Booleans inside the engine

Booleans are oddball roots

In JavaScript you see two primitive boolean values: true and false. Inside V8 12.4, those two values are two pre-built heap objects called oddballs. A variable that holds a boolean carries a tagged reference to one of those roots. Writing true, writing false, or computing a < b does not allocate a public Boolean object.

This lesson builds directly on Tagged values, Smis & heap numbers. If you want the beginner truthy/falsy rules first, read Booleans & truthiness.

1const first = true;2const second = 3 < 5;3console.log(first, second);4console.log(typeof first);5console.log(Boolean("non-empty"));

Line 1 uses a literal. Line 2 computes a comparison. Both print as normal primitive booleans on line 3, and typeof on line 4 stays "boolean".

true and false in read-only space

V8's oddball header says: “The Oddball describes objects null, undefined, true, and false.” It lists cached fields for to_number_raw, to_string, to_number, type_of, and kind. The same file defines kFalse = 0, kTrue = 1, and kNotBooleanMask = ~1. In oddball-inl.h, IsBoolean checks (kind & kNotBooleanMask) == 0, so only kinds 0 and 1 pass.

1%DebugPrint(true);2%DebugPrint(false);3%DebugPrint(1 < 2);

The test runs that snippet with node --allow-natives-syntax. It asserts the stable pieces: [Oddball] in ReadOnlySpace: #true, [Oddball] in ReadOnlySpace: #false, the same map address within one run, and no undetectable flag on the boolean map. A comparison result such as 1 < 2 prints as the same #true oddball.

V8's static roots article explains why roots such as undefined and true live in the read-only heap and are loaded from the startup snapshot. For the startup cost side of snapshots, connect this to Startup performance. Node 22 here uses V8 12.4 without pointer compression; Chrome has newer V8 builds with pointer compression and the sandbox, so addresses and layout details differ. The read-only root idea is the shared design.

For contrast, JavaScriptCore's JSCJSValue.h comments list False: 0x06 and True: 0x07. Mozilla's Value.h defines JSVAL_TYPE_BOOLEAN and sets a boolean payload with uint32_t(b).

Stack slots, registers, and heap pointers

The interpreter stores locals in register slots inside a stack frame. When a slot holds a primitive boolean, the value is a tagged reference to #true or #false. Object fields and array elements work the same way. Strict equality between primitive booleans can be the same-root comparison after type checks.

1const flags = [true, false, true];2console.log(flags[0] === true);3console.log(flags[1] === false);4console.log(flags.length);

1const flags = [true, false];2%DebugPrint(flags);

In Node 22/V8 12.4, %DebugPrint([true, false]) reports PACKED_ELEMENTS, not a special boolean elements kind. The elements print as <true> and <false>. Link this model back to Stack and heap and Heap layout for the broader memory picture.

1function chooseBadge(score) {2  const passed = score >= 70;3  const needsReview = !passed;4  const pair = [passed, needsReview];5  return { passed, needsReview, firstSlot: pair[0] };6}7 8console.log(chooseBadge(82));Run

The replay records real JavaScript values. The side memory pane is deliberately labelled as a teaching model; it is not an engine debugger and does not inspect raw addresses.

ToBoolean inside V8

ECMAScript defines ToBoolean as a table: undefined, null, false, +0, -0, NaN, 0n, and the empty string are false; most other values are true. V8 then implements fast source-level paths for that table.

1const value = true;2console.log(Boolean(value));3if (value) {4  console.log("truthy branch");5} else {6  console.log("falsy branch");7}

The undetectable map bit is why V8 can make document.all-style legacy objects falsey; Node's internal %GetUndetectable() probe verifies the behavior, but regular application code should treat document.all as a web-compatibility exception, not a pattern to copy.

Ignition bytecode for boolean decisions

V8's interpreter, Ignition, uses different bytecodes depending on whether a value still needs ToBoolean or is already a boolean-like comparison result. The lesson stores mnemonic-only listings because bytecode offsets and addresses are not stable.

1function branchIf(x) {2  if (x) return "yes";3  return "no";4}5 6function lessIf(a, b) {7  if (a < b) return "lt";8  return "ge";9}10 11function doubleBang(x) {12  return !!x;13}14 15function notValue(x) {16  return !x;17}18 19function notLess(a, b) {20  return !(a < b);21}22 23function andValue(a, b) {24  return a && b;25}26 27function strictTrue(x) {28  return x === true;29}

1branchIf:2Ldar a03JumpIfToBooleanFalse4Return5 6lessIf:7Ldar a18TestLessThan a09JumpIfFalse10Return11 12doubleBang:13Ldar a014ToBoolean15Return16 17notValue:18Ldar a019ToBooleanLogicalNot20Return21 22notLess:23Ldar a124TestLessThan a025LogicalNot26Return27 28andValue:29Ldar a030JumpIfToBooleanFalse31Ldar a132Return33 34strictTrue:35LdaTrue36TestReferenceEqual a037Return

The important contrast is if (x) versus if (a < b). A general value uses JumpIfToBooleanFalse. A comparison uses TestLessThan and then JumpIfFalse because the comparison result is already one of the boolean values. !!x uses ToBoolean; !x uses ToBooleanLogicalNot; !(a < b) uses LogicalNot after the comparison; a && b uses JumpIfToBooleanFalse; and x === true loads true then runs TestReferenceEqual in this Node build.

1function label(value) {2  if (value) {3    return "truthy path";4  }5  return "falsy path";6}7 8console.log(label(0));Run

1function label(value) {2  if (value) {3    return "truthy path";4  }5  return "falsy path";6}7 8console.log(label(0));

Optimized code can use one bit

Interpreter bytecode still deals in tagged values. TurboFan, V8's optimizing compiler, can choose lower-level machine representations. machine-type.h defines MachineRepresentation::kBit. In representation-change.cc, ChangeBitToTagged and ChangeTaggedToBit appear in the paths that cross between a compiler bit and a tagged boolean.

1MachineRepresentation::kBit2RepresentationChanger::InsertChangeBitToTagged3RepresentationChanger::GetBitRepresentationFor / ChangeTaggedToBit

That means optimized code can keep a comparison result as a 0/1 value in a CPU register and materialize the tagged true or false pointer only when the value escapes to observable JavaScript. This is a compiler design fact; the page cannot observe that register directly.

Boolean wrapper objects

Boolean(x) without new returns the primitive oddball result of ToBoolean. new Boolean(x) allocates a wrapper object on the heap. That wrapper has an internal primitive value, but the wrapper itself is an object, so it is truthy even when it wraps false.

1const primitive = Boolean(false);2const boxed = new Boolean(false);3 4console.log(primitive, typeof primitive);5console.log(Boolean(boxed), typeof boxed);6console.log(boxed.valueOf());

1const boxed = new Boolean(false);2%DebugPrint(boxed);3%DebugPrint(Boolean(false));

The Node probe asserts stable text: [JSPrimitiveWrapper], a value: field pointing at <false>, and a later [Oddball] in ReadOnlySpace: #false for the primitive result.

Practical use

Do not micro-optimize !!value versus Boolean(value). Pick the form that communicates intent. Do avoid new Boolean; it creates a truthy object and surprises readers. For millions of dense flags, model memory honestly and measure: a normal array stores references to values, while a typed array or bitset stores compact numeric flags.

1const featureFlags = [true, false, true, true];2const packed = new Uint8Array([1, 0, 1, 1]);3 4console.log(featureFlags.filter(Boolean).length);5console.log(packed.reduce((sum, bit) => sum + bit, 0));6console.log("model bytes", featureFlags.length * 8, packed.byteLength);

The model bytes line is intentionally labelled: it uses eight bytes per array slot as a simplified reference-size model and compares that with Uint8Array#byteLength. Real arrays have headers, elements backing stores, pointer compression differences, and engine-specific overhead, so use heap snapshots or benchmarks for production decisions.

Common misconceptions

• “A primitive boolean is a wrapper object.” No. V8 primitives point at oddballs; wrappers are allocated by new Boolean.
• “Every condition calls the same slow conversion.” No. Comparisons already produce booleans, so bytecode can use JumpIfFalse.
• “Optimized 0/1 bits are observable JavaScript numbers.” No. They are compiler internals that must materialize as tagged booleans when observed.
• “new Boolean(false) behaves like false in an if.” No. It is an object, so it is truthy.
• “Node and Chrome expose the same internal layout.” No. Node 22 here has pointer compression off; Chrome uses newer V8 with pointer compression and sandboxing.

Key takeaways

• V8 12.4 stores primitive true and false as read-only oddball roots.
• Stack slots, registers, object fields, and array elements hold tagged references to those roots.
• ToBoolean is specified by ECMAScript and implemented in V8 with fast paths for Smis, roots, maps, strings, HeapNumbers, and BigInts.
• Ignition uses JumpIfToBooleanFalse for general conditions and direct boolean tests after comparisons.
• TurboFan can keep boolean-like values as kBit until it must materialize a tagged boolean.
• new Boolean(false) allocates a truthy wrapper object; avoid it in application code.

One-liner: Primitive booleans are two shared engine roots; conversions and bytecodes decide when code points at #true or #false.

Up next: undefined inside the engine, where another oddball meets holes, TDZ checks, missing properties, and LdaUndefined.