SpiderMonkey's Inline Caches: Beyond Simple Caching

2025-09-14

This post delves into the implementation of inline caching (IC) within the SpiderMonkey JavaScript engine. Unlike traditional caching, SpiderMonkey's IC is a self-modifying code technique. It inserts a series of stubs at call sites, dynamically selecting efficient execution paths based on input types. The first call executes a fallback path and generates corresponding stubs based on the result. Subsequent calls of the same type hit the cache, significantly improving efficiency. The article uses JavaScript addition as an example to explain how IC works, and mentions SpiderMonkey's latest CacheIR architecture, which abstracts the details of ICs to enable sharing between different compilers.

Read more
Development inline caching

Tracing Firefox Memory Allocation with eBPF

2025-05-31

The author used eBPF (extended Berkeley Packet Filter) to trace memory allocation in SpiderMonkey, Firefox's JavaScript engine. The initial goal was to pinpoint the source locations of frequent Rooted object creations for memory management optimization. Using the bpftrace tool and user probes (uprobes), the author successfully traced the `registerWithRootLists` function and utilized the ustack function to get call stack information. Ultimately, the author generated reports and filed several bug reports, optimizing memory allocation and reducing tens of millions of calls to `registerWithRootLists`.

Read more
Development