SpiderMonkey Internals

SpiderMonkey is the JavaScript engine used in Firefox, originally written by Brendan Eich. It has evolved into a multi-tiered JIT (Just-In-Time) compiler beast.

The Pipeline: From Code to Machine Code

Modern JS engines don't just "interpret" code line-by-line. They use a tiered approach to balance startup speed vs. peak execution performance.

1. Parsing & Bytecode

First, the source code is parsed into an AST (Abstract Syntax Tree). This is then compiled into Bytecode. Bytecode is a platform-independent representation of the script.

2. The C++ Interpreter

SpiderMonkey starts by interpreting this bytecode. This is slow but has zero compilation overhead, ensuring the page starts running immediately.

3. Baseline Interpreter & JIT

If a function runs frequently ("hot"), it gets promoted.

• Baseline Interpreter: A highly optimized template interpreter.
• Baseline JIT: Compiles bytecode into quick-and-dirty native machine code. It collects Type Information (e.g., "this variable is always an Integer") which is crucial for the next step.

4. WarpMonkey (Optimizing JIT)

Previously known as IonMonkey, the optimizing tier is now powered by Warp. It takes the Type Information (IC - Inline Caches) gathered by the Baseline tier and generates highly optimized machine code.

It performs aggressive optimizations like:

• Inlining: Replacing function calls with the function body.
• Dead Code Elimination: Removing code that doesn't affect the output.
• Bounds Check Elimination: Removing array index checks if safety is proven.

If an assumption fails (e.g., a variable suddenly becomes a String instead of an Int), the engine performs a Bailout, de-optimizing back to the interpreter.

Garbage Collection (GC)

SpiderMonkey uses a sophisticated Garbage Collector to manage memory.

• Generational GC (Nursery): New objects are allocated in a "Nursery". Most objects die young. Collecting the nursery is extremely fast and happens frequently.
• Incremental GC: Instead of pausing the browser for 500ms to clean up the "Tenured" (old) heap, the GC breaks the work into tiny slices (e.g., 5-10ms) interleaved with JavaScript execution.
• Compacting GC: It moves live objects together to reduce fragmentation.