The specification, the engine and the host

Three separate things have to line up before a line of JavaScript does anything, and only one of them is the language.

Somebody tells you that JavaScript has a thing called alert that pops up a message box. You try it here and the program stops, complaining that alert is not defined. Neither of you is lying, and this is the single most common source of confusion for people learning this language.

What people call JavaScript is three separate things stacked on top of each other. Only the bottom one is the same everywhere. Before naming them, ask this particular place what it happens to have.

You do not need to understand every character of that yet. It walks down a list of names and asks, for each one, whether the surrounding world has anything by that name. Five of the seven are here. document and window are not.

Notice which ones survived. Math and JSON and Date are here. So are console and setTimeout, which is interesting, because those two are not part of JavaScript at all. Here is what each layer is.

Layer one: ECMAScript, the specification

A specification is a document that says exactly what a language means. JavaScript's is called ECMAScript, published by a standards body called Ecma International as standard ECMA-262, and revised once a year. It is free to read and it is the final authority: when two programs disagree about what a line of JavaScript does, one of them is wrong, and this document says which.

The specification defines the grammar (where brackets and semicolons go), the eight types of value, and a small standard library: Math, JSON, Date, String, Array, Object, Promise and a few dozen more. That is the whole language.

It defines no way to draw anything on a screen, no way to open a file, no way to send a message over a network, and no way to wait for a second. Not one of those is in the document.

Layer two: an engine

An engine is a program that reads JavaScript source text and carries it out, implementing what the specification says. There are four you will hear about: V8 (used by Chrome, Node.js and Deno), SpiderMonkey (Firefox), JavaScriptCore (Safari and Bun), and ChakraCore (retired, from old Edge).

An engine on its own is not much use. It can add numbers and sort text, and it has no way to tell you the answer, because printing is not part of the language either.

Layer three: a host

A host is the larger program that embeds an engine and hands it everything the specification left out. A web browser is a host: it supplies document, window, alert and fetch. Node.js is a host: it supplies process, require and a file system. This page is a host too, and a deliberately small one, which is why document came back absent.

This explains setTimeout, which is the example worth remembering. Every host provides it, so it feels like part of the language, and the specification has never once mentioned it. In a browser it comes from the HTML standard; in Node.js it comes from Node's own timers. Two different implementations that agree closely enough that nobody notices.

What this buys you

The parts that come from the specification behave identically wherever you run them. Every line below is pure language, so it gives the same answer in a browser, in Node.js, and in the box on this page.

The parts that come from the host do not. That is not a flaw to work around; it is the arrangement. A browser needs a way to draw and Node.js needs a way to open a file, and neither belongs in a language definition.

There is a safe way to ask whether something is present. Asking for document directly stops the program; asking typeof document never does, whatever the answer.

typeof gives back a short piece of text describing what something is. The lesson on the eight types covers it properly. For now it is the polite way to knock on a door.