Interesting. I wonder if an even more effective approach to unobfuscation would be an "anti-jit" compiler; since what we're interested in is the actual execution flow, can we leverage all the browser's optimization engine to pull that out for us?
Do the various JIT engines use an intermediate representation (IR) and what does it look like?
V8 starts with interpreting bytecode (Ignition), then hot code gets tiered up to a non-optimising JIT without an IR (Sparkplug), and even hotter code goes an optimising one with an IR (TurboFan)
That way it can start executing quickly and not waste time on compiling/optimising things that only get run a few times
Do the various JIT engines use an intermediate representation (IR) and what does it look like?