Mozilla answers Google's Crankshaft with IonMonkey

Another simian joins Firefox JavaScript engine

Mozilla is developing a new JIT compiler for SpiderMonkey – the Firefox JavaScript engine – aiming to provide a new set of JavaScript optimizations. Known as IonMonkey, this will be SpiderMonkey's third JIT, but Mozilla hopes to consolidate all its optimization work on the new platform.

"Our goal is to implement a new compiler to enable many new JavaScript optimizations," reads the IonMonkey page on the MozillaWiki. "In particular, IonMonkey will feature much more organized and explicit data structures typical of advanced compilers. This goal of being clean and flexible will be extremely important for future optimization work and experimentation."

The project is led by David Anderson and David Mandelin, who were instrumental in building the JaegerMonkey JIT that was added to Firefox 4. Anderson and Mandelin aim to at least match the speed of Firefox's Trace JIT and Google's Crankshaft JavaScript engine.

When Google first revealed Crankshaft last fall, Mandelin said that Mozilla's JavaScript team and developer community "definitely have the skills and resources to enhance" the Firefox engine in ways that rival Google's design, and he indicated that work would begin soon after the release of Firefox 4.

"Plenty to do after Firefox 4 comes out," Mandelin said . "In the words of David Anderson, 'The game’s back on'."

Crankshaft was inspired by Sun's Java HotSpot performance engine, the revamped Java virtual machine that arrived in 1999, according to an exchange between The Register and Google engineer Eric Kay in December. Google Chrome developer Lars Bak was the lead man on the Sun HotSpot team, and Crankshaft uses HotSpot-like "adaptive compilation", identifying important code and optimizing that code as needed.

This is also reminiscent of what Mozilla does with the TraceMonkey extension to its JavaScript engine. But TraceMonkey "traces" code, detecting loops and converting them to assembly code. It works in tandem with JaegerMonkey. When TraceMonkey doesn't apply, JaegerMonkey kicks in and converts entire methods into assembly.

IonMonkey will make use of the Type Interface project from Mozilla man Brian Hackett, an effort to work around JavaScript's untyped setup. "[Hackett's project] is a hybrid static and dynamic analysis that is able to pinpoint, for certain, the types for every variable and property in a JavaScript program. This allows you to remove all sorts of run-time checks and perform optimizations that would otherwise be impossible," Anderson tells Infoq.

Mozilla intends to share all its IonMonkey code across the x86, x64, and ARM platforms. ®