Optimizing javascript through speculative execution is to speculate on type and produce optimizations based on those speculation.
Profiling is the act of speculating and will allow you to optimize JS execution better.
There are various ways of doing that. You can speculate on the type of variables on each appearance and then chose a path to an optimized code for that type of the slow path if the speculation fails (diamond speculation). The technique used by JavaSciptCore is OSR (On Stack Replacement). It will speculate and definitly exit a optimized path on failing. Exiting is fast and easy, reentry to the optimized path is slow and hard.
JavaScriptCore (the Safari JS VM) has a 4 tier interpreter/compiler infrastructure. JavaScriptCore (JSC) first compile the javascript into the VM bytecode. Then this bytecode get interpreted by LLint (Low Level Interpreter) which does not perfom optimization, just execute and profile the code for the next tier. The next tier is the basline JIT which will convert the bytec