Inline caches, IC states, and deoptimization
How V8''''s per-call-site inline caches track hidden classes, the monomorphic/polymorphic/megamorphic state machine, deoptimization triggers, and the FadedExample of a hidden-class transition breaking a hot IC.
A single source line — p.x — can execute in 1 CPU cycle or in 100 cycles, depending on how many different object shapes have passed through it. The structure that decides this is the inline cache, and its state is the most impactful performance number you cannot see in DevTools by default.
How inline caches work
Every property access in JS is a polymorphic operation — the object could be any shape. V8 generates a tiny per-call-site cache: the first time a line runs, V8 records the hidden class it saw and the property offset for that class. Next time the same line runs and the object has the same hidden class, V8 reads the property at the recorded offset directly — 5–10 CPU cycles. No hashtable lookup, no type check, one MOV instruction.
The IC state machine
The IC state lives in the FeedbackVector slot for that source line. Transitions are one-way towards megamorphic:
| State | Hidden classes seen | Cost | Notes |
|---|---|---|---|
uninitialized | 0 | — | First execution |
monomorphic | 1 | 5–10 cycles | Fast direct access |
polymorphic | 2–4 | Linear branch chain | Still fast |
megamorphic | 5+ | Generic lookup, ~50–100 cycles | 10–50× slower |
A function can have hundreds of IC slots. One megamorphic site does not kill the whole function, but a hot loop containing a megamorphic property access kills its loop body.
- Monomorphic access
- 5–10 cycles
- Megamorphic threshold
- ≥5 shapes per IC slot
- Megamorphic slowdown
- 10–50× vs monomorphic
- IC slot size in FeedbackVector
- 16 bytes (8B class + 8B handler)
- Generic lookup cost
- 50–100 cycles
Deoptimization
Understanding deoptimization is what separates an engineer who reads a 40ms frame as “slow” from one who reads it as “TurboFan guard fired, function fell back to Ignition.”
When TurboFan optimises a function, it bakes in assumptions: “this argument is always a smi”, “this object’s property z is always a number”, “this loop never overflows 32-bit indices”. A guard is inserted at each assumption. If at runtime any guard fails, V8 deoptimizes: throws away the compiled code, reconstructs the interpreter state from the optimised frame, and resumes execution in Ignition (or Sparkplug). The function may climb back up later, but the deopt itself costs ~microseconds.
Common deopt triggers:
- Passing a different type to a previously-typed argument
- Indexing past array bounds
- Hitting NaN in a numeric operation
- Accessing a deleted property
Chrome DevTools --trace-opt --trace-deopt flags expose deopts. %OptimizationStatus(fn) at --allow-natives-syntax in d8 shows the current tier.
Trace one hidden-class transition that breaks an IC
1/3A hot loop processes objects from 6 different constructors. What IC state does the property-access site reach?
Order the steps of a property access at a TurboFan-compiled monomorphic IC:
- 1 TurboFan-compiled function receives an object pointer in a register
- 2 Load the hidden-class pointer from the object header
- 3 Compare loaded hidden class to the expected class from compile time
- 4 If equal: read the property at the precomputed offset — 1 MOV
- 5 If not equal: deoptimize, fall back to lower tier
- 6 Lower tier records the new hidden class, IC may transition state
- 7 Function may be re-optimised with updated feedback
A function was TurboFan-compiled and ran at 5µs. After a refactor it now runs at 250µs. What is the most likely V8-level cause?
▸Why this works
Why is the megamorphic threshold 5 and not some other number? V8’s polymorphic IC handler can embed up to 4 class-check branches inline before the code becomes too large and complex to manage. At 5+, the handler overhead exceeds the benefit of any specialisation, so V8 falls back to a generic runtime lookup that handles all shapes uniformly. The number 4 is an implementation constant tuned for the average JS workload; it is not a fundamental hardware limit.
- 01Describe the IC state machine: what triggers each transition?
- 02What is a deoptimization guard and when does it fire?
- 03A call site has seen 3 hidden classes. How do you bring it back to monomorphic?
An inline cache is a per-call-site stub that records the hidden class V8 saw and the property offset for that class. When the same hidden class arrives again, the property is read at the precomputed offset in 5–10 cycles — no lookup. The IC state machine transitions from uninitialized → monomorphic → polymorphic → megamorphic as more classes are observed. Megamorphic (5+ classes) forces a generic runtime lookup costing 50–100 cycles per access — 10–50× slower than monomorphic. Deoptimization happens when a TurboFan guard fires at runtime; the compiled code is discarded and execution falls back to Ignition. A single deopt is expensive but survivable; a deopt-loop — where TurboFan recompiles the same function only to deopt it on every call — is a catastrophic throughput killer. Now when you see a function that ran at 5µs yesterday and runs at 250µs today, your first hypothesis should be IC degradation or a deopt guard — not a GC problem, not a network call, not more work. Check the shapes first.
Practice
Start at the top. Tasks go easiest → hardest: recall a fact, apply it to a case, then a senior-level stretch. Open one, attempt it, then reveal.
appears again in169
- Why GraphQL gets N+1junior
- DataLoader mechanics: tick-boundary batchingmiddle
- Batch function contracts: ordering, shapes, errorsmiddle
- Federation and lookahead: batching beyond DataLoadermiddle
- Query complexity defences: depth, cost, persisted queriesmiddle
- Senior GraphQL API: scheduling contract, tenant isolation, observabilitysenior
- Why idempotency: making retries safejunior
- Server-side state machine: four states of an idempotency keymiddle
- Outbox and inbox: effectively-once across the dual-write boundarymiddle
- Concurrency and cache architecture for idempotency at scalesenior
- Observability, production failures, and global-scale designsenior
- What is a cache stampede and why it makes things worsejunior
- Lock and single-flight: bounding concurrent rebuildsmiddle
- XFetch: coordination-free probabilistic early expirationmiddle
- Stale-while-revalidate and CDN request coalescingmiddle
- Detecting stampedes and designing TTL for productionmiddle
- Metastable failure, fencing tokens, and production postmortemssenior
- What a relation is: tables, rows, keys, and constraintsjunior
- Constraints, keys, and Postgres data typesmiddle
- Normal forms, denormalization, and why schemas stickmiddle
- JSONB, arrays, and when a side table winsmiddle
- Heap storage, TOAST, and column alignmentsenior
- Schema integrity: deferral, versioning, and production failure modessenior
- Relational vs document, wide-column, graph, and key-valuesenior
- Index-only scans, the Visibility Map, and INCLUDEsenior
- Production failure modes and the index audit playbooksenior
- pg_statistic, ANALYZE, and production observabilitymiddle
- Production failure modes and plan stabilitysenior
- MVCC: why readers and writers never wait for each otherjunior
- Row versions and snapshots: the on-disk mechanicsmiddle
- HOT updates and isolation levels: what you gain and what you paymiddle
- Vacuum and bloat: keeping the storage tax boundedmiddle
- CLOG, XID wraparound, and MultiXact: deep visibility internalssenior
- SSI internals and production autovacuum tuningsenior
- Real-world MVCC failures, deployment patterns, and distributed snapshotssenior
- Connection pools: amortising the cost of a Postgres backendjunior
- PgBouncer session, transaction, and statement modesmiddle
- Pool sizing: the (cores × 2) + spindles formula and the two-layer stackmiddle
- Pool exhaustion and idle-in-transaction: the 3 AM failure modemiddle
- Migrating to transaction mode: rollout playbook and PgBouncer 1.21 prepared statementsmiddle
- The Postgres process model and why raising max_connections degrades throughputsenior
- Pooler landscape 2026, serverless connection storms, and the full failure-mode taxonomysenior
- What a schema migration is and why it replaces ad-hoc DDLjunior
- ADD COLUMN: instant in PG 11+ vs rewrite in older Postgresjunior
- The lock-queue failure mode: why instant DDL can freeze the databasemiddle
- Safe DDL patterns: NOT VALID, CONCURRENTLY, and unsafe-op fixesmiddle
- Expand-contract: zero-downtime for breaking schema changesmiddle
- Advisory locks, migration tools, and deploy coordinationsenior
- Migration failure taxonomy and production disciplinesenior
- Why sharding exists: the single-Postgres ceilingjunior
- Shard-key selection: hash, range, list, and directory strategiesmiddle
- Partitioning vs sharding: same word, two different thingsmiddle
- Co-location and Citus: the invariant that makes sharding usablemiddle
- The hot-shard failure mode: detection, isolation, and durable policymiddle
- Schema-based sharding and multi-tenancy alternativessenior
- Online resharding, 2PC, and the operational cost of shardingsenior
- The seven acts: from CREATE TABLE to Citusjunior
- Acts 1–3 in depth: schema, indexes, and planner statisticsmiddle
- Acts 4–6 in depth: MVCC bloat, connection pooling, and safe migrationsmiddle
- Act 7 in depth: sharding, co-location, and the seven-tier tradeoff cascademiddle
- Observability, anti-patterns, and production triagesenior
- Raft roles, terms, and why majority quorums prevent split brainjunior
- How Raft replicates a log entry and decides it is safe to commitmiddle
- Raft leader election: timeouts, voting rules, and the four safety propertiesmiddle
- Raft in the real world: partitions, slow disks, and client routingmiddle
- Raft extensions: pre-vote, learners, snapshots, and linearizable readssenior
- Raft in production: membership changes, Multi-Raft, and observabilitysenior
- Where data fetching happens — and why it decides LCPjunior
- Fetch waterfalls — diagnosis and the Promise.all curemiddle
- React Server Components and Suspense streamingmiddle
- Client-side cache: TanStack Query, SWR, and stale-while-revalidatemiddle
- LCP, prefetch, and race conditions in interactive fetchingmiddle
- Senior internals: RSC payload, caching layers, and production failure modessenior
- What a JavaScript engine iszero
- Ignition and the bytecodemiddle
- Inside the interpreter loopmiddle
- How V8 represents a valuemiddle
- What a Map really is: opening the hidden classmiddle
- Transition trees, deprecation, and migrationmiddle
- Fast properties, slow properties, and slack trackingmiddle
- Inline caches, deeply: feedback slots and handlersmiddle
- Monomorphic, polymorphic, megamorphic — and the stub cachemiddle
- Four tiers and how warm-up worksmiddle
- Type feedback: the fuel for the optimisersenior
- TurboFan: the sea-of-nodes optimisersenior
- Speculation and guardssenior
- Deoptimization: falling off the cliffsenior
- On-Stack Replacement: swapping the frame mid-loopsenior
- Scopes, contexts, and the scope chainmiddle
- What a closure actually retainsmiddle
- When V8 allocates a Context (and what it costs)middle
- Closures, feedback vectors, and call-site polymorphismmiddle
- Why a GC, and reachabilitymiddle
- Leaks in a garbage-collected languagesenior
- The engine vs the loopmiddle
- Microtasks vs macrotasks: orderingmiddle
- Inside a Promisemiddle
- async/await, desugaredmiddle
- Capstone: optimize a hot pathsenior
- The three-way handshakejunior
- Sequence numbers and connection statemiddle
- DNS: what it does and why it existsjunior
- The resolver walk: referrals, record types, and gluemiddle
- TTL, caching, and DNS propagationmiddle
- The 1-RTT handshake: key shares and ECDHEmiddle
- Session resumption and 0-RTTmiddle
- WebSocket: the HTTP upgrade handshakejunior
- WebSocket frame format: opcodes, masking, fragmentationmiddle
- WebSocket backpressure: when clients can''''t keep upmiddle
- Reconnection: jittered backoff, thundering herd, message resumptionsenior
- WebSocket at scale: HTTP/2 multiplexing, permessage-deflate, C10Msenior
- WebSocket in production: proxies, security, and distributed architecturesenior
- What reverse proxies dojunior
- Health checks, connection draining, and slow startmiddle
- Session affinity, consistent hashing, and the right fixmiddle
- Retry storms, circuit breakers, and load sheddingsenior
- Resilient LB architecture: anycast, zone-aware routing, and observabilitysenior
- Why QUIC and not TCP+TLSjunior
- Connection IDs and network migrationmiddle
- 0-RTT resumption and packet encryptionsenior
- DDoS: what it is and why it worksjunior
- Amplification attacks and state exhaustionmiddle
- Rate limiting: algorithms and architecturemiddle
- WAFs, firewalls, mTLS, and HSTSmiddle
- DNS cache poisoning and BGP hijackingsenior
- Defense-in-depth architecture and attack economicssenior
- DNS, TCP, TLS in sequence: where the milliseconds gomiddle
- Proxy intercepts and security gates: rate limiters, WAF, mTLSmiddle
- Alternate paths: QUIC 0-RTT, WebSocket upgrade, connection migrationmiddle
- Observability: distributed traces, USE/RED, and samplingsenior
- Resilience: cascading retries, circuit breakers, and error budgetssenior
- What the three signals are: logs, metrics, and tracesjunior
- Why structured logs exist: the diary vs the spreadsheetjunior
- The production log schema: fields every line must carrymiddle
- PII redaction and log injectionsenior
- OTel Logs Data Model and audit logs as a subsystemsenior
- SLI, SLO, and the error budget: reliability by the numbersjunior
- Error budget policy, latency SLOs, and composite journeysmiddle
- Production SLO failures, self-observability, security, and the big picturesenior
- The incident loop: from pager to postmortem to preventionmiddle
- Cache lines, struct layout, and false sharingmiddle
- SIMD, SoA vs AoS, and memory bandwidthmiddle
- Cache-oblivious algorithms, PGO, and production failuressenior
- GC in production: observability, security, edge cases, and fleet governancesenior
- Batching: amortize fixed cost per operationjunior
- The batching window: size and wait timemiddle
- Batching in Kafka and Postgresmiddle
- io_uring and observability of batchingmiddle
- From Nagle to io_uring: evolution of batchingmiddle
- Backpressure, failure isolation, and batch security in productionsenior
- CI enforcement and RUM: making budgets stickmiddle
- V8 JIT pipeline, HTTP priorities, and bundle securitysenior
- The performance loop: discipline, not a projectjunior
- Classify and fix: matching bottleneck families to remediesmiddle
- Observability stack and CI gates: catching regressions before they shipmiddle
- Incident to enforcement: SLO burn to verified fix in 35 minutesmiddle
- Culture, economics, and org-scale performancesenior
- At-most-once, at-least-once, exactly-once: the three delivery contractsjunior
- The three failure legs — where duplicates and losses actually happenmiddle
- Consumer-side dedup: the cheapest path to exactly-once processingmiddle
- Kafka exactly-once semantics: idempotent producer and transactionsmiddle
- SQS visibility timeout, DLQ, and the outbox patternmiddle
- Exactly-once in production: impossibility proof, hybrid patterns, and real incidentssenior
- What OAuth is and why passwords are not the answerjunior
- Authorization code flow with PKCEmiddle
- ID token validation and JWKS cache managementmiddle
- Refresh token rotation and scope-based least privilegemiddle
- Sender-constrained tokens: DPoP and mTLSsenior
- OAuth in production: audience attacks, observability, and real failuressenior
Something unclear?
Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.