Pointer tagging and pointer compression

The tagging scheme, precisely

We have seen that a value word’s low bit is the tag. Now the exact convention, which is the inverse of what beginners guess:

• Smi: low bit 0. The integer occupies the upper bits. No masking needed to use the integer in tagged arithmetic.
• HeapObject pointer: low bit 1. The real address is the word with that bit cleared.

This works because heap allocations are aligned (to at least a word boundary), so a real address always ends in …000. V8 adds 1 to mark it as a pointer. To dereference, the engine clears the low bit — a single AND / subtract:

// Conceptual untag (a real V8 dereference is one machine instruction):
const TAG = 1;
function isPointer(word) { return (word & TAG) === 1; }
function untag(word)     { return word & ~TAG; }   // clear the tag bit -> real address
// then load from the resulting address

So the cost of dynamic typing is: one bit test to classify, and one mask before any object access. Everything in V8 is built so these two operations are essentially free on the hot path.

Why pointers were the heap’s biggest cost

Object-oriented JavaScript is pointer-heavy. Think about what a typical object graph holds: every HeapObject’s first word is a pointer (its Map). Every property that is itself an object is a pointer. Arrays of objects are arrays of pointers. A linked list, a tree, a React fibre graph — overwhelmingly pointers.

On a 64-bit machine, each of those pointers is 8 bytes. But almost no real program needs a 64-bit address space for its JS heap — a few gigabytes is plenty. So 4 of those 8 bytes are, in practice, always zero. Across a graph with millions of pointers, that is a lot of wasted memory and wasted cache: every cache line holds half as many useful pointers as it could.

Pointer compression: 32-bit offsets in a cage

V8 8.0 (shipped 2020, on by default in Chrome and Node from then on) fixed this with pointer compression. The idea:

1. Allocate the entire JS heap inside a single 4GB-aligned region — the cage. Its start address is the base, held in a dedicated register.
2. Store every HeapObject pointer not as a full 64-bit address, but as a 32-bit offset from the base.
3. To dereference, reconstruct the real address as base + offset — one add against the base register.

Together these three steps mean that only the 32-bit offset travels through memory — the shared base never leaves its register. Without step 1 (the aligned cage) there would be no base to share; without step 3 there would be no way to recover the full address without storing it. Remove any one step and you lose either the 4-byte saving or the ability to dereference at all.

A compressed pointer is 4 bytes instead of 8. The Smi/pointer tag still lives in the low bit of the 32-bit value, so the scheme composes cleanly with tagging.

The payoff is large and was measured across real workloads:

• Heap size dropped ~40% on typical web and Node workloads — because so much of the heap is pointers.
• Cache locality improved, since twice as many pointers fit per cache line, which often speeds up pointer-chasing code despite the extra add.

The cost: a 4GB cap and an add

Nothing is free. Pointer compression’s price:

• A hard 4GB heap cap per isolate. A 32-bit offset can only address 4GB. If you genuinely need a larger JS heap in one isolate, you must build V8 with compression disabled (or use multiple isolates / worker threads, each with its own cage). For almost all apps, 4GB is far more than enough; for a few data-processing giants, it is a real wall.
• A decompression step. Every pointer load now does base + offset instead of using the stored value directly. This is a single cheap add, and the locality win usually more than pays for it — but it is non-zero, and it is why compression is a tradeoff, not a pure win.

Contrast with the old full-64-bit scheme (pre-8.0): pointers were stored as complete addresses, so no decompression add and no 4GB cap — but every pointer cost 8 bytes and cache lines were half-utilised. V8 judged the memory and locality win worth the cap for the overwhelming majority of users.