Optimizing javascript through speculative execution is to speculate on type and produce optimizations based on those speculation.
Profiling is the act of speculating and will allow you to optimize JS execution better.
There are various ways of doing that. You can speculate on the type of variables on each appearance and then chose a path to an optimized code for that type of the slow path if the speculation fails (diamond speculation). The technique used by JavaSciptCore is OSR (On Stack Replacement). It will speculate and definitly exit a optimized path on failing. Exiting is fast and easy, reentry to the optimized path is slow and hard.
JavaScriptCore (the Safari JS VM) has a 4 tier interpreter/compiler infrastructure. JavaScriptCore (JSC) first compile the javascript into the VM bytecode. Then this bytecode get interpreted by LLint (Low Level Interpreter) which does not perfom optimization, just execute and profile the code for the next tier. The next tier is the basline JIT which will convert the bytecode to equivalent machine code using templates. The next tier is the DFG JIT (Data Flow Graph) which perform some optimization at the cost of compile time. The trade off being in favor of compile time. Finally, the last tier is the FTL JIT (Faster Than Light) which is a compiler like DGF but is more aggressive in its optimization, which means it will take more time to compile.