Booleans inside the engine

true and false are two shared values

You know true and false from everyday JavaScript. This lesson shows how a JavaScript engine stores them. An engine is the program that runs your code. We use V8, the engine inside Chrome and Node.js. Every fact here was checked in Node 22, which uses V8 version 12.4.

Inside V8, there is exactly one true and exactly one false. V8 makes them once, when it starts. V8 calls these special built-in values oddballs. A variable that holds a boolean only stores a pointer to one of them. A pointer is a memory address: it says where a value is. Writing true, writing false, or working out a < b never makes a new value.

This lesson builds on Tagged values, Smis & heap numbers. That lesson shows how V8 marks each stored value as either a small number or a pointer. The mark is called a tag, so a stored pointer is a tagged pointer. If you want the beginner rules for truthy and falsy values first, read Booleans & truthiness.

1const first = true;2const second = 3 < 5;3console.log(first, second);4console.log(typeof first);5console.log(Boolean("non-empty"));

Line 1 stores the literal true. Line 2 stores the result of the comparison 3 < 5, which is also true. Line 3 prints both: true true. Line 4 prints boolean, because typeof tells you the type of a value. Line 5 turns a non-empty string into a boolean and prints true.

Where V8 keeps true and false

V8 is written in the C++ language, and its source code is public. So we can read how it builds true and false. The file oddball.h describes oddballs. Its comment says: “The Oddball describes objects null, undefined, true, and false.” So four values are oddballs: null, undefined, true, and false.

Each oddball stores a few ready-made answers, so V8 never has to work them out again:

• to_number_raw and to_number: the value as a number.
• to_string: the value as a string.
• type_of: what typeof gives for the value.
• kind: a small number that says which oddball this is.

For booleans, the kinds are kFalse = 0 and kTrue = 1. The same file defines kNotBooleanMask = ~1: a number with every bit set except the last one. In oddball-inl.h, the check IsBoolean tests (kind & kNotBooleanMask) == 0. That test passes only when the kind is 0 or 1. So only false and true pass.

1%DebugPrint(true);2%DebugPrint(false);3%DebugPrint(1 < 2);

%DebugPrint is a special V8 helper. It prints what V8 stores for a value. It only works when you start Node with node --allow-natives-syntax, so this block can't run on this page. The lesson's test runs it and checks the parts that are the same on every run:

• [Oddball] in ReadOnlySpace: #true for true.
• [Oddball] in ReadOnlySpace: #false for false.
• The same map address for both values, within one run.
• No undetectable flag on the boolean map. You'll meet this flag in the ToBoolean section.

Line 3 prints the result of 1 < 2. It is the same #true oddball.

Why read-only? V8's static roots article explains it. Core values such as undefined and true are roots: values the engine always needs. They live in the read-only part of the heap. (The heap is the memory where objects live.) V8 loads them from its startup snapshot, a saved copy of memory that V8 reads when it starts. The Startup performance lesson explains what snapshots cost and save.

The details differ between programs that use V8. Node 22 here uses V8 12.4 without pointer compression, a trick that stores pointers in fewer bytes. Chrome uses newer V8 versions with pointer compression and the sandbox, a fence that limits which memory V8 can touch. So addresses and memory layout differ. The idea of one shared, read-only true and false is the same.

Other engines store booleans in other ways. Each row below is one engine. It says how that engine stores true and false, and which source file shows it.

In JavaScriptCore, Safari's engine, comments in JSCJSValue.h list False: 0x06 and True: 0x07. These are not pointers. The stored value itself is the number 0x06 or 0x07. In SpiderMonkey, Firefox's engine, Value.h defines the type mark JSVAL_TYPE_BOOLEAN. It stores the boolean as the number uint32_t(b): 0 or 1.

Where variables keep their booleans

When a function runs, V8 gives that call a stack frame: a block of memory for that one call. V8's interpreter is the part of V8 that runs your code one small step at a time. It keeps each local variable in a register, a numbered slot in the stack frame.

When a slot holds a boolean, it holds a pointer to #true or #false. Object properties and array items work the same way. Because there is only one true, === between two booleans can come down to one question: do both pointers point to the same place? V8 first checks that both values really are booleans.

1const flags = [true, false, true];2console.log(flags[0] === true);3console.log(flags[1] === false);4console.log(flags.length);

Line 1 makes an array of three booleans. Lines 2 and 3 each print true: the items are the usual true and false. Line 4 prints 3, the length of the array.

1const flags = [true, false];2%DebugPrint(flags);

In Node 22 (V8 12.4), %DebugPrint([true, false]) reports PACKED_ELEMENTS. That is V8's name for an array of any values with no gaps. V8 has no special kind of array just for booleans. The items print as <true> and <false>: pointers to the same two oddballs. For the bigger memory picture, see Stack and heap and Heap layout.

1function chooseBadge(score) {2  const passed = score >= 70;3  const needsReview = !passed;4  const pair = [passed, needsReview];5  return { passed, needsReview, firstSlot: pair[0] };6}7 8console.log(chooseBadge(82));Run

Press Step to walk through the replay. It runs the real code and shows the real values. The box beside it is a simple model of memory. It does not read real memory addresses from the engine.

How V8 turns any value into true or false

An if needs a yes-or-no answer. When you write if (value), JavaScript first turns value into true or false. The language rules call this step ToBoolean. The rules are a short table. These values become false:

• undefined and null.
• false.
• The numbers +0, -0, and NaN.
• BigInt zero, 0n.
• The empty string, "".

Almost every other value becomes true. One odd exception, document.all, comes up below. Values that become false are called falsy. The rest are called truthy. V8 follows this table, with quick checks for the most common values.

1const value = true;2console.log(Boolean(value));3if (value) {4  console.log("truthy branch");5} else {6  console.log("falsy branch");7}

V8's checks use two words from the value-representation lesson. A Smi is a small whole number stored right in the slot. A heap number is a number stored as its own object on the heap.

An undetectable object has a special bit on its map, and V8 treats it as falsy. Only null, undefined, and objects like the old document.all have this bit. That is how document.all can be falsy even though it is an object. Node has an internal helper, %GetUndetectable(), that makes such an object. The lesson test uses it to check that the object is falsy. Treat document.all as an old browser exception. Don't copy the idea in your own code.

The instructions V8 runs for an if

V8 doesn't run your source text directly. First it turns each function into bytecode: a list of small, simple instructions. V8's interpreter, called Ignition, runs those instructions one at a time. Each instruction has a short name, called a mnemonic. For example, Ldar a0 loads the first argument, a0, so the next instruction can use it. Return ends the function.

For a decision, Ignition uses a jump: an instruction that skips to another place in the list. Which jump it uses depends on one question: is the value already true or false?

1function branchIf(x) {2  if (x) return "yes";3  return "no";4}5 6function lessIf(a, b) {7  if (a < b) return "lt";8  return "ge";9}10 11function doubleBang(x) {12  return !!x;13}14 15function notValue(x) {16  return !x;17}18 19function notLess(a, b) {20  return !(a < b);21}22 23function andValue(a, b) {24  return a && b;25}26 27function strictTrue(x) {28  return x === true;29}

Each function holds one pattern: if (x), if (a < b), !!x, !x, !(a < b), a && b, and x === true. Below is the bytecode Node printed for each one. Only the mnemonics are kept. Memory addresses and instruction positions change from run to run, so they are left out. a0 and a1 mean the first and second argument.

1branchIf:2Ldar a03JumpIfToBooleanFalse4Return5 6lessIf:7Ldar a18TestLessThan a09JumpIfFalse10Return11 12doubleBang:13Ldar a014ToBoolean15Return16 17notValue:18Ldar a019ToBooleanLogicalNot20Return21 22notLess:23Ldar a124TestLessThan a025LogicalNot26Return27 28andValue:29Ldar a030JumpIfToBooleanFalse31Ldar a132Return33 34strictTrue:35LdaTrue36TestReferenceEqual a037Return

The key difference is if (x) versus if (a < b):

• if (x): x could be any value, so Ignition uses JumpIfToBooleanFalse. This one instruction turns the value into true or false, then jumps if it is false.
• if (a < b): TestLessThan compares the two values. Its result is already true or false. So JumpIfFalse jumps without converting anything.

The other functions follow the same idea:

• !!x uses ToBoolean: turn the value into true or false.
• !x uses ToBooleanLogicalNot: turn the value into a boolean, then flip it.
• !(a < b) uses LogicalNot right after the comparison, because the result is already a boolean.
• a && b uses JumpIfToBooleanFalse, the same jump as if (x).
• x === true loads true with LdaTrue. Then TestReferenceEqual checks: do both pointers point to the same place? That is what this Node build prints.

Pick a value below, then step through label(value). The replay shows which check decides the branch.

1function label(value) {2  if (value) {3    return "truthy path";4  }5  return "falsy path";6}7 8console.log(label(0));Run

1function label(value) {2  if (value) {3    return "truthy path";4  }5  return "falsy path";6}7 8console.log(label(0));

Fast code can use a single bit

Bytecode always works with tagged values: pointers to #true and #false. For code that runs many times, V8 has a second compiler called TurboFan. It turns busy functions into fast machine code: instructions the computer's processor runs directly.

TurboFan can store a value in a smaller form. It calls each form a representation. The file machine-type.h defines MachineRepresentation::kBit: a single bit, 0 or 1. In representation-change.cc, ChangeBitToTagged turns a bit into a tagged boolean, and ChangeTaggedToBit goes the other way.

1MachineRepresentation::kBit2RepresentationChanger::InsertChangeBitToTagged3RepresentationChanger::GetBitRepresentationFor / ChangeTaggedToBit

So fast code can keep the result of a comparison as 0 or 1 in a CPU register. That is a tiny storage spot inside the processor, not the interpreter's register from earlier. Fast code only makes the real true or false pointer when your JavaScript needs to see the value, for example to store it or print it. This is how V8's compiler is designed. Your page can't see that register.

These three things are easy to mix up. Each row below says what one of them is and where you meet it.

Boolean objects made with new

Boolean(x) without new runs ToBoolean. It gives back true or false: one of the two shared values. new Boolean(x) is different. It makes a new wrapper object on the heap: an object that holds a boolean inside it. The wrapper is an object, and every object is truthy. So the wrapper is truthy even when it holds false.

1const primitive = Boolean(false);2const boxed = new Boolean(false);3 4console.log(primitive, typeof primitive);5console.log(Boolean(boxed), typeof boxed);6console.log(boxed.valueOf());

Line 1 stores the plain value false. Line 2 makes a wrapper object around false. Line 4 prints false boolean. Line 5 prints true object: the wrapper is truthy, and its type is object. Line 6 calls valueOf(), which gives back the value inside the wrapper, so it prints false.

1const boxed = new Boolean(false);2%DebugPrint(boxed);3%DebugPrint(Boolean(false));

The lesson test runs this in Node and checks the parts that are the same on every run:

• [JSPrimitiveWrapper], V8's name for a wrapper object.
• A value: field that points to <false>.
• [Oddball] in ReadOnlySpace: #false for the plain value on line 3.

Using this in real code

What does all this mean for everyday code?

• Don't try to speed up !!value versus Boolean(value). Both give the same result. Pick the one that is clearer to read.
• Don't use new Boolean. It makes a truthy object, and readers won't expect that.
• For millions of yes-or-no flags, think about memory and measure it. A normal array stores a pointer for each item. A typed array or a bitset stores small numbers instead.

A typed array holds numbers of one fixed size. Each item in a Uint8Array takes one byte. A bitset packs 8 flags into each byte, one bit per flag.

1const featureFlags = [true, false, true, true];2const packed = new Uint8Array([1, 0, 1, 1]);3 4console.log(featureFlags.filter(Boolean).length);5console.log(packed.reduce((sum, bit) => sum + bit, 0));6console.log("model bytes", featureFlags.length * 8, packed.byteLength);

Line 1 stores four flags as booleans. Line 2 stores the same flags as the numbers 1 and 0 in a Uint8Array. Line 4 counts the true flags: filter(Boolean) keeps only the truthy items, so it prints 3. Line 5 adds up the numbers and also prints 3. Line 6 prints model bytes 32 4.

Line 6 is only a rough model. It counts 8 bytes per array item, the size of one pointer here, so 4 items make 32 bytes. packed.byteLength is the real size of the typed array's data: 4 bytes. Real arrays also need a header, storage for their items, and extra space that differs between engines. Pointer compression changes the sizes too. Before you change real code, measure with heap snapshots or speed tests.

Common misconceptions

• “A boolean is a wrapper object.” No. A boolean is a pointer to one of the two shared oddballs. Only new Boolean makes a wrapper object.
• “Every if runs the same slow conversion.” No. A comparison already gives a boolean, so the bytecode can use JumpIfFalse with no conversion.
• “Fast code's 0/1 bits are numbers your code can see.” No. They exist only inside the compiler. When your code reads the value, V8 turns it into true or false.
• “new Boolean(false) acts like false in an if.” No. It is an object, so it is truthy.
• “Node and Chrome store values in exactly the same way.” No. Node 22 here has pointer compression turned off. Chrome uses a newer V8 with pointer compression and the sandbox.

Key takeaways

• In V8 12.4, true and false are two shared oddballs in read-only memory.
• Variables, object properties, and array items hold pointers to those two values.
• ToBoolean comes from the language rules. V8 runs it with quick checks for Smis, fixed values, strings, heap numbers, and BigInts.
• Ignition uses JumpIfToBooleanFalse for a general if (x), and a plain JumpIfFalse after a comparison.
• TurboFan can keep a boolean as a single bit (kBit) until your code needs the real true or false.
• new Boolean(false) makes a truthy object. Don't use it in your code.

One-liner: V8 has one true and one false; every boolean points to one of them, and conversions and jumps decide which one.

Up next: undefined inside the engine. undefined is another oddball. You'll meet gaps in arrays, the check for using a variable too early, missing properties, and the LdaUndefined instruction.