How the V8 Engine Optimizes JavaScript at Runtime
How the V8 Engine Optimizes JavaScript at Runtime
V8 引擎如何在运行时优化 JavaScript
The V8 engine speeds up JavaScript by dynamically compiling frequently run bytecode into optimized native machine code. However, if you pass inconsistent argument types to these optimized functions, V8 panics and deoptimizes back to bytecode. Keeping your functions monomorphic (single-typed) prevents this costly deoptimization loop, ensuring maximum runtime execution speed. V8 引擎通过将频繁运行的字节码动态编译为优化的原生机器码来加速 JavaScript。然而，如果你向这些优化后的函数传递不一致的参数类型，V8 会触发“恐慌”并将其反优化（deoptimize）回字节码。保持函数为单态（Monomorphic，即单一类型）可以防止这种代价高昂的反优化循环，从而确保最高的运行时执行速度。
If you’ve spent as much time digging into V8 execution flags as I have, you quickly realize that JavaScript is constantly rewriting itself under the hood. We like to think of JavaScript as a dynamically typed scripting language. But at runtime, engines like V8 are working tirelessly to turn your code into a highly optimized, statically typed powerhouse. When we violate that type stability, we pay a massive performance tax. 如果你像我一样花时间深入研究过 V8 的执行标志，你很快就会意识到 JavaScript 在底层不断地重写自身。我们倾向于将 JavaScript 视为一种动态类型的脚本语言，但在运行时，像 V8 这样的引擎正不懈地努力将你的代码转化为高度优化、静态类型的强力引擎。当我们破坏这种类型稳定性时，就会付出巨大的性能代价。
How does the V8 engine optimize JavaScript at runtime? V8 uses a multi-tiered compilation pipeline that starts with an interpreter for fast startup times, then upgrades hot functions to optimized machine code using a JIT compiler. By tracking runtime type patterns, the engine can safely make assumptions to skip expensive dynamic lookups. V8 引擎如何在运行时优化 JavaScript？V8 使用多层编译流水线：首先通过解释器实现快速启动，然后利用 JIT（即时）编译器将热点函数升级为优化的机器码。通过跟踪运行时的类型模式，引擎可以安全地做出假设，从而跳过昂贵的动态查找。
When I look at V8’s execution pipeline, I see two primary systems working in tandem: Ignition (the interpreter) and TurboFan (the JIT compiler). Initially, Ignition compiles your raw JavaScript into bytecode so your app can boot instantly. As this bytecode executes, V8 allocates a data structure called a Feedback Vector for each function. Inside this vector are Feedback Slots (managed by Inline Caches, or ICs). These slots act as recorders, capturing the exact types (or “shapes”) of the variables passing through your code. 当我审视 V8 的执行流水线时，我看到了两个协同工作的核心系统：Ignition（解释器）和 TurboFan（JIT 编译器）。最初，Ignition 将你的原始 JavaScript 编译为字节码，以便应用能立即启动。当字节码执行时，V8 会为每个函数分配一个名为“反馈向量”（Feedback Vector）的数据结构。该向量内部包含“反馈槽”（Feedback Slots，由内联缓存 IC 管理）。这些槽位充当记录器，捕获流经代码的变量的确切类型（或“形状”）。
Once a function runs frequently enough to cross an execution threshold, V8 marks it as “hot” and hands it to TurboFan. TurboFan reads those feedback slots, assumes the types will remain identical in the future, and compiles a highly streamlined, native machine code version of that function. 一旦函数运行频率达到执行阈值，V8 就会将其标记为“热点”，并交给 TurboFan。TurboFan 读取这些反馈槽，假设未来类型保持不变，并编译出该函数高度精简的原生机器码版本。
What happens when you pass different types to an optimized function? Passing a different type to an optimized function triggers a process called “deoptimization” (or “deopt”). Because the JIT-compiled machine code was built on strict assumptions about your data types, encountering an unexpected type forces V8 to discard the optimized code and fall back to interpreted bytecode. 当你向优化后的函数传递不同类型时会发生什么？向优化函数传递不同类型会触发一个称为“反优化”（deoptimization 或 deopt）的过程。由于 JIT 编译的机器码是基于对数据类型的严格假设构建的，遇到意外类型会迫使 V8 丢弃优化代码，并回退到解释执行的字节码。
To understand this, let’s look at how V8 handles a basic addition operation under the hood: 为了理解这一点，让我们看看 V8 在底层是如何处理基本加法运算的：
function calculateTotal(price) {
return price + 10; // V8 allocates a Feedback Slot here
}
// Warm-up: V8 records 'Number' in the feedback slot
for (let i = 0; i < 10000; i++) {
calculateTotal(i);
}
// Deopt trigger: Type changes from Number to String
calculateTotal("100");During the warm-up loop, V8 records a Number in the feedback slot for price. TurboFan looks at this stable type feedback, skips the overhead of checking for strings or objects, and compiles optimized machine code. But the moment I call calculateTotal(“100”), that optimized assumption is shattered. V8 realizes the compiled machine code cannot safely execute a string operation, bails out, throws away the optimized native code, and reverts back to Ignition’s bytecode interpreter to perform the operation safely.
在预热循环期间，V8 在反馈槽中为 price 记录了 Number 类型。TurboFan 查看这种稳定的类型反馈，跳过检查字符串或对象的开销，并编译出优化的机器码。但当我调用 calculateTotal("100") 的那一刻，这种优化假设被打破了。V8 意识到编译后的机器码无法安全地执行字符串操作，于是中止任务，丢弃优化后的原生代码，并回退到 Ignition 的字节码解释器以安全地执行该操作。
Why are deoptimizations so bad for performance? While a single deoptimization is relatively cheap, a cycle of continuous optimization and deoptimization (known as a “deopt loop”) consumes heavy CPU cycles. This back-and-forth overhead makes your code run significantly slower than if it had just remained in the interpreter. In my experience profiling performance bottlenecks, constant type-swapping is a silent killer. 为什么反优化对性能如此不利？虽然单次反优化代价相对较小，但持续的优化和反优化循环（称为“反优化循环”）会消耗大量的 CPU 周期。这种反复切换的开销使得代码运行速度比一直保持在解释器中运行还要慢得多。根据我分析性能瓶颈的经验，频繁的类型切换是一个隐形杀手。
V8 tracks the state of your function’s feedback slots and categorizes them into three optimization tiers: V8 会跟踪函数反馈槽的状态，并将其分为三个优化层级：
| State | Description | Performance | JIT Optimization Status |
|---|---|---|---|
| Monomorphic | The slot observes only one type (e.g., always integers). | Fastest | High Optimization |
| Polymorphic | The slot observes a small, fixed set of different types (up to 4). | Moderate | Partially Optimized |
| Megamorphic | The slot observes an unpredictable variety of types (> 4). | Slow | No Optimization (Interpreter Fallback) |
| 状态 | 描述 | 性能 | JIT 优化状态 |
|---|---|---|---|
| 单态 (Monomorphic) | 槽位仅观察到一种类型（例如：始终为整数）。 | 最快 | 高度优化 |
| 多态 (Polymorphic) | 槽位观察到少量固定的不同类型（最多 4 种）。 | 中等 | 部分优化 |
| 超多态 (Megamorphic) | 槽位观察到不可预测的多种类型（> 4 种）。 | 慢 | 无优化（回退至解释器） |
If your code cycles between types, V8 will try to re-optimize it as polymorphic, hit another mismatch, deoptimize again, and eventually give up entirely—leaving your function permanently trapped in slow, interpreted bytecode. 如果你的代码在不同类型间循环，V8 会尝试将其重新优化为多态，但遇到不匹配后再次反优化，最终彻底放弃——使你的函数永久陷入缓慢的字节码解释执行中。
How can we write code that V8 can easily optimize? To help the JIT compiler, you must write highly predictable, type-consistent code. Using tools like TypeScript ensures compile-time type safety, which naturally guides you to write monomorphic runtime functions. Even though TypeScript’s type annotations are entirely stripped away before runtime, I consider it a key tool for performance. By enforcing strict interfaces and preventing runtime type-shifting, you are writing code that perfectly aligns with V8’s JIT compiler. When your functions remain monomorphic, V8 keeps its blazing-fast machine code in play, giving you maximum execution speed. 我们如何编写易于 V8 优化的代码？为了辅助 JIT 编译器，你必须编写高度可预测、类型一致的代码。使用 TypeScript 等工具可以确保编译时的类型安全，这自然会引导你编写单态的运行时函数。尽管 TypeScript 的类型注解在运行时之前会被完全剥离，但我认为它是性能的关键工具。通过强制执行严格的接口并防止运行时类型转换，你编写的代码将与 V8 的 JIT 编译器完美契合。当函数保持单态时，V8 就能持续使用其极速的机器码，从而为你提供最高的执行速度。
FAQ
常见问题
Does TypeScript make raw JavaScript run faster at runtime? TypeScript 会让原始 JavaScript 在运行时运行得更快吗？ No, TypeScript does not directly modify runtime performance because its types compile away. However, it forces developers to write highly consistent, type-safe structures, which prevents runtime deoptimizations and makes your code naturally easier for V8’s JIT compiler to optimize. 不会，TypeScript 不会直接改变运行时性能，因为它的类型在编译时会被移除。然而，它强制开发者编写高度一致、类型安全的结构，这能防止运行时反优化，并使你的代码自然地更易于被 V8 的 JIT 编译器优化。
What is the difference between monomorphic and polymorphic functions in JavaScript? JavaScript 中单态函数和多态函数有什么区别？ A monomorphic function only ever receives arguments of the exact same type, allowing V8 to compile highly optimized, direct machine code. A polymorphic function handles a small variety of different types (usually 2 to 4), requiring V8 to emit slightly slower, guarded machine code to handle those distinct cases. 单态函数只接收完全相同类型的参数，允许 V8 编译出高度优化的直接机器码。多态函数处理少量不同的类型（通常为 2 到 4 种），这要求 V8 生成稍慢的、带有保护机制的机器码来处理这些不同的情况。
How do I profile and identify JIT deoptimizations in my Node.js app?
我该如何在 Node.js 应用中分析并识别 JIT 反优化？
You can inspect V8’s internal decisions by running your Node.js application with specific flags. If you run your app using node --trace-opt --trace-deopt app.js, your console will display…
你可以通过使用特定的标志运行 Node.js 应用来检查 V8 的内部决策。如果你使用 node --trace-opt --trace-deopt app.js 运行应用，控制台将显示……