SpiderMonkey

From Vero - Wikipedia
Jump to navigation Jump to search

Template:Short description Template:About Template:Use dmy dates Template:Infobox software

SpiderMonkey is an open-source JavaScript and WebAssembly engine by the Mozilla Foundation.<ref>Template:Cite web</ref> The engine powers the Firefox Web browser and has used multiple generations of JavaScript just-in-time (JIT) compilers, including TraceMonkey, JägerMonkey, IonMonkey, and the current WarpMonkey.

It is the first JavaScript engine, written by Brendan Eich at Netscape Communications, and later released as open source and currently maintained by the Mozilla Foundation. Its design allows it to be embedded in applications beyond Web browsers, with implementations including MongoDB database system, Adobe Acrobat, and the GNOME desktop environment.

History

Eich "wrote JavaScript in ten days" in 1995,<ref name=BE201106> Template:Cite web </ref> having been "recruited to Netscape with the promise of 'doing Scheme' in the browser".<ref name=BE200804> Template:Cite web </ref> (The idea of using Scheme was abandoned when "engineering management [decided] that the language must 'look like JavaTemplate:'".)<ref name=BE200804/> In late 1996, Eich, needing to "pay off [the] substantial technical debt" left from the first year, "stayed home for two weeks to rewrite Mocha as the codebase that became known as SpiderMonkey".<ref name=BE201106/> (Mocha was the original working name for the language.)<ref name="BE200804" /><ref name=BE201108> Template:Cite web </ref> In 2011, Eich transferred management of the SpiderMonkey code to Dave Mandelin.<ref name=BE201106/>

Versions

Template:See also

SpiderMonkey version history
Version Release date ECMAScript version Browser version Added functionality<ref name="js20">Template:Cite journal</ref><ref>Template:Cite web</ref><ref>https://web.archive.org/web/20140829071706/https://developer.mozilla.org/en-US/docs/Web/JavaScript/New_in_JavaScript/1.5</ref><ref>http://www.jsdb.org/jsguide/intro.html#1023167</ref><ref>Template:Cite web</ref>
scope="row" Template:Version
(Mocha) 		September 1995<ref name="js20" /> Netscape Navigator 2.0b1<ref>Template:Cite web (The first beta version with JavaScript support, marketed as LiveScript at that point.)</ref>
  • Basic syntax mostly from C, >>> (unsigned shift) from Java, for-in statement and function declaration from AWK.<ref name="js20" />
  • var, with, this, obj.prop and obj[prop] syntax, automatic semicolon insertion, <!-- comments.
  • number, string, boolean, object and function types; undefined and null
  • Object, String, Date classes and methods, Math object, eval(), parseInt(), parseFloat(), isNaN()
  • Function's arguments property (quirk: merely an alias for the function object)
scope="row" Template:Version
(Mocha) 		August 1996 Basis for ES1 Netscape Navigator 3.0
  • Finished originally envisioned language design that was cut short due to Netscape Navigator 2.0's feature freeze.<ref name="js20" />
  • prototype-based inheritance (from Self) via function's prototype property.
  • typeof, void and delete var operators.
  • Array, Boolean, Function, Number, String classes.
  • Automatic type coercions. Wrapper objects when accessing a primitive's property.
scope="row" Template:Version June 1997 Basis for ES3 Netscape Navigator 4.0-4.05
  • New engine codenamed "SpiderMonkey", replacing the original Mocha.
  • Regular expressions, function expressions, nested functions.
  • do-while, switch, statement labels, break/continue with label, delete obj.prop, __proto__ pseudo-property.
  • Array ([...]), Object ({prop: ...}) and RegExp (/.../) literals.
  • Array methods: push, pop, shift, splice, unshift, concat, slice
  • String methods: charCodeAt, fromCharCode, match, replace, search, substr
  • Function and arguments are distinct objects, arguments.callee, function's arity property.
  • Non-standard: removed automatic coercions for == (restored in 1.3), watch()/unwatch(), import/export statements and signed scripts.
scope="row" Template:Version October 1998 ES1 + ES2
(compliant with the standard)		 Netscape Navigator 4.06-4.7x
scope="row" Template:Version Netscape Server
  • try-catch-finally statement, in and instanceof operators.
  • No indirect eval() (later reverted), removed Object.prototype.eval().
  • Function's arguments property is now a variable. arity property deprecated in favor of length.
scope="row" Template:Version November 2000 ES3 Netscape Navigator 6, Firefox 1.0
  • ES3 features: runtime errors reported as exceptions, regex enhancements (non-greedy quantifiers, non-capturing groups, lookahead assertions, m flag), Number formatting methods (toExponential, toFixed, toPrecision)
  • Getters and setters.
  • Multiple catch clauses in try-catch.
  • Functions can be declared inside an expression and if clause.
  • const declaration (not part of ES3, adopted in ES6)
scope="row" Template:Version November 2005 E4X Firefox 1.5
  • Array methods: indexOf, lastIndexOf, every, filter, forEach, map, some
  • Array and String generics
  • E4X and for each...in statement
scope="row" Template:Version October 2006 Firefox 2.0
  • Iterators and generators, for...of, yield, let statement, destructuring assignment.
  • Non-standard: array comprehensions.
scope="row" Template:Version June 2008 Firefox 3.0
  • Array methods: reduce, reduceRight
  • Non-standard: expression closures and generator comprehensions.
scope="row" Template:Version June 2009 Firefox 3.5<ref>Template:Cite web</ref>
  • TraceMonkey: tracing JIT<ref name="tracemonkey" />
  • JSON support, Object.getPrototypeOf(), String methods: trim, trimLeft, trimRight, startsWith.
  • Switched to C++ from plain C for building the engine.
scope="row" Template:Version March 2011 ES5 Firefox 4.0<ref>Template:Cite web</ref>
  • JägerMonkey: method JIT
  • Object manipulation and protection methods, Array.isArray(), Date.prototype.toJSON(), Function.prototype.bind()
  • Strict mode
  • Trailing comma not accepted by JSON.parse()
  • Proxy class and typed arrays (not part of ES5, adopted in ES6)
scope="row" Template:Version January 2012 Firefox 10.0
  • Regular expressions object no longer callable, Function.prototype.isGenerator() method (in 5.0).
  • ES6 WeakMap (in 6.0)
  • Function.arity removed (in 7.0)
  • E4X deprecated (in 10.0)
scope="row" Template:Version November 2012 Firefox 17.0
  • ArrayBuffer.prototype.slice() (in 12.0)
  • ES6 for...of and Map/Set (in 13.0)
  • ES6 default and rest parameters, new Number methods, DataView interface (in 15.0)
  • ES6 spread operator for array initializers (in 16.0)
  • String methods: startsWith, endsWith, contains. Iterator improvements. E4X disabled for web (in 17.0)
scope="row" Template:Version September 2013 Firefox 24.0
  • IonMonkey: optimizing JIT compiler (in 18.0)<ref name="ff18" />
  • ES6 Proxy, String.prototype.contains() method (in 18.0),
  • for each...in deprecated, Math.imul() (in 20.0)
  • Map/Set methods: keys, values, entries (in 20.0/24.0)
  • E4X removed, parseInt no longer treats strings with leading "0" as octal (in 21.0)
  • ES6 arrow functions, Object.is() (in 22.0)
  • OdinMonkey: asm.js optimization module (in 22.0)
scope="row" Template:Version July 2014 Firefox 31.0
scope="row" Template:Version May 2015 Firefox 38.0
scope="row" Template:Version March 2016 Firefox 45.0
scope="row" Template:Version March 2017 ES6 Firefox 52.0
scope="row" Template:Version May 2018 Firefox 60.0
scope="row" Template:Version July 2019 Firefox 68.0
scope="row" Template:Version June 2020 Firefox 78.0
scope="row" Template:Version August 2021 Firefox 91.0
  • WarpMonkey JIT replaced IonMonkey in 83.0.<ref name="ff83" />
scope="row" Template:Version June 2022 Firefox 102.0
scope="row" Template:Version July 2022 Firefox 103.0
scope="row" Template:Version September 2024<ref>Template:Cite web</ref> Firefox 131.0
Template:Version

Standards

SpiderMonkey implements the ECMA-262 specification (ECMAScript). ECMA-357 (ECMAScript for XML (E4X)) was dropped in early 2013.<ref>Template:Cite web</ref>

Internals

SpiderMonkey is written in C/C++ and contains an interpreter, the WarpMonkey JIT compiler, and a garbage collector.

TraceMonkey

TraceMonkey<ref name="tracemonkey">Template:Cite web</ref> was the first JIT compiler written for the JavaScript language. Initially introduced as an option in a beta release and introduced in Brendan Eich's blog on August 23, 2008,<ref>Template:Cite web</ref> the compiler became part of the mainline release as part of SpiderMonkey in Firefox 3.5, providing "performance improvements ranging between 20 and 40 times faster" than the baseline interpreter in Firefox 3.<ref>Template:Cite web</ref>

Instead of compiling whole functions, TraceMonkey was a tracing JIT, which operates by recording control flow and data types during interpreter execution. This data then informed the construction of trace trees, highly specialized paths of native code.

Improvements to JägerMonkey eventually made TraceMonkey obsolete, especially with the development of the SpiderMonkey type inference engine. TraceMonkey is absent from SpiderMonkey from Firefox 11 onward.<ref>Template:Cite web</ref>

JägerMonkey

JägerMonkey, internally named MethodJIT, was a whole-method JIT compiler designed to improve performance in cases where TraceMonkey could not generate stable native code.<ref>Template:Cite web</ref><ref name="hunted">Template:Cite web</ref> It was first released in Firefox 4 and eventually entirely supplanted TraceMonkey. It has itself been replaced by IonMonkey.

JägerMonkey operated very differently from other compilers in its class: While typical compilers worked by constructing and optimizing a control-flow graph representing the function, JägerMonkey instead operated by iterating linearly forward through SpiderMonkey bytecode, the internal function representation. Although this prohibits optimizations that require instruction reordering, JägerMonkey compiling has the advantage of being very fast, which is useful for JavaScript since recompiling due to changing variable types is frequent.

Mozilla implemented a number of critical optimizations in JägerMonkey, most importantly polymorphic inline caches and type inference.<ref>Template:Cite web</ref>

The difference between TraceMonkey and JägerMonkey JIT techniques and the need for both was explained in a hacks.mozilla.org article. A more in-depth explanation of the technical details was provided by Chris Leary, one of SpiderMonkey's developers, in a blog post Template:Webarchive. More technical information can be found in other developer's blogs: dvander, dmandelin.

IonMonkey

IonMonkey was a JavaScript JIT compiler of Mozilla, which was aimed to enable many new optimizations that were impossible with the prior JägerMonkey architecture.<ref name="mozilla1">Template:Cite web</ref>

IonMonkey was a more traditional compiler: it translated SpiderMonkey bytecode into a control-flow graph, using static single assignment form (SSA) for the intermediate representation. This architecture enabled well-known optimizations from other programming languages to be used for JavaScript, including type specialization, function inlining, linear-scan register allocation, dead code elimination, and loop-invariant code motion.<ref>Template:Cite web</ref>

The compiler can emit fast native code translations of JavaScript functions on the ARM, x86, and x86-64 platforms. It has been the default engine since Firefox 18.<ref name="ff18">Template:Cite web</ref>

OdinMonkey

OdinMonkey is the name of Mozilla's new optimization module for asm.js, an easily compilable subset of JavaScript. OdinMonkey itself is not a JIT compiler, it uses the current JIT compiler. It's included with Firefox from release 22.<ref name="ff22">Template:Cite web</ref>

WarpMonkey

The WarpMonkey JIT replaces the former IonMonkey engine from version 83.<ref name="ff83">Template:Cite web</ref> It is able to inline other scripts and specialize code based on the data and arguments being processed. It translates the bytecode and Inline Cache data into a Mid-level Intermediate Representation (Ion MIR) representation. This graph is transformed and optimized before being lowered to a Low-level Intermediate Representation (Ion LIR). This LIR performs register allocation and then generates native machine code in a process called Code Generation. The optimizations here assume that a script continues to see data similar what has been seen before. The Baseline JITs are essential to success here because they generate ICs that match observed data. If after a script is compiled with Warp, it encounters data that it is not prepared to handle it performs a bailout. The bailout mechanism reconstructs the native machine stack frame to match the layout used by the Baseline Interpreter and then branches to that interpreter as though we were running it all along. Building this stack frame may use special side-table saved by Warp to reconstruct values that are not otherwise available.<ref>Template:Cite web</ref>

Use

SpiderMonkey is intended to be embedded in other applications that provide host environments for JavaScript. An incomplete list follows:

SpiderMonkey includes a JavaScript Shell for interactive JavaScript development and for command-line invocation of JavaScript program files.<ref>Template:Cite web</ref>

See also

Template:Portal

References

Template:Reflist

Template:Mozilla Template:ECMAScript

Retrieved from "https://wiki.sarg.dev/index.php?title=SpiderMonkey&oldid=133692"