Skip to content

Conversation

@awesomekling
Copy link
Member

@awesomekling awesomekling commented Jan 7, 2026

If we call put() directly on the underlying indexed property storage like we were doing here, we skip the checks that switch from flat to sparse property storage when a huge index is suddenly accessed.

This was caught by folks hitting memory issues when running test-js.

Fixes #7365

It's harmless if the WeakRef is asked to remove dead cells when it has
no dead cells to remove. This can happen if the WeakRef lives longer
due to someone referencing it. Caught by test-js with different GC
frequency.
If we call put() directly on the underlying indexed property storage
like we were doing here, we skip the checks that switch from flat to
sparse property storage when a huge index is suddenly accessed.

This was caught by folks hitting memory issues when running test-js.
Copy link
Contributor

@trflynn89 trflynn89 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes #7365

@trflynn89 trflynn89 enabled auto-merge (rebase) January 7, 2026 12:29
@trflynn89 trflynn89 merged commit 7a4e74b into LadybirdBrowser:master Jan 7, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Crash when resizing array with polluted prototype

2 participants