we avoid getting stuck holding a big bag of shapes. --- Libraries/LibJS/Runtime/Object.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Libraries/LibJS/Runtime/Object.cpp b/Libraries/LibJS/Runtime/Object.cpp index a9ad694d90..d5a30a3086 100644 --- a/Libraries/LibJS/Runtime/Object.cpp +++ b/Libraries/LibJS/Runtime/Object.cpp @@ -212,6 +212,12 @@ bool Object::put_own_property(Object& this_object, const FlyString& property_nam bool new_property = !metadata.has_value(); if (new_property) { + if (!m_shape->is_unique() && shape().property_count() > 100) { + // If you add more than 100 properties to an object, let's stop doing + // transitions to avoid filling up the heap with shapes. + ensure_shape_is_unique(); + } + if (m_shape->is_unique()) { m_shape->add_property_to_unique_shape(property_name, attributes); m_storage.resize(m_shape->property_count());