LibJS: Switch objects to unique shape after 100 property additions

At that point, it seems unlikely that the shape is gonna be shared with
other objects, and we avoid getting stuck holding a big bag of shapes.

1 files changed, 6 insertions, 0 deletions

diff --git a/Libraries/LibJS/Runtime/Object.cpp b/Libraries/LibJS/Runtime/Object.cpp
index a9ad694d90..d5a30a3086 100644
--- a/Libraries/LibJS/Runtime/Object.cpp
+++ b/Libraries/LibJS/Runtime/Object.cpp
@@ -212,6 +212,12 @@ bool Object::put_own_property(Object& this_object, const FlyString& property_nam
     bool new_property = !metadata.has_value();
 
     if (new_property) {
+        if (!m_shape->is_unique() && shape().property_count() > 100) {
+            // If you add more than 100 properties to an object, let's stop doing
+            // transitions to avoid filling up the heap with shapes.
+            ensure_shape_is_unique();
+        }
+
         if (m_shape->is_unique()) {
             m_shape->add_property_to_unique_shape(property_name, attributes);
             m_storage.resize(m_shape->property_count());