SpiderMonkey

SpiderMonkey is an open-source JavaScript and WebAssembly engine by the Mozilla Foundation. The engine powers the Firefox Web browser and has used multiple generations of JavaScript just-in-time (JIT) compilers, including TraceMonkey, JägerMonkey, IonMonkey, and the current WarpMonkey.

SpiderMonkey

Developers	Mozilla Foundation Mozilla Corporation
Repository	github.com/mozilla-firefox/firefox/tree/main/js/src, github.com/mozilla-spidermonkey
Written in	C, C++
Operating system	Cross-platform
Platform	IA-32, x86-64, ARM, MIPS, SPARC, RISC-V
Type	JavaScript and WebAssembly engine
License	MPL 2.0
Website	spidermonkey.dev

It is the first JavaScript engine, written by Brendan Eich at Netscape Communications, and later released as open source and currently maintained by the Mozilla Foundation. Its design allows it to be embedded in applications beyond Web browsers, with implementations including MongoDB database system, Adobe Acrobat, and the GNOME desktop environment.

History

Eich "wrote JavaScript in ten days" in 1995, having been "recruited to Netscape with the promise of 'doing Scheme' in the browser". (The idea of using Scheme was abandoned when "engineering management [decided] that the language must 'look like Java'".) In late 1996, Eich, needing to "pay off [the] substantial technical debt" left from the first year, "stayed home for two weeks to rewrite Mocha as the codebase that became known as SpiderMonkey". (Mocha was the original working name for the language.) In 2011, Eich transferred management of the SpiderMonkey code to Dave Mandelin.

Versions

SpiderMonkey version history
Version	Release date	ECMAScript version	Browser version	Added functionality
Unsupported: 1.0 (Mocha)	September 1995		Netscape Navigator 2.0b1	Basic syntax mostly from C, `>>>` (unsigned shift) from Java, `for-in` statement and `function` declaration from AWK. `var`, `with`, `this`, `obj.prop` and `obj[prop]` syntax, automatic semicolon insertion, `<!--` comments. number, string, boolean, object and function types; undefined and null `Object`, `String`, `Date` classes and methods, `Math` object, `eval()`, `parseInt()`, `parseFloat()`, `isNaN()` Function's `arguments` property (quirk: merely an alias for the function object)
Unsupported: 1.1 (Mocha)	August 1996	Basis for ES1	Netscape Navigator 3.0	Finished originally envisioned language design that was cut short due to Netscape Navigator 2.0's feature freeze. prototype-based inheritance (from Self) via function's `prototype` property. `typeof`, `void` and `delete var` operators. `Array`, `Boolean`, `Function`, `Number`, `String` classes. Automatic type coercions. Wrapper objects when accessing a primitive's property.
Unsupported: 1.2	June 1997	Basis for ES3	Netscape Navigator 4.0-4.05	New engine codenamed "SpiderMonkey", replacing the original Mocha. Regular expressions, function expressions, nested functions. `do-while`, `switch`, statement labels, `break`/`continue` with label, `delete obj.prop`, `__proto__` pseudo-property. Array (`[...]`), Object (`{prop: ...}`) and RegExp (`/.../`) literals. Array methods: push, pop, shift, splice, unshift, concat, slice String methods: charCodeAt, fromCharCode, match, replace, search, substr Function and `arguments` are distinct objects, `arguments.callee`, function's `arity` property. Non-standard: removed automatic coercions for `==` (restored in 1.3), `watch()`/`unwatch()`, `import`/`export` statements and signed scripts.
Unsupported: 1.3	October 1998	ES1 + ES2 (compliant with the standard)	Netscape Navigator 4.06-4.7x	Full ECMAScript compliance, Unicode support, `===` and `!==`. Type coercion for `==` reverted to JS1.1 semantics. `if(x=y)` no longer converts to `if(x==y)`. Non-nullish objects are truthy in conditionals, even a `Boolean` object that wraps `false`. Global `undefined` binding (idiom before: `void(0)`)
Unsupported: 1.4			Netscape Server	`try-catch-finally` statement, `in` and `instanceof` operators. No indirect `eval()` (later reverted), removed `Object.prototype.eval()`. Function's `arguments` property is now a variable. `arity` property deprecated in favor of `length`.
Unsupported: 1.5	November 2000	ES3	Netscape Navigator 6, Firefox 1.0	ES3 features: runtime errors reported as exceptions, regex enhancements (non-greedy quantifiers, non-capturing groups, lookahead assertions, m flag), Number formatting methods (toExponential, toFixed, toPrecision) Getters and setters. Multiple `catch` clauses in `try-catch`. Functions can be declared inside an expression and `if` clause. `const` declaration (not part of ES3, adopted in ES6)
Unsupported: 1.6	November 2005	E4X	Firefox 1.5	Array methods: indexOf, lastIndexOf, every, filter, forEach, map, some Array and String generics E4X and `for each...in` statement
Unsupported: 1.7	October 2006		Firefox 2.0	Iterators and generators, `for...of`, `yield`, `let` statement, destructuring assignment. Non-standard: array comprehensions.
Unsupported: 1.8	June 2008		Firefox 3.0	Array methods: reduce, reduceRight Non-standard: expression closures and generator comprehensions.
Unsupported: 1.8.1	June 2009		Firefox 3.5	TraceMonkey: tracing JIT JSON support, Object.getPrototypeOf(), String methods: trim, trimLeft, trimRight, startsWith. Switched to C++ from plain C for building the engine.
Unsupported: 1.8.5	March 2011	ES5	Firefox 4.0	JägerMonkey: method JIT Object manipulation and protection methods, Array.isArray(), Date.prototype.toJSON(), Function.prototype.bind() Strict mode Trailing comma not accepted by `JSON.parse()` Proxy class and typed arrays (not part of ES5, adopted in ES6)
Unsupported: 1.8.8	January 2012		Firefox 10.0	Regular expressions object no longer callable, Function.prototype.isGenerator() method (in 5.0). ES6 WeakMap (in 6.0) Function.arity removed (in 7.0) E4X deprecated (in 10.0)
Unsupported: 17	November 2012		Firefox 17.0	ArrayBuffer.prototype.slice() (in 12.0) ES6 for...of and Map/Set (in 13.0) ES6 default and rest parameters, new Number methods, DataView interface (in 15.0) ES6 spread operator for array initializers (in 16.0) String methods: startsWith, endsWith, contains. Iterator improvements. E4X disabled for web (in 17.0)
Unsupported: 24	September 2013		Firefox 24.0	IonMonkey: optimizing JIT compiler (in 18.0) ES6 Proxy, String.prototype.contains() method (in 18.0), `for each...in` deprecated, Math.imul() (in 20.0) Map/Set methods: keys, values, entries (in 20.0/24.0) E4X removed, parseInt no longer treats strings with leading "0" as octal (in 21.0) ES6 arrow functions, Object.is() (in 22.0) OdinMonkey: asm.js optimization module (in 22.0)
Unsupported: 31	July 2014		Firefox 31.0
Unsupported: 38	May 2015		Firefox 38.0
Unsupported: 45	March 2016		Firefox 45.0
Unsupported: 52	March 2017	ES6	Firefox 52.0	Nearly complete ES6 compliance by 52.0-53.0. Proper Tail Calls the only remaining long-standing issue.
Unsupported: 60	May 2018		Firefox 60.0
Unsupported: 68	July 2019		Firefox 68.0
Unsupported: 78	June 2020		Firefox 78.0	Switched regex engine from YARR to V8's Irregexp.
Unsupported: 91	August 2021		Firefox 91.0	WarpMonkey JIT replaced IonMonkey in 83.0.
Unsupported: 102	June 2022		Firefox 102.0
Unsupported: 103	July 2022		Firefox 103.0
Latest version: 131	September 2024		Firefox 131.0
Legend: Unsupported Supported Latest version Preview version Future version

Standards

SpiderMonkey implements the ECMA-262 specification (ECMAScript). ECMA-357 (ECMAScript for XML (E4X)) was dropped in early 2013.

Internals

SpiderMonkey is written in C/C++ and contains an interpreter, the WarpMonkey JIT compiler, and a garbage collector.

TraceMonkey

TraceMonkey was the first JIT compiler written for the JavaScript language. Initially introduced as an option in a beta release and introduced in Brendan Eich's blog on August 23, 2008, the compiler became part of the mainline release as part of SpiderMonkey in Firefox 3.5, providing "performance improvements ranging between 20 and 40 times faster" than the baseline interpreter in Firefox 3.

Instead of compiling whole functions, TraceMonkey was a tracing JIT, which operates by recording control flow and data types during interpreter execution. This data then informed the construction of trace trees, highly specialized paths of native code.

Improvements to JägerMonkey eventually made TraceMonkey obsolete, especially with the development of the SpiderMonkey type inference engine. TraceMonkey is absent from SpiderMonkey from Firefox 11 onward.

JägerMonkey

JägerMonkey, internally named MethodJIT, was a whole-method JIT compiler designed to improve performance in cases where TraceMonkey could not generate stable native code. It was first released in Firefox 4 and eventually entirely supplanted TraceMonkey. It has itself been replaced by IonMonkey.

JägerMonkey operated very differently from other compilers in its class: While typical compilers worked by constructing and optimizing a control-flow graph representing the function, JägerMonkey instead operated by iterating linearly forward through SpiderMonkey bytecode, the internal function representation. Although this prohibits optimizations that require instruction reordering, JägerMonkey compiling has the advantage of being very fast, which is useful for JavaScript since recompiling due to changing variable types is frequent.

Mozilla implemented a number of critical optimizations in JägerMonkey, most importantly polymorphic inline caches and type inference.

The difference between TraceMonkey and JägerMonkey JIT techniques and the need for both was explained in a hacks.mozilla.org article. A more in-depth explanation of the technical details was provided by Chris Leary, one of SpiderMonkey's developers, in a blog post Archived 9 December 2012 at archive.today. More technical information can be found in other developer's blogs: dvander, dmandelin.

IonMonkey

IonMonkey was a JavaScript JIT compiler of Mozilla, which was aimed to enable many new optimizations that were impossible with the prior JägerMonkey architecture.

IonMonkey was a more traditional compiler: it translated SpiderMonkey bytecode into a control-flow graph, using static single assignment form (SSA) for the intermediate representation. This architecture enabled well-known optimizations from other programming languages to be used for JavaScript, including type specialization, function inlining, linear-scan register allocation, dead code elimination, and loop-invariant code motion.

The compiler can emit fast native code translations of JavaScript functions on the ARM, x86, and x86-64 platforms. It has been the default engine since Firefox 18.

OdinMonkey

OdinMonkey is the name of Mozilla's new optimization module for asm.js, an easily compilable subset of JavaScript. OdinMonkey itself is not a JIT compiler, it uses the current JIT compiler. It's included with Firefox from release 22.

WarpMonkey

The WarpMonkey JIT replaces the former IonMonkey engine from version 83. It is able to inline other scripts and specialize code based on the data and arguments being processed. It translates the bytecode and Inline Cache data into a Mid-level Intermediate Representation (Ion MIR). This graph is transformed and optimized before being lowered to a Low-level Intermediate Representation (Ion LIR). This LIR performs register allocation and then generates native machine code in a process called Code Generation. The optimizations here assume that a script continues to see data similar what has been seen before. The Baseline JITs are essential to success here because they generate ICs that match observed data. If after a script is compiled with Warp, it encounters data that it is not prepared to handle it performs a bailout. The bailout mechanism reconstructs the native machine stack frame to match the layout used by the Baseline Interpreter and then branches to that interpreter as though we were running it all along. Building this stack frame may use special side-table saved by Warp to reconstruct values that are not otherwise available.

Use

SpiderMonkey is intended to be embedded in other applications that provide host environments for JavaScript. An incomplete list follows:

Mozilla Firefox, Thunderbird, SeaMonkey, and other applications that use the Mozilla application framework
- Forks of Firefox including the Pale Moon, Basilisk and Waterfox web browsers.
Data storage applications:
- MongoDB moved from V8 to SpiderMonkey in version 3.2
- Riak uses SpiderMonkey as the runtime for JavaScript MapReduce operations
- CouchDB database system (written in Erlang). JavaScript is used for defining maps, filters, reduce functions and viewing data, for example in HTML format.
Adobe Acrobat and Adobe Reader, Adobe Flash Professional, and Adobe Dreamweaver. Adobe Acrobat DC uses Spidermonkey 24.2 with ECMA-357 support forward ported.
GNOME desktop environment, version 3 and later
Cinnamon desktop environment, version 1.0 and later
Yahoo! Widgets, formerly named Konfabulator
FreeSWITCH, open-source telephony engine, uses SpiderMonkey to allow users to write call management scripts in JavaScript
PythonMonkey uses SpiderMonkey to allow users to write programs where JavaScript and Python functions, types, and events interoperate and (where possible) share memory storage.
The text-based web browser ELinks uses SpiderMonkey to support JavaScript
Parts of SpiderMonkey are used in the Wine project's JScript (re-)implementation
Synchronet, a BBS, e-mail, Web, and application server using the SpiderMonkey engine
JavaScript OSA, a SpiderMonkey inter-process communication language for the Mac computer
0 A.D., a real-time strategy game
Wasmer has incorporated SpiderMonkey into their WinterJS open-source project; a JavaScript runtime environment.
SpiderMonkey is also used in many other open-source projects; an external list is maintained at Mozilla's developer site.

SpiderMonkey includes a JavaScript Shell for interactive JavaScript development and for command-line invocation of JavaScript program files.