Our current Shape tree design has a number of flaws. Most importantly:

• Memory usage: 6 words (48 bytes) per property on 64-bit platforms is a lot. More information could be shared.
• Performance: megamorphic lookups are very hot for modern JS code. The Shape tree is effectively a linked list so there's a lot of pointer chasing, this doesn't work well with CPU caches.
• Complexity: the Shape tree conflates object state (BaseShape, ObjectFlags) with property information; is biased towards native objects.

The goal of this bug is to experiment with a separate data structure that stores the property information. Shape would then just point to this. This data structure could then be shared across realms/compartments in a zone, resulting in memory usage improvements. It would store properties as (short) arrays instead of linked lists so it should work better with CPU cache lines too.

Bug 1700052 landed last week and moved the getter/setter objects out of shapes. That was the main blocker for this: we're now mostly happy with the data and invariants implied by a Shape. This bug can now change how Shapes are implemented under the hood without affecting what a Shape implies.

I have a working prototype for this that has pretty good memory usage numbers: about 70 KB (3%) less on AWSY-Base-JS, and it more than halves our shape memory on most pages.

Unscientific pair-wise comparison of AWSY-tp6-fission results: https://jandem.github.io/reshape/fission-memory.htm