Reference for the acronyms and terms relevant to JavaScript engine internals and vulnerability research. Organized by universal concepts (compiler theory, memory management, engine core) and engine-specific vocabulary (V8, JSC, SpiderMonkey).
IR — Intermediate Representation. Any structured form of code between the source and the emitted machine code. Every JIT tier has its own IR.
AST — Abstract Syntax Tree. The parsed form of source code, before any lowering. The first IR every engine builds.
Bytecode. A compact linear IR interpreted or fed into a baseline JIT. V8 uses Ignition bytecode; JSC uses LLInt bytecode; SpiderMonkey has its own.
SSA — Static Single Assignment. An IR form where every variable is assigned exactly once. Makes dataflow analysis and optimization tractable. Nearly every optimizing JIT normalizes to SSA before optimizing.
Phi node. An SSA construct at a control-flow merge point that selects a value based on which predecessor block executed. Alt names: Merge node, Select node. See also: Upsilon (JSC's alternative construction).
CFG — Control Flow Graph. The graph of basic blocks connected by branches. Every optimization walks the CFG.
Basic block. A straight-line sequence of instructions with a single entry and single exit. The unit of CFG nodes.
Sea of Nodes. A graph IR that mixes data and control dependencies as edges rather than separating them. Used by V8 TurboFan (originally from HotSpot).
JIT — Just-In-Time compiler. A compiler that emits machine code at runtime, based on observed types and behavior. Contrast: AOT (Ahead-Of-Time).
Tiering / speculative tier-up. Running code through progressively-more-optimizing compilers as it heats up. V8: Ignition → Sparkplug → Maglev → TurboFan.
Baseline compiler / baseline JIT. A fast non-optimizing JIT that emits machine code with minimal analysis. Used for warm code that isn't hot enough for the optimizer.
Optimizing compiler / optimizing JIT. The high-tier JIT that runs full optimization passes on hot code. Slower to compile but produces fast code.
Deoptimization / deopt / bailout. Abandoning the optimized machine code and returning to a lower tier (typically bytecode interpreter) when a type-speculation guard fails. The core mechanism enabling speculative optimization.
OSR — On-Stack Replacement. Swapping the running function to a different tier while it's executing on the stack, without waiting for it to return. Essential for tiering into loops that never exit.
Speculative optimization. Emitting fast code that assumes runtime types/shapes and inserts guards that deopt on assumption failure. The entire premise of modern JS JITs.
Inline cache (IC). A per-callsite cache of the last-seen shape/type at that site, used to skip generic property lookup. Feeds type feedback into higher tiers.
Type feedback / profiling. Runtime data collected by lower tiers about what shapes/types actually occur at each callsite. Consumed by the optimizing compiler.
Register allocation. Assigning IR virtual registers to real CPU registers. The heaviest backend pass.
Constant folding. Compile-time evaluation of expressions with constant operands.
CSE — Common Subexpression Elimination. Recognizing repeated computations and evaluating them once.
DCE — Dead Code Elimination. Removing computations whose results are never used.
LICM — Loop-Invariant Code Motion. Hoisting computations out of loops when they don't depend on the loop variable.
Escape analysis. Determining whether an object's lifetime is bounded by a function, so it can be allocated on the stack or scalar-replaced instead of on the heap.
Escaped object. An object determined by escape analysis to have a lifetime beyond the current function, forcing heap allocation.
Scalar replacement. Replacing an escape-analyzed object with its individual fields kept in registers, eliminating the allocation entirely.
Peephole optimization. Local rewrites of short instruction sequences into better ones during code emission.
Elimination phase. Any optimization pass that removes redundant IR nodes (DCE, CSE, dead-store elimination, etc.).
Node. A single operation in an IR graph. V8 TurboFan calls its IR nodes "Nodes"; JSC calls them "DFG Nodes"; SpiderMonkey has MIR Nodes.
GC — Garbage Collection. Automatic reclamation of unreachable objects. All major JS engines are garbage-collected.
Root set. The set of objects known to be alive without needing traversal — typically stack values, global variables, and registers. GC starts marking from the roots.
Marking. The phase where the collector traverses reachable objects and marks them alive.
Sweeping. The phase where the collector frees unmarked (unreachable) objects.
Mark and sweep. The classic GC algorithm: mark all reachable objects, sweep unmarked ones.
Mark-compact. Mark reachable objects, then compact them to eliminate fragmentation.
Copying collector. A collector that copies live objects into a fresh region and discards the source region wholesale. Cheney's algorithm is the canonical form.
Scavenger. The minor-GC (young generation) copying collector in V8 and SpiderMonkey.
Generational GC. Splits the heap into generations by object age. Young objects (nursery) are collected frequently and cheaply; old objects rarely.
Young / Old / Nursery / Tenured. Generational GC's two generations. Objects allocated in Young/Nursery; promoted to Old/Tenured if they survive one or more scavenges.
Liveness generation. The generational-GC boundary tracking which generation an object currently belongs to. Also: "age" of an object.
Store barrier / write barrier. Extra code emitted around memory writes that lets the collector stay correct under mutation. Records inter-generational pointers so the young-generation collector can find them.
Example: inline void WriteBarrier(Object* dst, Object* value) { if (Heap::IsInOldGen(dst) && Heap::IsInYoungGen(value)) RememberedSet::Insert(dst); *dst = value; }
Read barrier. Symmetric to write barrier — extra code around reads. Rare in JS engines; used by concurrent-compaction algorithms.
Remembered set. The data structure recording old-to-young pointers. Consulted during minor GC as additional roots.
Card marking. A cheap remembered-set implementation that tracks dirty regions ("cards") rather than individual pointers.
Incremental GC. GC interleaved with mutator work in small slices, to reduce pause times.
Concurrent GC. GC running in a separate thread while the mutator continues. Requires barriers to stay correct.
Parallel GC. GC using multiple threads to do the collection work in parallel while the mutator is paused.
Stop-the-world. A GC phase during which all mutator threads are paused. Every GC has at least a brief STW phase (for root scanning); reducing this is the point of incremental/concurrent designs.
Tri-color marking. Marking algorithm using three colors: white (unvisited), gray (visited but children not yet), black (visited and done). Enables concurrent marking with barriers to maintain the tri-color invariant.
Conservative GC. A collector that treats every stack/register slot as potentially a pointer, without a type map. Historically JSC used conservative marking of C++ stack values; most engines have moved to precise (rooted) marking for JS heap.
Weak reference. A pointer that doesn't keep its target alive. GC clears weak references to unreachable targets. Exposed to JS as WeakRef, WeakMap, WeakSet.
Handles. A double-indirection mechanism (pointer-to-pointer) that lets GC move the underlying object without invalidating references held by C++ code. All engines use handles for API interaction.
Arena / zone. A region of the heap that groups objects sharing a common lifetime, allowing bulk deallocation. SpiderMonkey uses "Zone" for its per-realm arenas.
Bump allocator. Allocation by incrementing a pointer. Extremely fast; used in the young generation.
Free list. Allocation by picking from a linked list of pre-sized free slots. Used for old-generation allocation.
TLAB — Thread-Local Allocation Buffer. A per-thread bump region, so allocations don't need atomic operations.
Allocation site. The source-code location where an object is allocated. Used for allocation-site feedback (predicting object shape).
Root scanning. The GC phase that walks the roots to find initially-live objects. Always stop-the-world.
Shape / Map / Structure / Hidden class. The runtime type descriptor for a JS object — records property names, offsets, and attributes. Objects with the same shape share the descriptor. Alt names by engine: V8: Map, JSC: Structure, SpiderMonkey: Shape.
Prototype. The [[Prototype]] link a JS object follows for inherited property lookup. Shape/Map records prototype identity, so prototype changes invalidate all shape-dependent optimizations.
Prototype chain. The linear chain of [[Prototype]] links a lookup traverses on missing property.
Property attributes. The three flags on each own property: writable, enumerable, configurable. Encoded in the shape.
Property access. The operation of loading or storing a named property. The hottest operation in JS; every engine has an inline cache system for it.
Realm. An ECMAScript spec construct encapsulating a global object and its intrinsics. Cross-realm object access is a source of many security-sensitive edge cases.
Compartment. A GC/heap partition. Objects in one compartment can't directly hold pointers to another. Used to enforce security boundaries (site isolation, iframe boundaries).
Realm-agnostic vs realm-tied. Whether an object's behavior depends on which realm created it. Cross-realm invariants are a bug source.
Feedback vector. V8's per-function struct holding inline-cache slots and type-feedback data. Consumed by tier-up compilers.
Bytecode array. An engine-specific data structure holding compiled bytecode for one function.
SFI — SharedFunctionInfo. V8's shareable-across-realms metadata for a JS function (source, bytecode, feedback). Multiple JSFunction instances can share one SFI.
Tagged pointer. A pointer with type-tag bits stolen from unused address bits. Enables representing small integers, booleans, and object pointers in a single machine word.
NaN-boxing. A tagged-value representation encoding integers/pointers into IEEE-754 double NaN bit patterns. Used by JSC and SpiderMonkey.
Smi — Small Integer. V8's tagged-integer representation: 31 or 32 bits stored inline in a pointer slot.
HeapObject. V8's term for any GC-allocated object (as opposed to Smi/inline).
Butterfly. JSC's split object storage layout: named properties grow leftward from a base pointer, indexed properties grow rightward. Enables shrink/grow without copying half the storage.
Group / ObjectGroup. SpiderMonkey's older type descriptor (largely superseded by Shape); tracked type-inference data at object granularity.
Slot. An individual property storage location on an object (in-object slot vs out-of-object/backing-store slot).
Pointer tagging. General term for any scheme encoding type info in pointer bits. Includes tagged pointers, NaN-boxing, Smi tagging.
Pointer compression. Storing 32-bit offsets from a base pointer instead of full 64-bit pointers, to halve heap object size. V8 uses this on 64-bit builds.
BigInt. Arbitrary-precision integer type added in ES2020. Every engine implements it as a heap-allocated variable-length object.
Wasm — WebAssembly. A separate bytecode/VM sharing the engine's runtime. V8 uses Liftoff (baseline) + TurboFan (optimizing); JSC uses BBQ + OMG; SpiderMonkey uses Baseline + Ion.
Ignition. V8's bytecode interpreter. First tier: executes bytecode directly, records type feedback.
Sparkplug. V8's baseline JIT (introduced 2021). Fast non-optimizing compiler that emits machine code directly from bytecode, with 1:1 bytecode-to-machine-code correspondence for easy OSR back to Ignition.
Maglev. V8's mid-tier optimizing JIT (introduced 2023). Faster to compile than TurboFan, produces medium-quality code. Sits between Sparkplug and TurboFan in the pipeline.
TurboFan. V8's high-tier optimizing compiler. Uses a Sea-of-Nodes IR. Being progressively replaced by Turboshaft.
Turboshaft. V8's next-generation optimizing compiler backend, replacing TurboFan piece by piece. Uses a more traditional CFG-of-basic-blocks IR.
Crankshaft. V8's original optimizing compiler (deprecated 2017), replaced by TurboFan. Historical reference only.
Hydrogen / Lithium. Crankshaft's IR layers (Hydrogen = high-level, Lithium = low-level). Deprecated.
Full-codegen. V8's original first-tier JIT (deprecated), replaced by Ignition + Sparkplug.
Torque. V8's DSL for writing builtins and runtime code, generates CSA (CodeStubAssembler) code. Type-safe, portable across architectures.
CSA — CodeStubAssembler. V8's portable assembler-like API for writing builtins. Compiled to native code at build time.
Orinoco. V8's GC architecture project name (the family of collectors: Scavenger for young, Mark-Compact for old, all with concurrent/parallel optimizations).
MinorMC. V8's minor mark-compact collector, an alternative to Scavenger for the young generation.
Isolate. V8's top-level runtime instance. Each isolate is an independent VM with its own heap, roots, and compilers. Chromium runs one isolate per renderer.
Context. V8's realm-equivalent within an isolate. Multiple contexts (realms) can share an isolate.
V8 Sandbox. V8's in-process memory sandbox restricting JIT-code memory access to a bounded region, so a JS engine bug can't easily reach arbitrary process memory. Enforces sandboxed-pointer discipline. See also: reference/browsers/chrome/mitigations/.
External pointer. A pointer from inside the V8 sandbox to memory outside it (e.g., to a C++ object). Sandboxed to enforce that JS code can't forge them.
Sandboxed pointer. A pointer constrained to the V8 sandbox region. Enforced by the compiler emitting bounds-checked accesses.
Trusted space. A heap region for objects whose integrity is trusted (e.g., bytecode arrays), separated from user-controllable objects.
Code space / RO space / large object space. V8's heap partitions by object kind: executable code, immutable read-only data, oversized allocations.
Optimized frame / deopt data. The metadata attached to a TurboFan-compiled function that lets the runtime reconstruct the bytecode-interpreter state at deopt.
Liftoff. V8's baseline Wasm compiler. Single-pass, no IR, fast compilation for startup.
JSFunction. The user-visible JS function object. Holds a pointer to a SFI (shared) and a feedback vector (instance-specific).
JSObject. V8's base class for all user-defined JS objects.
LLInt — Low-Level Interpreter. JSC's first tier: an assembly-language bytecode interpreter (yes, an interpreter written in assembly, generated via a JSC-internal DSL). Extremely fast for an interpreter.
Baseline JIT. JSC's second tier: a template-based JIT that emits code by concatenating precompiled snippets. Records profiling data for higher tiers.
DFG — Data Flow Graph. JSC's mid-tier optimizing JIT. Uses SSA over a DFG IR. Handles most speculative optimizations.
FTL — Faster Than Light. JSC's top-tier optimizing JIT. Originally used LLVM as its backend; now uses B3.
B3 — Bare Bones Backend. JSC's LLVM-replacement optimizing backend. Used by FTL and the Wasm OMG tier.
Air — Assembly IR. B3's low-level backend IR, close to machine code. Register allocation and instruction selection happen here.
Upsilon. JSC's alternative to standard Phi nodes: an Upsilon node in the predecessor block writes a value into a Phi in the successor. Enables SSA without dominator-tree recomputation on IR changes.
OSR entry / OSR exit. JSC's terms for tier-up (entering optimized code mid-execution) and deopt (exiting optimized code back to a lower tier).
Butterfly. JSC's split object storage layout (see Engine Core section).
Structure. JSC's Shape/Map equivalent (see Engine Core section).
Epoch. JSC's generational-GC boundary counter. Objects allocated in the current epoch are young; earlier epochs are old.
MarkedSpace / MarkedBlock. JSC's old-generation heap organization. MarkedSpace is the collection of MarkedBlocks (16 KB chunks) for old objects.
Eden / Nursery. JSC's young generation.
Handles. JSC's rooted-pointer mechanism (see Engine Core section).
LargeAllocation. JSC's separate space for objects too large for MarkedBlocks.
BBQ — Build Bytecode Quickly. JSC's baseline Wasm compiler.
OMG — Optimized Machine code Generator. JSC's optimizing Wasm compiler, uses B3.
JSCell. JSC's base class for all GC-allocated objects.
JSGlobalObject. JSC's realm/global object.
Interpreter. SpiderMonkey's C++ bytecode interpreter (baseline tier).
Baseline Interpreter. SpiderMonkey's newer intermediate tier introduced 2019 — a portable interpreter written in the JIT's IR that gets JIT-compiled once per bytecode instruction. Not to be confused with Baseline Compiler.
Baseline Compiler. SpiderMonkey's second-tier baseline JIT.
Ion / IonMonkey. SpiderMonkey's optimizing JIT. Uses MIR/LIR SSA IR.
Warp. SpiderMonkey's newer optimizing frontend to Ion (2020+), replacing the old TypeInference-based one. Uses CacheIR for type feedback.
CacheIR. SpiderMonkey's IR for inline caches. Recorded by ICs at runtime and consumed by Warp for optimization.
MIR — Middle-level IR. Ion's high-level SSA IR.
LIR — Low-level IR. Ion's post-lowering IR, close to machine code.
Trial inlining. Warp's mechanism for speculatively inlining and rolling back if the specialization doesn't pay off.
TraceMonkey. SpiderMonkey's original trace-based JIT (deprecated). Historical reference.
JaegerMonkey. SpiderMonkey's method-based JIT that replaced TraceMonkey (deprecated).
Nursery. SpiderMonkey's young generation.
Tenured heap. SpiderMonkey's old generation.
Zone. SpiderMonkey's per-realm heap partition (contains all objects for a realm).
Chunks. SpiderMonkey's 1 MB heap chunks that hold Arenas.
Arena. SpiderMonkey's 4 KB heap sub-allocation unit within a chunk, dedicated to one AllocKind.
AllocKind. SpiderMonkey's per-object-type categorization for allocation (object, string, symbol, etc.).
Compartment. SpiderMonkey's cross-realm boundary within a Zone. Multiple realms may share a compartment.
JSContext. SpiderMonkey's per-thread runtime state.
JSObject. SpiderMonkey's base class for user JS objects.
Shape. SpiderMonkey's property-descriptor structure (see Engine Core).
Group / ObjectGroup. SpiderMonkey's older type descriptor, largely superseded by Shape. Historical.
JITZone. SpiderMonkey's per-Zone JIT code and metadata.
V8 Inspector Protocol / CDP. The V8 debugging protocol used by Chrome DevTools. Not JS-engine internal but standard for interactive analysis.
--allow-natives-syntax. V8 command-line flag that enables %FunctionName() syntax in JS for calling V8 runtime intrinsics. Standard for exploitation testing and internal debugging.
--print-code / --print-opt-code. V8 flags to dump generated machine code, useful for JIT internals inspection.
d8. V8's standalone shell. The reference environment for JS engine exploration.
jsshell. SpiderMonkey's standalone shell.
jsc. JSC's standalone shell (yes, both the engine and the shell are called jsc).
Turbolizer. V8 TurboFan's graph visualizer. Reads dumped IR graphs and renders them interactively.