Brendan saw this in a JSC bug (bugs.webkit.org/show_bug.cgi?id=89622). This game: http://bigsword.sinaapp.com/game.html seems to create 114MB of dictionary shapes and 32MB of dictionary tables for 30MB of objects. v8 seems to create 34MB total so it would seem like there is some specific thing SM is missing that is preventing a ton of objects from reusing shapes in the property tree.

A quick glance at Chrome's memory snapshot tool seems to indicate most of the memory is in arrays. That would perhaps indicate that our lack of named properties on dense arrays is what is killing us. Waldo: I cannot for the life of me get bugzilla to give me the dense/sparse slots bug. I'd like to block this on it, pending confirmation that slow arrays are actually the problem here.

bug 586842 maybe?

Bug 827490 just landed. Does it help?

The URL is no longer valid. I got a warning screen in Chinese, which Google Translate translates to: You access the website failure You visit the site exceeds the quota, may be caused by the following reasons: 1 the site Yundou depleted; The site of more than a minute quota; 3. "Budget set" too low. After a few seconds it redirected me to http://yunshangdian.com/?c=wiki&page=intro. I will mark this INCOMPLETE. We have numerous similar bugs blocking bug 586842, so we don't really need this one.