SpiderMonkey Newsletter (Firefox 114-115)

[Jan de Mooij]

(This newsletter is also available on our blog.)

SpiderMonkey is the JavaScript engine used in Mozilla Firefox. This newsletter gives an overview of the JavaScript and WebAssembly work we’ve done as part of the Firefox 114 and 115 Nightly release cycles.

🚀 Performance

We’re working on improving performance for popular web frameworks such as React. We can’t list all of these improvements here, but the list below covers some of this work.

• We’ve landed more changes to improve the hit rate of the JIT megamorphic set-property cache.
• We’ve optimized unique ids for objects: we can now store them in the object’s slots instead of in the external hash table. We also inlined more of the lookup code.
• We added a JIT hints mechanism to cache information about Baseline JIT compilations within a process.
• We’ve added frame pointers to compiled regular expression code to improve performance profiles.
• We fixed a reported Wasm multi-threading performance issue on Apple M1 by using new ARM64 atomic instructions when available.
• We’ve ported Array.prototype.concat from self-hosted JS code to C++. The new implementation is a lot faster especially for arrays with many elements.
• We’ve also rewritten some regular expression builtins in C++. The fast paths we had for Ion are now also used in Baseline.
• We moved an optimization for constant global names like undefined from the JITs to the bytecode emitter, so that these are also optimized in the interpreters.
• We’ve simplified the nursery object allocation code more to make it easier to add a fast path for this.

👷🏽‍♀️ New features

• We’re shipping Array.fromAsync in Firefox 115.
• We’re also shipping the ‘Change Array By Copy proposal’ in Firefox 115.
• We’ve implemented the isWellFormed and toWellFormed functions for strings (disabled by default).

⚡ Wasm GC

High-level programming languages currently need to bring their own GC if they want to run on WebAssembly. This can result in memory leaks because it cannot collect cycles that form between browser objects and the Wasm code. The Wasm GC proposal adds struct and array types to Wasm so these languages can use the browser’s GC instead.

• We implemented function subtyping.
• We added new encodings for cast instructions.
• We optimized allocation of Wasm GC structs more.
• We implemented and optimized the generalized casting instructions

⚙️ Modernizing JS modules

We’re working on improving our implementation of modules. This includes supporting modules in Workers, adding support for Import Maps, and ESMification (replacing the JSM module system for Firefox internal JS code with standard ECMAScript modules).

• See the AreWeESMifiedYet website for the status of ESMification. As of this week, more than 90% of modules have been ESMified 🎉
• We’ve shipped worker modules in Firefox 114.

📚 Miscellaneous

• We’ve added support for more formats to the date parser, to fix web compatibility issues.
• We’ve removed the JSContext dependency for off-thread parsing and also for the JSON parser. This lets us parse JS and JSON on background threads with very little overhead.
• We’ve rewritten some C++ code to work around a CPU issue that caused Firefox crashes on Intel Atom D2000/N2000 CPUs.