DEV Community: 灰豆

Let’s Understand Chrome V8--Chapter 21: Compiler Workflow: Token, AST

灰豆 — Tue, 11 Oct 2022 02:13:40 +0000

Original source: https://javascript.plainenglish.io/lets-understand-chrome-v8-compiler-workflow-token-ast-8f629bd79803
Welcome to other chapters of Let’s Understand Chrome V8

In the last article, we talked about the parser, we knew that the scanner is passive and needs to be waked up by the parser. Here, I go on with walking you through the compiler workflow, watching tokens, and AST in detail.

1. Scanner and Token

The following function is responsible for generating AST, it contains the scanner initialization, scanner execution, and parser token, where you can watch compiler workflow in detail.

1.  FunctionLiteral* Parser::ParseProgram(Isolate* isolate, ParseInfo* info) {
2.  //omit.................
3.    scanner_.Initialize();
4.    scanner_.SkipHashBang();
5.    FunctionLiteral* result = DoParseProgram(isolate, info);
6.    MaybeResetCharacterStream(info, result);
7.    MaybeProcessSourceRanges(info, result, stack_limit_);
8.    HandleSourceURLComments(isolate, info->script());
9.  //omit..................
10.    return result;
11.  }

Line 3 is the scanner initialization, below is the source code.

1.  void Scanner::Initialize() {
2.    Init();
3.    next().after_line_terminator = true;
4.    Scan();
5.  }

In line 3, the Init() initializes the scanner. In line 5, the Scan() generates only a token, remember that the scanner is driven by the parser, this token is used to wake up the parser first and then trigger a token-cache miss in soon, ends up starting the compiler pipeline. Let's examine the Init() in more depth.

1.  void Init() {
2.    Advance();
3.    current_ = &token_storage_[0];
4.    next_ = &token_storage_[1];
5.    next_next_ = &token_storage_[2];
6.    found_html_comment_ = false;
7.    scanner_error_ = MessageTemplate::kNone;
8.  }
9.  //.........................
10.  template <bool capture_raw = false>
11.  void Advance() {
12.    if (capture_raw) {
13.      AddRawLiteralChar(c0_);
14.    }
15.    c0_ = source_->Advance();
16.  }
17.  //................
18.  inline uc32 Advance() {
19.     uc32 result = Peek();
20.     buffer_cursor_++;
21.     return result;
22.   }
23.   //...................
24.   inline uc32 Peek() {
25.     if (V8_LIKELY(buffer_cursor_ < buffer_end_)) {
26.       return static_cast<uc32>(*buffer_cursor_);
27.     } else if (ReadBlockChecked()) {
28.       return static_cast<uc32>(*buffer_cursor_);
29.     } else {
30.       return kEndOfInput;
31.     }
32.   }

In line 2, the Advance() gets out a character from JavaScript code that you as developers are writing actually.
Line 11 shows the Advance() source code. In line 15, the keyword c0_ points to the next character that the Advance() will take out. The definition of source_->Advance is at line 18. Please look at line 24, the Peek() is the actual function that gets out a character from your JavaScript, since in lines 25-28, it is reading the buffer stream that holds your JavaScript.
Back to void Scanner::Initialize(), let's dive into the Scan().

1.  void Scanner::Scan() { Scan(next_); }
2.  //....................
3.  void Scanner::Scan(TokenDesc* next_desc) {
4.    next_desc->token = ScanSingleToken();
5.    DCHECK_IMPLIES(has_parser_error(), next_desc->token == Token::ILLEGAL);
6.    next_desc->location.end_pos = source_pos();
7.  }
8.  //.....................
9.  V8_INLINE Token::Value Scanner::ScanSingleToken() {
10.    Token::Value token;
11.    do {
12.      next().location.beg_pos = source_pos();
13.      if (V8_LIKELY(static_cast<unsigned>(c0_) <= kMaxAscii)) {
14.        token = one_char_tokens[c0_];
15.        switch (token) {//omit.....................
16.          case Token::IDENTIFIER:
17.            return ScanIdentifierOrKeyword();
18.          default:
19.            UNREACHABLE();
20.        }
21.      }
22.      if (IsIdentifierStart(c0_) ||
23.          (CombineSurrogatePair() && IsIdentifierStart(c0_))) {
24.        return ScanIdentifierOrKeyword();
25.      }
26.      if (c0_ == kEndOfInput) {
27.        return source_->has_parser_error() ? Token::ILLEGAL : Token::EOS;
28.      }
29.      token = SkipWhiteSpace();
30.      // Continue scanning for tokens as long as we're just skipping whitespace.
31.    } while (token == Token::WHITESPACE);
32.    return token;
33.  }

In line 4, the ScanSingleToken() uses the Advance() to get out characters one by one until meeting a terminator.

In our case, the started character is an f, we know that the f may mean the keyword function or a normal user-defined variable, depending on the next characters. Since our case is the keyword function, step into lines 16-17.

The fundamental of the scanner is the finite state automaton, V8 uses the pre-defined macro template and switch-case to scan characters and then organize related characters together as a token that will be filled into the cache.

Let's get a glance at the ScanIdentifierOrKeyword().

1.  V8_INLINE Token::Value Scanner::ScanIdentifierOrKeywordInner() {
2.    STATIC_ASSERT(arraysize(character_scan_flags) == kMaxAscii + 1);
3.    if (V8_LIKELY(static_cast<uint32_t>(c0_) <= kMaxAscii)) {
4.      if (V8_LIKELY(c0_ != '\\')) {
5.        uint8_t scan_flags = character_scan_flags[c0_];
6.        DCHECK(!TerminatesLiteral(scan_flags));
7.  //omit....................
8.         AdvanceUntil([this, &scan_flags](uc32 c0) {
9.           if (V8_UNLIKELY(static_cast<uint32_t>(c0) > kMaxAscii)) {
10.              scan_flags |=
11.                  static_cast<uint8_t>(ScanFlags::kIdentifierNeedsSlowPath);
12.              return true;
13.            }
14.            uint8_t char_flags = character_scan_flags[c0];
15.            scan_flags |= char_flags;
16.          });
17.          if (V8_LIKELY(!IdentifierNeedsSlowPath(scan_flags))) {
18.             //omit...................
19.          }
20.          can_be_keyword = CanBeKeyword(scan_flags);
21.        } else {
22.    //omit................
23.        }
24.      }
25.      return ScanIdentifierOrKeywordInnerSlow(escaped, can_be_keyword);
26.    }

The ScanIdentifierOrKeywordInner() generates one token at one execution.

2 Generate AST

The DoParseProgram() is responsible for generating AST tree.

1.  FunctionLiteral* Parser::DoParseProgram(Isolate* isolate, ParseInfo* info) {
2.    ParsingModeScope mode(this, allow_lazy_ ? PARSE_LAZILY : PARSE_EAGERLY);
3.    FunctionLiteral* result = nullptr;
4.    {
5.      DeclarationScope* scope = outer->AsDeclarationScope();
6.      scope->set_start_position(0);
7.      FunctionState function_state(&function_state_, &scope_, scope);
8.      ScopedPtrList<Statement> body(pointer_buffer());
9.      int beg_pos = scanner()->location().beg_pos;
10.      if (parsing_module_) {
11.  //omit................
12.      } else if (info->is_wrapped_as_function()) {
13.        ParseWrapped(isolate, info, &body, scope, zone());
14.      } else {
15.        this->scope()->SetLanguageMode(info->language_mode());
16.        ParseStatementList(&body, Token::EOS);
17.      }
18.      scope->set_end_position(peek_position());
19.      if (is_strict(language_mode())) {
20.        CheckStrictOctalLiteral(beg_pos, end_position());
21.      }
22.      if (is_sloppy(language_mode())) {
23.        InsertSloppyBlockFunctionVarBindings(scope);
24.      }
25.      if (info->is_eval()) {
26.        DCHECK(parsing_on_main_thread_);
27.        info->ast_value_factory()->Internalize(isolate);
28.      }
29.      CheckConflictingVarDeclarations(scope);
30.    }
31.    info->set_max_function_literal_id(GetLastFunctionLiteralId());
32.    return result;
33.  }

Line 2 get out lazy option, in default, lazy is true and is defined in flag-definitions.h. Line 8 creates an empty AST body.
In line 16, the ParseStatementList() parses tokens and generates AST.

1.  void ParserBase<Impl>::ParseStatementList(StatementListT* body,
2.                                            Token::Value end_token) {
3.    DCHECK_NOT_NULL(body);
4.    while (peek() == Token::STRING) {
5.  //omit.........
6.    }
7.    TargetScopeT target_scope(this);
8.    while (peek() != end_token) {
9.      StatementT stat = ParseStatementListItem();
10.      if (impl()->IsNull(stat)) return;
11.      if (stat->IsEmptyStatement()) continue;
12.      body->Add(stat);
13.    }
14.  }

In line 4, the peek() gets back the type of the current token. In our case, the first token is Token::FUNCTION which is neither Token::STRING nor end_token, so go into ParseStatementListItem().

1.  ParserBase<Impl>::ParseStatementListItem() {
2.    switch (peek()) {
3.      case Token::FUNCTION:
4.        return ParseHoistableDeclaration(nullptr, false);
5.      case Token::CLASS:
6.        Consume(Token::CLASS);
7.        return ParseClassDeclaration(nullptr, false);
8.      case Token::VAR:
9.      case Token::CONST:
10.        return ParseVariableStatement(kStatementListItem, nullptr);
11.      case Token::LET:
12.        if (IsNextLetKeyword()) {
13.          return ParseVariableStatement(kStatementListItem, nullptr);
14.        }
15.        break;
16.      case Token::ASYNC:
17.        if (PeekAhead() == Token::FUNCTION &&
18.            !scanner()->HasLineTerminatorAfterNext()) {
19.          Consume(Token::ASYNC);
20.          return ParseAsyncFunctionDeclaration(nullptr, false);
21.        }
22.        break;
23.      default:
24.        break;
25.    }
26.    return ParseStatement(nullptr, nullptr, kAllowLabelledFunctionStatement);
27.  }

In ParseStatementListItem, according to the Token type, do the next actions. Precisely, the ParseStatementListItem also is a finite state automaton which uses pre-defined macro templates and switch-case to match and analyze characters.
Figure 1 shows the call stack.

In JavaScript, a statement may be a variable definition, a function, or a statement block, so the ParseStatementListItem() recursively calls itself frequently.

Takeaways
(1) The fundamental of the compiler is used the finite state automaton to analyze characters. Specifically, V8 uses macro templates and switch-case;

(2) The compiler's minimal granularity is a JavaScript function;

(3) Since lazy compilation is here, a function is compiled when it will execute in soon;

(4) The FunctionLiteral holds the AST tree that represents your JavaScript function;

(5) The following is the macro template that defines Token.

1.  #define IGNORE_TOKEN(name, string, precedence)
2.  /* Binary operators */
3.  /* ADD and SUB are at the end since they are UnaryOp */
4.  #define BINARY_OP_TOKEN_LIST(T, E) \
5.  #define EXPAND_BINOP_ASSIGN_TOKEN(T, name, string, precedence) \
6.    T(ASSIGN_##name, string "=", 2)
7.  #define EXPAND_BINOP_TOKEN(T, name, string, precedence) \
8.    T(name, string, precedence)
9.  #define TOKEN_LIST(T, K)                                           \
10.    T(TEMPLATE_SPAN, nullptr, 0)                                     \
11.    T(TEMPLATE_TAIL, nullptr, 0)                                     \
12.    /* BEGIN Property */                                             \
13.    T(PERIOD, ".", 0)                                                \
14.    T(LBRACK, "[", 0)                                                \
15.    /* END Property */                                               \
16.    /* END Member */                                                 \
17.    T(QUESTION_PERIOD, "?.", 0)                                      \
18.    T(LPAREN, "(", 0)                                                \
19.    /* END PropertyOrCall */                                         \

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8--Chapter 20: Compiler Workflow, Parser

灰豆 — Mon, 26 Sep 2022 07:04:55 +0000

Original source: https://javascript.plainenglish.io/lets-understand-chrome-v8-compiler-workflow-parser-36941d0ff204
Welcome to other chapters of Let’s Understand Chrome V8

In the past articles, we talked a lot about the JavaScript compiler of V8. The parser, the scanner, and the bytecode, as well as their fundamentals, kernel code, and key structure, were all we covered.

In the next articles, we will walk through the compiler workflow, and watch how V8 transforms the JavaScript code into bytecode step by step.

Figure 1 shows the workflow, it starts from the JavaScript code you wrote, goes through the scanner and parser, and finally generates bytecodes.

Note: In this article, I use d8.exe instead of v8.exe, since d8.exe can print out to the terminal directly as well as the d8 is very light versus v8.

1. Read JavaScript code

Below is our test case：

function ignition(s) {
    this.slogan=s;
    this.start=function(){eval('console.log(this.slogan);')}
}
worker = new ignition("here we go!");
worker.start();

Below is the Execute() that is responsible for executing the JavaScript code. Quite simply, it first reads the JavaScript code from a file, then compiles and executes the code.

1.  bool SourceGroup::Execute(Isolate* isolate) {
2.  //............omit..................
3.      // Use all other arguments as names of files to load and run.
4.      HandleScope handle_scope(isolate);
5.      Local<String> file_name =
6.          String::NewFromUtf8(isolate, arg, NewStringType::kNormal)
7.              .ToLocalChecked();
8.      Local<String> source = ReadFile(isolate, arg);
9.      if (source.IsEmpty()) {
10.        printf("Error reading '%s'\n", arg);
11.        base::OS::ExitProcess(1);
12.      }
13.      Shell::set_script_executed();
14.      if (!Shell::ExecuteString(isolate, source, file_name, Shell::kNoPrintResult,
15.                                Shell::kReportExceptions,
16.                                Shell::kProcessMessageQueue)) {
17.        success = false;
18.        break;
19.      }
20.    }
21.    return success;
22.  }

In line 5, the NewFromUtf8 gets the file name which is our case. In line 8, the ReadFile gets file content which is our case actually.

1.  Local<String> Shell::ReadFile(Isolate* isolate, const char* name) {
2.  //only the most important parts..............................
3.    char* chars = static_cast<char*>(file->memory());
4.    Local<String> result;
5.    if (i::FLAG_use_external_strings && i::String::IsAscii(chars, size)) {
6.      String::ExternalOneByteStringResource* resource =
7.          new ExternalOwningOneByteStringResource(std::move(file));
8.      result = String::NewExternalOneByte(isolate, resource).ToLocalChecked();
9.    } else {
10.      result = String::NewFromUtf8(isolate, chars, NewStringType::kNormal, size)
11.                   .ToLocalChecked();
12.    }
13.    return result;
14.  }

Line 8 and line 10 return the JavaScript code depending on the type is ExternalOneByte or UTF8. Here, our case is UTF8, regarding String::ExternalOneByteStringResource, we will talk about it in the future.

Back to SourceGroup::Execute(), and step into Shell::ExecuteString at line 14, its source is given below:

1.  bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
2.                      Local<Value> name, PrintResult print_result,
3.                      ReportExceptions report_exceptions,
4.                      ProcessMessageQueue process_message_queue) {
5.      //omit............................
6.  bool success = true;
7.  {
8.    if (options.compile_options == ScriptCompiler::kConsumeCodeCache) {
9.      //omit............................
10.       } else if (options.stress_background_compile) {
11.     //omit............................
12.       } else {
13.         ScriptCompiler::Source script_source(source, origin);
14.         maybe_script = ScriptCompiler::Compile(context, &script_source,
15.                                                options.compile_options);
16.       }
17.       Local<Script> script;
18.       if (!maybe_script.ToLocal(&script)) {
19.         // Print errors that happened during compilation.
20.         if (report_exceptions) ReportException(isolate, &try_catch);
21.         return false;
22.       }
23.       if (options.code_cache_options ==
24.           ShellOptions::CodeCacheOptions::kProduceCache) {
25.     //omit............................
26.       }
27.       maybe_result = script->Run(realm);//here is executing bytecode.
28.  }
29.  }

In line 13, our JavaScript is wrapped into a variable script_source which includes the line and column offset. Since V8 only compiles the JavaScript function that is executing exactly not the full JavaScript code, the variable script_source help the compiler record the compilation information.

In line 14, start to compile JavaScript.

2. Parser initialization

In the workflow, the first part is the scanner, the second is the parser. Actually, the scanner is passive and the parser is active, this means that the parser takes out a token from the compilation cache actively, and the scanner is waked up by the parser once the cache miss, and to generate tokens and fill the cache.

Below is CompileUnboundInternal() called by ScriptCompiler::Compile that at above line 14.

1.  MaybeLocal<UnboundScript> ScriptCompiler::CompileUnboundInternal(
2.      Isolate* v8_isolate, Source* source, CompileOptions options,
3.      NoCacheReason no_cache_reason) {
4.  //omit...............
5.    i::Handle<i::String> str = Utils::OpenHandle(*(source->source_string));
6.    i::Handle<i::SharedFunctionInfo> result;
7.    i::Compiler::ScriptDetails script_details = GetScriptDetails(
8.        isolate, source->resource_name, source->resource_line_offset,
9.        source->resource_column_offset, source->source_map_url,
10.        source->host_defined_options);
11.    i::MaybeHandle<i::SharedFunctionInfo> maybe_function_info =
12.        i::Compiler::GetSharedFunctionInfoForScript(
13.            isolate, str, script_details, source->resource_options, nullptr,
14.            script_data, options, no_cache_reason, i::NOT_NATIVES_CODE);
15.    if (options == kConsumeCodeCache) {
16.      source->cached_data->rejected = script_data->rejected();
17.    }
18.    delete script_data;
19.    has_pending_exception = !maybe_function_info.ToHandle(&result);
20.    RETURN_ON_FAILED_EXECUTION(UnboundScript);
21.    RETURN_ESCAPED(ToApiHandle<UnboundScript>(result));
22.  }

The above function generates the UnboundInternal stuff, the line 11 tells us that the stuff is just a Sharedfunction actually. But, what is Bind? A Sharedfunction cannot be executed directly, V8 needs to match a context to the Sharedfunction, the “match” is just the bing.

Let’s step into GetSharedFunctionInfoForScript.

1.  MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
2.      Isolate* isolate, Handle<String> source,
3.      const Compiler::ScriptDetails& script_details,
4.   .................) {
5.  //omit.........................
6.          {
7.      maybe_result = compilation_cache->LookupScript(
8.          source, script_details.name_obj, script_details.line_offset,
9.          script_details.column_offset, origin_options, isolate->native_context(),
10.          language_mode);
11.    }
12.    if (maybe_result.is_null()) {
13.      ParseInfo parse_info(isolate);
14.      // No cache entry found compile the script.
15.      NewScript(isolate, &parse_info, source, script_details, origin_options,
16.                natives);
17.      // Compile the function and add it to the isolate cache.
18.      if (origin_options.IsModule()) parse_info.set_module();
19.      parse_info.set_extension(extension);
20.      parse_info.set_eager(compile_options == ScriptCompiler::kEagerCompile);
21.      parse_info.set_language_mode(
22.          stricter_language_mode(parse_info.language_mode(), language_mode));
23.      maybe_result = CompileToplevel(&parse_info, isolate, &is_compiled_scope);
24.      Handle<SharedFunctionInfo> result;
25.      if (extension == nullptr && maybe_result.ToHandle(&result)) {
26.        DCHECK(is_compiled_scope.is_compiled());
27.        compilation_cache->PutScript(source, isolate->native_context(),
28.                                     language_mode, result);
29.      } else if (maybe_result.is_null() && natives != EXTENSION_CODE) {
30.        isolate->ReportPendingMessages();
31.      }
32.    }
33.    return maybe_result;
34.  }

Line 7 is looking up the compilation cache, that I mentioned in the last article.

Line 13, the parse_info is a wrapper for Parser, like the variable script_source mentioned upfront.

Line 15, the Parser_info initialization, code is given below:

1.  Handle<Script> NewScript(Isolate* isolate, ParseInfo* parse_info,
2.                           Handle<String> source,
3.                           Compiler::ScriptDetails script_details,
4.                           ScriptOriginOptions origin_options,
5.                           NativesFlag natives) {
6.    Handle<Script> script =
7.        parse_info->CreateScript(isolate, source, origin_options, natives);
8.    Handle<Object> script_name;
9.    if (script_details.name_obj.ToHandle(&script_name)) {
10.      script->set_name(*script_name);
11.      script->set_line_offset(script_details.line_offset);
12.      script->set_column_offset(script_details.column_offset);
13.    }
14.    Handle<Object> source_map_url;
15.    if (script_details.source_map_url.ToHandle(&source_map_url)) {
16.      script->set_source_mapping_url(*source_map_url);
17.    }
18.    Handle<FixedArray> host_defined_options;
19.    if (script_details.host_defined_options.ToHandle(&host_defined_options)) {
20.      script->set_host_defined_options(*host_defined_options);
21.    }
22.    return script;
23.  }

From line 6 to line 12 wrap the JavaScript code that is our case into the variable script, then initialize the line_offset and column_offset. It is like the script_source really as I said.

Back to Compiler::GetSharedFunctionInfoForScript(), and step into CompileToplevel() at line 23.

1.  MaybeHandle<SharedFunctionInfo> CompileToplevel(
2.      ParseInfo* parse_info, Isolate* isolate,
3.      IsCompiledScope* is_compiled_scope) {
4.  //omit.......................
5.    if (parse_info->literal() == nullptr &&
6.        !parsing::ParseProgram(parse_info, isolate)) {
7.      return MaybeHandle<SharedFunctionInfo>();
8.    }
9.  //omit........................
10.    MaybeHandle<SharedFunctionInfo> shared_info =
11.        GenerateUnoptimizedCodeForToplevel(
12.            isolate, parse_info, isolate->allocator(), is_compiled_scope);
13.    if (shared_info.is_null()) {
14.      FailWithPendingException(isolate, parse_info,
15.                               Compiler::ClearExceptionFlag::KEEP_EXCEPTION);
16.      return MaybeHandle<SharedFunctionInfo>();
17.    }
18.    FinalizeScriptCompilation(isolate, parse_info);
19.    return shared_info;
20.  }

In line 5, the literal() returns the abstract syntax tree(AST), and V8 starts up the compiler to generate AST if is nullptr.

The first time, the AST is null, and steps into ParseProgram.

1.  bool ParseProgram(ParseInfo* info, Isolate* isolate,
2.                    ReportErrorsAndStatisticsMode mode) {
3.  //omit............................
4.    Parser parser(info);
5.    FunctionLiteral* result = nullptr;
6.    result = parser.ParseProgram(isolate, info);
7.    info->set_literal(result);
8.    if (result) {
9.      info->set_language_mode(info->literal()->language_mode());
10.      if (info->is_eval()) {
11.        info->set_allow_eval_cache(parser.allow_eval_cache());
12.      }
13.    }
14.    if (mode == ReportErrorsAndStatisticsMode::kYes) {
15.  //omit.............................
16.    }
17.    return (result != nullptr);
18.  }

In line 5, create the parser, namely, parser initialization.

1.  Parser::Parser(ParseInfo* info)
2.      : ParserBase<Parser>(info->zone(), &scanner_, info->stack_limit(),
3.                           info->extension(), info->GetOrCreateAstValueFactory(),
4.                           info->pending_error_handler(),
5.                           info->runtime_call_stats(), info->logger(),
6.                           info->script().is_null() ? -1 : info->script()->id(),
7.                           info->is_module(), true),
8.        info_(info),
9.        scanner_(info->character_stream(), info->is_module()),
10.        preparser_zone_(info->zone()->allocator(), ZONE_NAME),
11.        reusable_preparser_(nullptr),
12.        mode_(PARSE_EAGERLY),  // Lazy mode must be set explicitly.
13.        source_range_map_(info->source_range_map()),
14.        target_stack_(nullptr),
15.        total_preparse_skipped_(0),
16.        consumed_preparse_data_(info->consumed_preparse_data()),
17.        preparse_data_buffer_(),
18.        parameters_end_pos_(info->parameters_end_pos()) {
19.    bool can_compile_lazily = info->allow_lazy_compile() && !info->is_eager();
20.    set_default_eager_compile_hint(can_compile_lazily
21.                                       ? FunctionLiteral::kShouldLazyCompile
22.                                       : FunctionLiteral::kShouldEagerCompile);
23.    allow_lazy_ = info->allow_lazy_compile() && info->allow_lazy_parsing() &&
24.                  info->extension() == nullptr && can_compile_lazily;
25.    set_allow_natives(info->allow_natives_syntax());
26.    set_allow_harmony_dynamic_import(info->allow_harmony_dynamic_import());
27.    set_allow_harmony_import_meta(info->allow_harmony_import_meta());
28.    set_allow_harmony_nullish(info->allow_harmony_nullish());
29.    set_allow_harmony_optional_chaining(info->allow_harmony_optional_chaining());
30.    set_allow_harmony_private_methods(info->allow_harmony_private_methods());
31.    for (int feature = 0; feature < v8::Isolate::kUseCounterFeatureCount;
32.         ++feature) {
33.      use_counts_[feature] = 0;
34.    }
35.  }

From line 8 to line 18, take out the compilation information, such as scanner, and compilation mode.

From line 9 to line 23, the important stuff is can_compile_lazily.

Line 25 enables the native commands that start with %.

Summary

V8 uses UTF16 to encode JavaScript source code;
V8 uses v8::internal::source to manage our JavaScript code;
First, look up the compilation cache, then start up the compiler if the cache miss;
The scanner is passive and the parser is active.

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8--Chapter 19: Compilation Cache, Make the Compiler Faster

灰豆 — Fri, 16 Sep 2022 10:58:02 +0000

Original source: https://medium.com/javascript-in-plain-english/lets-understand-chrome-v8-compilation-cache-make-the-compiler-faster-5d230185d127
Welcome to other chapters of Let’s Understand Chrome V8

For performance reasons, V8 uses the compilation cache to hold the SharedFunction which is the compiler result, the cache returns the result directly once the same JavaScript code is compiled again.

You may ask why the same code is compiled again. Compile first, then execute — this is the pipeline of V8. Even the exact same code, the same function, still needs to be sent to the compiler, but not always recompiled. Actually, JavaScript code may change during execution, so the first action always is that we get the JavaScript code’s hash-value from the compilation cache, return the SharedFunction if the cache is hit, and recompile the JavaScript conversely.

1. Initialization and filling

The Isolate, which is the V8 virtual machine instance, is responsible for initializing the CompilationCache, isolate::Init as shown below:

bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
                   StartupDeserializer* startup_deserializer) {
//omit...................
#define ASSIGN_ELEMENT(CamelName, hacker_name)                  \
  isolate_addresses_[IsolateAddressId::k##CamelName##Address] = \
      reinterpret_cast<Address>(hacker_name##_address());
  FOR_EACH_ISOLATE_ADDRESS_NAME(ASSIGN_ELEMENT)
#undef ASSIGN_ELEMENT

  compilation_cache_ = new CompilationCache(this);

The last line is now a CompilationCache, namely, initialization. Let’s dive into it in more depth.

1.  class V8_EXPORT_PRIVATE CompilationCache {
2.   public:
3.    MaybeHandle<SharedFunctionInfo> LookupScript(
4.        Handle<String> source, MaybeHandle<Object> name, int line_offset,
5.        int column_offset, ScriptOriginOptions resource_options,
6.        Handle<Context> native_context, LanguageMode language_mode);
7.    InfoCellPair LookupEval(Handle<String> source,
8.                            Handle<SharedFunctionInfo> outer_info,
9.                            Handle<Context> context, LanguageMode language_mode,
10.                            int position);
11.    MaybeHandle<FixedArray> LookupRegExp(Handle<String> source,
12.                                         JSRegExp::Flags flags);
13.    void PutScript(Handle<String> source, Handle<Context> native_context,
14.                   LanguageMode language_mode,
15.                   Handle<SharedFunctionInfo> function_info);
16.    void PutEval(Handle<String> source, Handle<SharedFunctionInfo> outer_info,
17.                 Handle<Context> context,
18.                 Handle<SharedFunctionInfo> function_info,
19.                 Handle<FeedbackCell> feedback_cell, int position);
20.    void PutRegExp(Handle<String> source, JSRegExp::Flags flags,
21.                   Handle<FixedArray> data);
22.    void Clear();
23.    void Remove(Handle<SharedFunctionInfo> function_info);
24.    void Iterate(RootVisitor* v);
25.    void MarkCompactPrologue();
26.    void Enable();
27.    void Disable();
28.   private:
29.    explicit CompilationCache(Isolate* isolate);
30.    ~CompilationCache() = default;
31.    base::HashMap* EagerOptimizingSet();
32.    static const int kSubCacheCount = 4;
33.    bool IsEnabled() const { return FLAG_compilation_cache && enabled_; }
34.    Isolate* isolate() const { return isolate_; }
35.    Isolate* isolate_;
36.    CompilationCacheScript script_;
37.    CompilationCacheEval eval_global_;
38.    CompilationCacheEval eval_contextual_;
39.    CompilationCacheRegExp reg_exp_;
40.    CompilationSubCache* subcaches_[kSubCacheCount];
41.    bool enabled_;
42.    friend class Isolate;
43.    DISALLOW_COPY_AND_ASSIGN(CompilationCache);
44.  };

There’re three fundamentals of the above function that are important:

LookupScript() at line 3. It is used to look up the cache to take out the SharedFunction that holds the bytecodes corresponding to your JavaScript code. If hit, skip compilation into the execution unit directly.
PutScript() at line 13. If LookupScript misses, PutScript() puts the hash corresponding to your JavaScript code and the SharedFunciton that the compiler generates into the cache before execution.
LookupEval and PutEval at lines 7 and 16. They are the same as LookupScript and PutScript but specialize in the JavaScript eval method because the eval needs not only SharedFunction but also context.

Let’s examine LookupScript in a little more depth:

1.  MaybeHandle<SharedFunctionInfo> CompilationCache::LookupScript(
2.      Handle<String> source, MaybeHandle<Object> name, int line_offset,
3.      int column_offset, ScriptOriginOptions resource_options,
4.      Handle<Context> native_context, LanguageMode language_mode) {
5.    if (!IsEnabled()) return MaybeHandle<SharedFunctionInfo>();
6.    return script_.Lookup(source, name, line_offset, column_offset,
7.                          resource_options, native_context, language_mode);
8.  }
9.  //..................separation..........................
10.  //..................separation..........................
11.  MaybeHandle<SharedFunctionInfo> CompilationCacheScript::Lookup(
12.      Handle<String> source, MaybeHandle<Object> name, int line_offset,
13.      int column_offset, ScriptOriginOptions resource_options,
14.      Handle<Context> native_context, LanguageMode language_mode) {
15.    MaybeHandle<SharedFunctionInfo> result;
16.    {
17.      HandleScope scope(isolate());
18.      const int generation = 0;
19.      DCHECK_EQ(generations(), 1);
20.      Handle<CompilationCacheTable> table = GetTable(generation);
21.      MaybeHandle<SharedFunctionInfo> probe = CompilationCacheTable::LookupScript(
22.          table, source, native_context, language_mode);
23.      Handle<SharedFunctionInfo> function_info;
24.      if (probe.ToHandle(&function_info)) {
25.        if (HasOrigin(function_info, name, line_offset, column_offset,
26.                      resource_options)) {
27.          result = scope.CloseAndEscape(function_info);
28.        }
29.      }
30.    }
31.    Handle<SharedFunctionInfo> function_info;
32.    if (result.ToHandle(&function_info)) {
33.  #ifdef DEBUG
34.      DCHECK(HasOrigin(function_info, name, line_offset, column_offset,
35.                       resource_options));
36.  #endif
37.      isolate()->counters()->compilation_cache_hits()->Increment();
38.      LOG(isolate(), CompilationCacheEvent("hit", "script", *function_info));
39.    } else {
40.      isolate()->counters()->compilation_cache_misses()->Increment();
41.    }
42.    return result;
43.  }

We can find that the CompilationCache::LookupScript is only the entrance, and the key function, as well as the important code, are all in CompilationCacheScript::Lookup().

In Lookup(), the argument source is the JavaScript that you as developers are actually writing, which is going to be compiled.
GetTable at line 20. It is the actual table that holds data into which PutScript put.
CompilationCacheTable::LookupScript at line 21. Look up the table for a result in which hit means a SharedFunction or miss is null.
In line 25: Check if the SharedFunction is the correct one depending on Origin.

Let’s take a glance at HasOrigin.

1.  // We only re-use a cached function for some script source code if the
2.  // script originates from the same place. This is to avoid issues
3.  // when reporting errors, etc.
4.  bool CompilationCacheScript::HasOrigin(Handle<SharedFunctionInfo> function_info,
5.                                         MaybeHandle<Object> maybe_name,
6.                                         int line_offset, int column_offset,
7.                                         ScriptOriginOptions resource_options) {
8.    Handle<Script> script =
9.        Handle<Script>(Script::cast(function_info->script()), isolate());
10.    Handle<Object> name;
11.    if (!maybe_name.ToHandle(&name)) {
12.      return script->name().IsUndefined(isolate());
13.    }
14.    if (line_offset != script->line_offset()) return false;
15.    if (column_offset != script->column_offset()) return false;
16.    if (!name->IsString() || !script->name().IsString()) return false;
17.    if (resource_options.Flags() != script->origin_options().Flags())
18.      return false;
19.    return String::Equals(
20.        isolate(), Handle<String>::cast(name),
21.        Handle<String>(String::cast(script->name()), isolate()));
22.  }

From line 1 to line 3, the comments provide the origin check rules. Specifically, the implementation is from line 14 to line 16.

Next, let’s go into PutScript.

1.  void CompilationCache::PutScript(Handle<String> source,
2.                                   Handle<Context> native_context,
3.                                   LanguageMode language_mode,
4.                                   Handle<SharedFunctionInfo> function_info) {
5.    if (!IsEnabled()) return;
6.    LOG(isolate(), CompilationCacheEvent("put", "script", *function_info));
7.    script_.Put(source, native_context, language_mode, function_info);
8.  }
9.  //.......................separation............................
10.  void CompilationCacheScript::Put(Handle<String> source,
11.                                   Handle<Context> native_context,
12.                                   LanguageMode language_mode,
13.                                   Handle<SharedFunctionInfo> function_info) {
14.    HandleScope scope(isolate());
15.    Handle<CompilationCacheTable> table = GetFirstTable();
16.    SetFirstTable(CompilationCacheTable::PutScript(table, source, native_context,
17.                                                   language_mode, function_info));
18.  }

As same as LookupScript(), the CompilationCache::PutScript is entrance, all important stuff is in CompilationCacheTable::PutScript.

In PutScript, I would like to inform you that the cache table will be filling. Below is the CacheTable source code:

1.  // This cache is used in two different variants. For regexp caching, it simply
2.  // maps identifying info of the regexp to the cached regexp object. Scripts and
3.  // eval code only gets cached after a second probe for the code object. To do
4.  // so, on first "put" only a hash identifying the source is entered into the
5.  // cache, mapping it to a lifetime count of the hash. On each call to Age all
6.  // such lifetimes get reduced, and removed once they reach zero. If a second put
7.  // is called while such a hash is live in the cache, the hash gets replaced by
8.  // an actual cache entry. Age also removes stale live entries from the cache.
9.  // Such entries are identified by SharedFunctionInfos pointing to either the
10.  // recompilation stub, or to "old" code. This avoids memory leaks due to
11.  // premature caching of scripts and eval strings that are never needed later.
12.  class CompilationCacheTable
13.      : public HashTable<CompilationCacheTable, CompilationCacheShape> {
14.   public:
15.    NEVER_READ_ONLY_SPACE
16.    static MaybeHandle<SharedFunctionInfo> LookupScript(
17.        Handle<CompilationCacheTable> table, Handle<String> src,
18.        Handle<Context> native_context, LanguageMode language_mode);
19.    static InfoCellPair LookupEval(Handle<CompilationCacheTable> table,
20.                                   Handle<String> src,
21.                                   Handle<SharedFunctionInfo> shared,
22.                                   Handle<Context> native_context,
23.                                   LanguageMode language_mode, int position);
24.    Handle<Object> LookupRegExp(Handle<String> source, JSRegExp::Flags flags);
25.    static Handle<CompilationCacheTable> PutScript(
26.        Handle<CompilationCacheTable> cache, Handle<String> src,
27.        Handle<Context> native_context, LanguageMode language_mode,
28.        Handle<SharedFunctionInfo> value);
//omit......................
29.
30.    };

From line 1 to line 11, the comments provide more corresponding explanations enough.

Let’s go back to CompilationCacheScript::Put() and ahead to line 16 which is CompilationCacheTable::PutScript().

1.  Handle<CompilationCacheTable> CompilationCacheTable::PutScript(
2.      Handle<CompilationCacheTable> cache, Handle<String> src,
3.      Handle<Context> native_context, LanguageMode language_mode,
4.      Handle<SharedFunctionInfo> value) {
5.    Isolate* isolate = native_context->GetIsolate();
6.    Handle<SharedFunctionInfo> shared(native_context->empty_function().shared(),
7.                                      isolate);
8.    src = String::Flatten(isolate, src);
9.    StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
10.    Handle<Object> k = key.AsHandle(isolate);
11.    cache = EnsureCapacity(isolate, cache, 1);
12.    int entry = cache->FindInsertionEntry(key.Hash());
13.    cache->set(EntryToIndex(entry), *k);
14.    cache->set(EntryToIndex(entry) + 1, *value);
15.    cache->ElementAdded();
16.    return cache;
17.  }

I think the important thing is that PutScript binds the JavaScript source and SharedFuncation as a hash pair as well as puts it into the cache, which the implementations are from line 9 to line 15.

2. Lookup and update

Let’s go into Compiler::GetSharedFunctionInfoForScript.

1.   MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
2.       Isolate* isolate, Handle<String> source,
3.       const Compiler::ScriptDetails& script_details,
4.       ScriptOriginOptions origin_options, v8::Extension* extension,
5.       ScriptData* cached_data, ScriptCompiler::CompileOptions compile_options,
6.       ScriptCompiler::NoCacheReason no_cache_reason, NativesFlag natives) {
7.  //omit.....................
8.       if (extension == nullptr) {
9.         bool can_consume_code_cache =
10.             compile_options == ScriptCompiler::kConsumeCodeCache;
11.         if (can_consume_code_cache) {
12.           compile_timer.set_consuming_code_cache();
13.         }
14.         maybe_result = compilation_cache->LookupScript(//lookup is here.
15.             source, script_details.name_obj, script_details.line_offset,
16.             script_details.column_offset, origin_options, isolate->native_context(),
17.             language_mode);
18.         if (!maybe_result.is_null()) {
19.           compile_timer.set_hit_isolate_cache();
20.         } else if (can_consume_code_cache) {
21.  //omit
22.           if (CodeSerializer::Deserialize(isolate, cached_data, source,
23.                                           origin_options)
24.                   .ToHandle(&inner_result) &&
25.               inner_result->is_compiled()) {
26.             is_compiled_scope = inner_result->is_compiled_scope();
27.             DCHECK(is_compiled_scope.is_compiled());
28.             //filling is here
29.             compilation_cache->PutScript(source, isolate->native_context(),
30.                                          language_mode, inner_result);
31.             Handle<Script> script(Script::cast(inner_result->script()), isolate);
32.             maybe_result = inner_result;
33.           } else {
34.             compile_timer.set_consuming_code_cache_failed();
35.           }
36.         }
37.       }
38.       return maybe_result;
39.     }

In line 14, it means that we need to compile the JavaScript code if LookupScript is missing, so we skip to line 21 to perform compilation and generate inner_result. Then at line 29, put the inner_result into the cache. We can find that the innuer_result is just the maybe_result at line 32.

Figure 1 shows the call stack.

Besides LookupScript and PutScript, there are also LookupEval, PutEval as well as LookupRegExp, PutRegExp in V8. The workflow of them is the same as LookupScript and PutScript, please learn by yourself.

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8--Chapter 18: Understanding Bytecode and How to Debug it

灰豆 — Fri, 09 Sep 2022 01:04:52 +0000

Original source: https://javascript.plainenglish.io/lets-understand-chrome-v8-understanding-bytecode-and-how-to-debug-it-2e470db67ba5
Welcome to other chapters of Let’s Understand Chrome V8

The bytecode is implemented using CodeStubAssembler (CSA), which can be roughly regarded as an assembly. Bytecode is loaded in a de-serialized manner during V8 startup, with no symbol table. So I want to tell you: CAS is obscure in a static analysis. Moreover, we can’t get the source code of the bytecode in debugging. This article will talk about how to debug bytecode at the assembly level and see its execution details.

Figure 1 shows the interpreter of bytecodes. The figure is detailed enough for JavaScript developers. But for V8 learners, Figure 1 lacks a lot of detail, such as: the ignition startup, loading the bytecode, and dispatch. Let’s debug bytecode to dive into those details.

1. Preparation

Note: Before debugging, you’d better understand stack frames, the encoding of bytecodes and registers, see here.

Below is the Invoke which is the last C++ function before debugging.

1.  V8_WARN_UNUSED_RESULT MaybeHandle<Object> Invoke(Isolate* isolate,
2.                                                  const InvokeParams& params) {
3.   if (params.target->IsJSFunction()) {
4.  //............omit...............
5.   }
6.    Object value;
7.     Handle<Code> code =
8.         JSEntry(isolate, params.execution_target, params.is_construct);
9.     {
10.       SaveContext save(isolate);
11.       SealHandleScope shs(isolate);
12.       if (FLAG_clear_exceptions_on_js_entry) isolate->clear_pending_exception();
13.       if (params.execution_target == Execution::Target::kCallable) {
14.         using JSEntryFunction = GeneratedCode<Address(
15.             Address root_register_value, Address new_target, Address target,
16.             Address receiver, intptr_t argc, Address** argv)>;
17.         // clang-format on
18.         JSEntryFunction stub_entry =
19.             JSEntryFunction::FromAddress(isolate, code->InstructionStart());
20.         Address orig_func = params.new_target->ptr();
21.         Address func = params.target->ptr();
22.         Address recv = params.receiver->ptr();
23.         Address** argv = reinterpret_cast<Address**>(params.argv);
24.         RuntimeCallTimerScope timer(isolate, RuntimeCallCounterId::kJS_Execution);
25.         value = Object(stub_entry.Call(isolate->isolate_data()->isolate_root(),
26.                                        orig_func, func, recv, params.argc, argv));
27.       } else {
28.  //............omit...............
29.       }
30.     }
31.     //............omit...............
32.     return Handle<Object>(value, isolate);
33.   }

Lines 14 to 23 initialize the JSFunction that will be executed, namely your JavaScript code. The following are five important members that you should remember. These members can help you to locate your position in debugging. They are constant in one debug context, but will be dissimilar in different debug.

(1) Line 7, code, it is the Builtin::JSEntry pointer, now the value is 1FA 0E06 ED30 (In my debug context).

(2) Line 18, stub_entry, it is the Ignition’s entrance. Below is the function that gets stub_entry from Builtin::JSEntry.

Address Code::OffHeapInstructionStart() const {
  DCHECK(is_off_heap_trampoline());
  if (Isolate::CurrentEmbeddedBlob() == nullptr) return raw_instruction_start();
  EmbeddedData d = EmbeddedData::FromBlob();
  return d.InstructionStartOfBuiltin(builtin_index());
}

The entry is 1FA 1326 1840.

(3) Line21, func, it is the address of JSFunction, namely your JavaScript code. The value is 16 2BD8 15A9.

(4) The address of Builtin::InterpreterEntryTrampoline is 52 61C0 8A41.

(5) The dispatch_table is 1FA 0E08 CFB0.

Figure 2 is the call stack that is going into bytecode.

2. Debug bytecode

Let’s start to debug bytecode by stepping into stub_entry.Call(). I’m sorry I can’t go through the line-by-line since the assembly code doesn’t have context. I think the best way is to give the important states during the Ignition execution.

In Figure 3, the register RCX is 1FA 1326 1840(stub_entry). As I mentioned, the stub_entry is the entrance of Ignition.

In Figure 4, the register RBX is 1FA0E068A00 which is the first argument of stub_entry.Call(), that is isolate->isolate_data()->isolate_root().

Figure 5 is moving the R8 and calling RSI. The register R8 is func, and the RSI is stub_entry, below is the function to which the stub_entry is pointing.

1.  void Builtins::Generate_JSEntry(MacroAssembler* masm) {
2.    Generate_JSEntryVariant(masm, StackFrame::ENTRY,
3.                            Builtins::kJSEntryTrampoline);
4.  }
5.  //==================separation===========================
6.  void Generate_JSEntryVariant(MacroAssembler* masm, StackFrame::Type type,
7.                               Builtins::Name entry_trampoline) {
8.    Label invoke, handler_entry, exit;
9.    Label not_outermost_js, not_outermost_js_2;
10.    {  
11.      NoRootArrayScope uninitialized_root_register(masm);
12.      __ pushq(rbp);
13.      __ movq(rbp, rsp);
14.      __ Push(Immediate(StackFrame::TypeToMarker(type)));
15.      __ AllocateStackSpace(kSystemPointerSize);
16.      __ pushq(r12);
17.      __ pushq(r13);
18.      __ pushq(r14);
19.      __ pushq(r15);
20.  #ifdef _WIN64
21.      __ pushq(rdi);  // Only callee save in Win64 ABI, argument in AMD64 ABI.
22.      __ pushq(rsi);  // Only callee save in Win64 ABI, argument in AMD64 ABI.
23.  #endif
24.      __ pushq(rbx);
25.  #ifdef _WIN64 //Here is True, my OS is Win10!!!!!!!!!!!!!!!!!!
26.      // On Win64 XMM6-XMM15 are callee-save.
27.      __ AllocateStackSpace(EntryFrameConstants::kXMMRegistersBlockSize);
28.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 0), xmm6);
29.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 1), xmm7);
30.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 2), xmm8);
31.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 3), xmm9);
32.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 4), xmm10);
33.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 5), xmm11);
34.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 6), xmm12);
35.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 7), xmm13);
36.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 8), xmm14);
37.      __ movdqu(Operand(rsp, EntryFrameConstants::kXMMRegisterSize * 9), xmm15);
38.      STATIC_ASSERT(EntryFrameConstants::kCalleeSaveXMMRegisters == 10);
39.      STATIC_ASSERT(EntryFrameConstants::kXMMRegistersBlockSize ==
40.                    EntryFrameConstants::kXMMRegisterSize *
41.                        EntryFrameConstants::kCalleeSaveXMMRegisters);
42.  #endif
43.  //............omit...........................
44.  }

In lines 12 to 37, we can see that they are the same as the assembly code in Figure 6. Actually, Generate_JSEntryVariant is executing. Builtin:JSEntry is responsible for organizing arguments by std::call standard. Later, the function Builtin::InterpreterEntryTrampoline will use these arguments.

Builtin::InterpreterEntryTrampoline lookups at the dispatch_table to find the target bytecode and call it, shown in Figure 7.

Let’s examine dispatch in a little more depth, see Figure 7.

mark 1: the machine register R15 is the dispatch_table.
mark 2: calculate the target bytecode address, that is dispatch_table + the encoding of the bytecode.
mark 3: call the target bytecode.

In my case, the target bytecode is LdaConstant.

1.  IGNITION_HANDLER(LdaConstant, InterpreterAssembler) {
2.    TNode<Object> constant = LoadConstantPoolEntryAtOperandIndex(0);
3.    SetAccumulator(constant);
4.    Dispatch();
5.  }

When LdaConstant exits, lookup at the dispatch_table to find the next bytecode, shown in Figure 8.

At the assembly level, we can see the Ignition startup and bytecode execution, which can help us understand the V8 interpreter better.

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8: How Does V8 Implement a JavaScript Object?

灰豆 — Wed, 07 Sep 2022 02:34:00 +0000

Chapter 17: JavaScript object memory layout and new method.
Original source: https://javascript.plainenglish.io/lets-understand-chrome-v8-how-does-v8-implement-a-javascript-object-ddde32120bb5
Welcome to other chapters of Let’s Understand Chrome V8

We know that the JavaScript object is a set of properties and elements. For performance and memory reasons, V8 designed several different representations of properties such as in-object, slow property, and self-dict. In this chapter, let’s examine the JavaScript object in a little more depth.

1. JavaScript object layout

The following Figure 1 shows what a basic JavaScript object looks like in memory.

Elements and properties are stored in two separate data structures which makes adding and accessing properties or elements more efficient for different usage patterns.

Elements are mainly used for the various Array.prototype methods such as pop or slice. Given that these functions access properties in consecutive ranges, V8 also represents them as simple arrays internally — most of the time.

Named properties are stored in a similar way in a separate array. However, unlike elements, we cannot simply use the key to deduce their position within the properties array; we need some additional metadata. In V8 every JavaScript object has a HiddenClass associated. The HiddenClass stores information about the shape of an object, and among other things, a mapping from property names to indices into the properties, more details are in chapter 14.

In Figure 2, there are elements, properties, and in-object properties. Unlike elements or properties, the in-object properties are stored in the Object itself, which means you can access them directly without map. The amount of the in-object is allocated when creating the JavaScript object. (The amount may be dissimilar in different V8 versions)

In Figure 3, there are three different named property types: in-object, fast and slow/dictionary.

(1) In-object properties are stored directly on the object itself and provide the fastest access.

(2) Fast properties live in the properties store, all the meta information is stored in the descriptor array on the HiddenClass.

(3) Slow properties live in a self-contained properties dictionary, meta information is no longer shared through the HiddenClass.

Figure 4 shows the JavaScript object memory layout.

All V8 managed heap objects must have a map pointer that is stored at the first address. Of course, also have elements and properties. The descriptor is an important member of the map, which is responsible for describing the properties of an object, which we will talk about in the future.

In the following case, the sayname is a function that is equal to console.log.

Let’s think about another question: where is the function of an object stored? namely, where is the sayname?

1.  function person(name) {
2.      this.name=name;
3.      this.sayname=function(){console.log(this.name);}
4.  }
5.  worker = new person("Nicholas");
6.  worker.sayname();
7.  //separation........................................
8.  //separation........................................
9.  Bytecode Age: 0
10.           000001DAA2FA1E96 @    0 : 13 00             LdaConstant [0]
11.           000001DAA2FA1E98 @    2 : c2                Star1
12.           000001DAA2FA1E99 @    3 : 19 fe f8          Mov <closure>, r2
13.      0 E> 000001DAA2FA1E9C @    6 : 64 51 01 f9 02    CallRuntime [DeclareGlobals], r1-r2
14.    100 S> 000001DAA2FA1EA1 @   11 : 21 01 00          LdaGlobal [1], [0]
15.           000001DAA2FA1EA4 @   14 : c2                Star1
16.           000001DAA2FA1EA5 @   15 : 13 02             LdaConstant [2]
17.           000001DAA2FA1EA7 @   17 : c1                Star2
18.           000001DAA2FA1EA8 @   18 : 0b f9             Ldar r1
19.    109 E> 000001DAA2FA1EAA @   20 : 68 f9 f8 01 02    Construct r1, r2-r2, [2]
20.    107 E> 000001DAA2FA1EAF @   25 : 23 03 04          StaGlobal [3], [4]
21.    134 S> 000001DAA2FA1EB2 @   28 : 21 03 06          LdaGlobal [3], [6]
22.           000001DAA2FA1EB5 @   31 : c1                Star2
23.    141 E> 000001DAA2FA1EB6 @   32 : 2d f8 04 08       LdaNamedProperty r2, [4], [8]
24.           000001DAA2FA1EBA @   36 : c2                Star1
25.    141 E> 000001DAA2FA1EBB @   37 : 5c f9 f8 0a       CallProperty0 r1, r2, [10]
26.           000001DAA2FA1EBF @   41 : c3                Star0
27.    151 S> 000001DAA2FA1EC0 @   42 : a8                Return
28.  Constant pool (size = 5)
29.  000001DAA2FA1E29: [FixedArray] in OldSpace
30.   - map: 0x024008ac12c1 <Map>
31.   - length: 5
32.             0: 0x01daa2fa1d11 <FixedArray[2]>
33.             1: 0x01daa2fa1c09 <String[6]: #person>
34.             2: 0x01daa2fa1c39 <String[8]: #Nicholas>
35.             3: 0x01daa2fa1c21 <String[6]: #worker>
36.             4: 0x01daa2fa1c51 <String[7]: #sayname>

The first part is JavaScript code, the last is corresponding bytecodes.

Lines 19–21 use the person object to construct an instance named worker.

Line 23 load the property that name is sayname.

Do you understand line23? It tells us that the sayname is just a property, regardless of its type. If you go a little more in-depth, you will see that the console and log are properties also.

So, in a JavaScript Object, all functions are treated as properties.

2. New JavaScript object

To debug the above case, we will step into the following code:

1.  RUNTIME_FUNCTION(Runtime_NewObject) {
2.    HandleScope scope(isolate);
3.    DCHECK_EQ(2, args.length());
4.    CONVERT_ARG_HANDLE_CHECKED(JSFunction, target, 0);
5.    CONVERT_ARG_HANDLE_CHECKED(JSReceiver, new_target, 1);
6.    RETURN_RESULT_OR_FAILURE(
7.        isolate,
8.        JSObject::New(target, new_target, Handle<AllocationSite>::null()));
9.  }
10.  //separation.....................................
11.  MaybeHandle<JSObject> JSObject::New(Handle<JSFunction> constructor,
12.                                      Handle<JSReceiver> new_target,
13.                                      Handle<AllocationSite> site) {
14.    Isolate* const isolate = constructor->GetIsolate();
15.    DCHECK(constructor->IsConstructor());
16.    DCHECK(new_target->IsConstructor());
17.    DCHECK(!constructor->has_initial_map() ||
18.           !InstanceTypeChecker::IsJSFunction(
19.               constructor->initial_map().instance_type()));
20.    Handle<Map> initial_map;
21.    ASSIGN_RETURN_ON_EXCEPTION(
22.        isolate, initial_map,
23.        JSFunction::GetDerivedMap(isolate, constructor, new_target), JSObject);
24.    int initial_capacity = V8_ENABLE_SWISS_NAME_DICTIONARY_BOOL
25.                               ? SwissNameDictionary::kInitialCapacity
26.                               : NameDictionary::kInitialCapacity;
27.    Handle<JSObject> result = isolate->factory()->NewFastOrSlowJSObjectFromMap(
28.        initial_map, initial_capacity, AllocationType::kYoung, site);
29.    isolate->counters()->constructed_objects()->Increment();
30.    isolate->counters()->constructed_objects_runtime()->Increment();
31.    return result;
32.  }

The RUNTIME_FUNCTION(Runtime_NewObject) is a MACRO that we mentioned in the last chapter. It calls the JSObject::New() to create a new object. The JSObject::New() calls JSFunction::GetDerivedMap() to allocate a new map.

In JSFunction::GetDerivedMap(), the following function will be called.

1.  void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
2.    DCHECK(function->has_prototype_slot());
3.    DCHECK(function->IsConstructor() ||
4.           IsResumableFunction(function->shared().kind()));
5.    if (function->has_initial_map()) return;
6.    Isolate* isolate = function->GetIsolate();
7.    int expected_nof_properties =
8.        CalculateExpectedNofProperties(isolate, function);
9.    if (function->has_initial_map()) return;
10.    InstanceType instance_type;
11.    if (IsResumableFunction(function->shared().kind())) {
12.      instance_type = IsAsyncGeneratorFunction(function->shared().kind())
13.                          ? JS_ASYNC_GENERATOR_OBJECT_TYPE
14.                          : JS_GENERATOR_OBJECT_TYPE;
15.    } else {
16.      instance_type = JS_OBJECT_TYPE;
17.    }
18.    int instance_size;
19.    int inobject_properties;
20.    CalculateInstanceSizeHelper(instance_type, false, 0, expected_nof_properties,
21.                                &instance_size, &inobject_properties);
22.    Handle<Map> map = isolate->factory()->NewMap(instance_type, instance_size,
23.                                                 TERMINAL_FAST_ELEMENTS_KIND,
24.                                                 inobject_properties);
25.    Handle<HeapObject> prototype;
26.    if (function->has_instance_prototype()) {
27.      prototype = handle(function->instance_prototype(), isolate);
28.    } else {
29.      prototype = isolate->factory()->NewFunctionPrototype(function);
30.    }
31.    DCHECK(map->has_fast_object_elements());
32.    DCHECK(prototype->IsJSReceiver());
33.    JSFunction::SetInitialMap(isolate, function, map, prototype);
34.    map->StartInobjectSlackTracking();
35.  }

Line 7, returns the number of properties expected by the constructor.

Lines 26 to 30 generate the prototype, the keyword function is a constructor. In our case, the function is person, the prototype is null since the person is the first-time execution, so line 29 is executed.

The generated prototype is bound to the constructor and is shared by all instances, that is the prototype principle that V8 implements.

Below is the CalculateExpectedNofProperties which is called in line 7.

1.  int JSFunction::CalculateExpectedNofProperties(Isolate* isolate,
2.                                                 Handle<JSFunction> function) {
3.    int expected_nof_properties = 0;
4.    for (PrototypeIterator iter(isolate, function, kStartAtReceiver);
5.         !iter.IsAtEnd(); iter.Advance()) {
6.      Handle<JSReceiver> current =
7.          PrototypeIterator::GetCurrent<JSReceiver>(iter);
8.      if (!current->IsJSFunction()) break;
9.      Handle<JSFunction> func = Handle<JSFunction>::cast(current);
10.      Handle<SharedFunctionInfo> shared(func->shared(), isolate);
11.      IsCompiledScope is_compiled_scope(shared->is_compiled_scope(isolate));
12.      if (is_compiled_scope.is_compiled() ||
13.          Compiler::Compile(isolate, func, Compiler::CLEAR_EXCEPTION,
14.                            &is_compiled_scope)) {
15.        DCHECK(shared->is_compiled());
16.        int count = shared->expected_nof_properties();
17.        if (expected_nof_properties <= JSObject::kMaxInObjectProperties - count) {
18.          expected_nof_properties += count;
19.        } else {
20.          return JSObject::kMaxInObjectProperties;
21.        }
22.      } else {
23.        continue;
24.      }
25.    }
26.    if (expected_nof_properties > 0) {
27.      expected_nof_properties += 8;
28.      if (expected_nof_properties > JSObject::kMaxInObjectProperties) {
29.        expected_nof_properties = JSObject::kMaxInObjectProperties;
30.      }
31.    }
32.    return expected_nof_properties;
33.  }

Line 28, the MaxInObject is the max amount of in-object, and the exceeded properties are stored in the properties list. Figure 5 shows the call stack.

References

Fast properties in V8

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8 — Chapter 16: What is Runtime? Why is it important?

灰豆 — Mon, 05 Sep 2022 02:23:51 +0000

Original source: https://javascript.plainenglish.io/lets-understand-chrome-v8-chapter-16-what-is-runtime-why-is-it-important-8c808e58843d
Welcome to other chapters of Let’s Understand Chrome V8

From the view of implementation: the builtins are implemented by Runtime, Torque (CodeStubAssembler), JavaScript, and ASM. Below is the official description of the V8:

V8’s builtins can be implemented using a number of different methods (each with different trade-offs):

Platform-dependent assembly language: can be highly efficient, but need manual ports to all platforms and are difficult to maintain.

C++: very similar in style to runtime functions and has access to V8’s powerful runtime functionality, but usually not suited to performance-sensitive areas.

JavaScript: concise and readable code, access to fast intrinsics, but frequent usage of slow runtime calls, subject to unpredictable performance through type pollution, and subtle issues around (complicated and non-obvious) JS semantics.

CodeStubAssembler: provides efficient low-level functionality that is very close to assembly language while remaining platform-independent and preserving readability.

What is Runtime? It is a method for implementing V8 builtins.

Why is it important? If you understand it means that you know the design and implementation of the quarter of the builtins.

In this article, I will talk about the initialization and call of Runtime. By learning them, we will have a comprehensive understanding of the workflow of Runtime.

1. Initialization

Runtime is the foundation component of V8, which is initialized during the V8 startup and is managed by the ExternalReferenceTable which is a pointer array for holding external resources. The below Init() is responsible for the initialization of ExternalReferenceTable.

1.   bool Isolate::Init(ReadOnlyDeserializer* read_only_deserializer,
2.                      StartupDeserializer* startup_deserializer) {
3.     TRACE_ISOLATE(init);
4.     const bool create_heap_objects = (read_only_deserializer == nullptr);
5.     // We either have both or neither.
6.     DCHECK_EQ(create_heap_objects, startup_deserializer == nullptr);
7.     base::ElapsedTimer timer;
8.    //omit...........................
9.      handle_scope_implementer_ = new HandleScopeImplementer(this);
10.      load_stub_cache_ = new StubCache(this);
11.      store_stub_cache_ = new StubCache(this);
12.      materialized_object_store_ = new MaterializedObjectStore(this);
13.      regexp_stack_ = new RegExpStack();
14.      regexp_stack_->isolate_ = this;
15.      date_cache_ = new DateCache();
16.      heap_profiler_ = new HeapProfiler(heap());
17.      interpreter_ = new interpreter::Interpreter(this);
18.      compiler_dispatcher_ =
19.          new CompilerDispatcher(this, V8::GetCurrentPlatform(), FLAG_stack_size);
20.      // Enable logging before setting up the heap
21.      logger_->SetUp(this);
22.      {  // NOLINT
23.        ExecutionAccess lock(this);
24.        stack_guard()->InitThread(lock);
25.      }
26.      // SetUp the object heap.
27.      DCHECK(!heap_.HasBeenSetUp());
28.      heap_.SetUp();
29.      ReadOnlyHeap::SetUp(this, read_only_deserializer);
30.      heap_.SetUpSpaces();
31.      isolate_data_.external_reference_table()->Init(this);
32.      //omit...............
33.    }

In the above code, lines 10~20 include the initialization of many foundation components, such as Interpreter and compiler_dispatcher. Line 31 is the ExternalReferenceTable that holds Runtime, see below.

1.  void ExternalReferenceTable::Init(Isolate* isolate) {
2.    int index = 0;
3.    // kNullAddress is preserved through serialization/deserialization.
4.    Add(kNullAddress, &index);
5.    AddReferences(isolate, &index);
6.    AddBuiltins(&index);
7.    AddRuntimeFunctions(&index);
8.    AddIsolateAddresses(isolate, &index);
9.    AddAccessors(&index);
10.    AddStubCache(isolate, &index);
11.    AddNativeCodeStatsCounters(isolate, &index);
12.    is_initialized_ = static_cast<uint32_t>(true);
13.    CHECK_EQ(kSize, index);
14.  }

In the above code, the 7th line is the initialization of the Runtime AddRuntimeFunctions where is below.

1.  void ExternalReferenceTable::AddRuntimeFunctions(int* index) {
2.    CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
3.                 kBuiltinsReferenceCount,
4.             *index);
5.    static constexpr Runtime::FunctionId runtime_functions[] = {
6.  #define RUNTIME_ENTRY(name, ...) Runtime::k##name,
7.        FOR_EACH_INTRINSIC(RUNTIME_ENTRY)
8.  #undef RUNTIME_ENTRY
9.    };
10.    for (Runtime::FunctionId fId : runtime_functions) {
11.      Add(ExternalReference::Create(fId).address(), index);
12.    }
13.    CHECK_EQ(kSpecialReferenceCount + kExternalReferenceCount +
14.                 kBuiltinsReferenceCount + kRuntimeReferenceCount,
15.             *index);
16.  }

The AddRuntimeFunctions has a parameter index. In my V8, there are 468 runtime functions, the first function is at ExternalReferenceTable[index =430], the last one is at ExternalReferenceTable[430+468–1].

As mentioned above, the ExternalReferenceTable is a pointer array, which is not only to hold the Runtime but also other stuff. We will talk about the stuff in the future.

Figure 1 is adding a Runtime function into the ExternalReferenceTable and gives you a chance to watch runtime_functions in the local variable window.

The 11th line Create() creates an entry according to the Runtime ID and finally stores it into the ExternalReferenceTable, see below.

1.  ExternalReference ExternalReference::Create(Runtime::FunctionId id) {
2.    return Create(Runtime::FunctionForId(id));
3.  }
4.  //separation........................
5.  const Runtime::Function* Runtime::FunctionForId(Runtime::FunctionId id) {
6.    return &(kIntrinsicFunctions[static_cast<int>(id)]);
7.  }
8.  //separation.......................
9.  ExternalReference ExternalReference::Create(const Runtime::Function* f) {
10.    return ExternalReference(
11.        Redirect(f->entry, BuiltinCallTypeForResultSize(f->result_size)));
12.  }

The Create() calls the FunctionForId() to return a kIntrinsicFunctions which is defined in below.

#define FUNCTION_ADDR(f) (reinterpret_cast<v8::internal::Address>(f))
#define F(name, number_of_args, result_size)                                  \
  {                                                                           \
    Runtime::k##name, Runtime::RUNTIME, #name, FUNCTION_ADDR(Runtime_##name), \
        number_of_args, result_size                                           \
  }                                                                           \
  ,


#define I(name, number_of_args, result_size)                       \
  {                                                                \
    Runtime::kInline##name, Runtime::INLINE, "_" #name,            \
        FUNCTION_ADDR(Runtime_##name), number_of_args, result_size \
  }                                                                \
  ,

static const Runtime::Function kIntrinsicFunctions[] = {
    FOR_EACH_INTRINSIC(F) FOR_EACH_INLINE_INTRINSIC(I)};

#undef I
#undef F

What is the kIntrinsicFunctions? Actually, it is an array in which every element is a 6-tuple. In the below 6-tuple, the first is a unique enum ID, the third is a mnemonic which does not help much, the fourth is the function address, and the last two are parameter counter and return counter. As you see, it is adding the Runtime DebugPrint, namely Initialization.

kIntrinsicFunctions []={
  //.....................
  {                                                                           
    Runtime::kDebugPrint, Runtime::RUNTIME, "DebugPrint", (reinterpret_cast<v8::internal::Address>(Runtime_DebugPrint)), 
        1, 1 
  },
  //.....................

let's look at the ExternalReferenceTable.

1.  class ExternalReferenceTable {
2.   public:
3.    static constexpr int kSpecialReferenceCount = 1;
4.    static constexpr int kExternalReferenceCount =
5.        ExternalReference::kExternalReferenceCount;
6.    static constexpr int kBuiltinsReferenceCount =
7.  #define COUNT_C_BUILTIN(...) +1
8.        BUILTIN_LIST_C(COUNT_C_BUILTIN);
9.  #undef COUNT_C_BUILTIN
10.     static constexpr int kRuntimeReferenceCount =
11.         Runtime::kNumFunctions -
12.         Runtime::kNumInlineFunctions;  // Don't count dupe kInline... functions.
13.     static constexpr int kIsolateAddressReferenceCount = kIsolateAddressCount;
14.     static constexpr int kAccessorReferenceCount =
15.         Accessors::kAccessorInfoCount + Accessors::kAccessorSetterCount;
16.     static constexpr int kStubCacheReferenceCount = 12;
17.     static constexpr int kStatsCountersReferenceCount =
18.   #define SC(...) +1
19.         STATS_COUNTER_NATIVE_CODE_LIST(SC);
20.   #undef SC
21.   //...........omit.........................
22.     ExternalReferenceTable() = default;
23.     void Init(Isolate* isolate);
24.    private:
25.     void Add(Address address, int* index);
26.     void AddReferences(Isolate* isolate, int* index);
27.     void AddBuiltins(int* index);
28.     void AddRuntimeFunctions(int* index);
29.     void AddIsolateAddresses(Isolate* isolate, int* index);
30.     void AddAccessors(int* index);
31.     void AddStubCache(Isolate* isolate, int* index);
32.     Address GetStatsCounterAddress(StatsCounter* counter);
33.     void AddNativeCodeStatsCounters(Isolate* isolate, int* index);
34.     STATIC_ASSERT(sizeof(Address) == kEntrySize);
35.     Address ref_addr_[kSize];
36.     static const char* const ref_name_[kSize];
37.     uint32_t is_initialized_ = 0;
38.     uint32_t dummy_stats_counter_ = 0;
39.     DISALLOW_COPY_AND_ASSIGN(ExternalReferenceTable);
40.   };

Line 7-17 defines all Builtins managed by ExternalReferenceTable, namely all Runtimes. Line 25-35 defines all private methods of ExternalReferenceTable. Take a look at line 35, it's the array that holds the Runtime address. The Address is 'using Address = uintptr_t'.

Figure 2 gives three important points, first is the function Add(); second, helps you to watch the variable ref_addr_; last is the call stack which can help you to debug this code.

2. Calling Runtime

In the last article, I wrote a Runtime function — MyRunctimeFunction, and also described Runtime’s definition.

Here, I’ll talk about the CallRuntime which is common usage in bytecodes and which can help you to understand the interaction between bytecode and runtime.

1.   template <class... TArgs>
2.   TNode<Object> CallRuntime(Runtime::FunctionId function,
3.                             SloppyTNode<Object> context, TArgs... args) {
4.     return CallRuntimeImpl(function, context,
5.                            {implicit_cast<SloppyTNode<Object>>(args)...});
6.   }
7.  //.....separation.........................
8.   TNode<Object> CodeAssembler::CallRuntimeImpl(
9.       Runtime::FunctionId function, TNode<Object> context,
10.        std::initializer_list<TNode<Object>> args) {
11.      int result_size = Runtime::FunctionForId(function)->result_size;
12.      TNode<Code> centry =
13.          HeapConstant(CodeFactory::RuntimeCEntry(isolate(), result_size));
14.      return CallRuntimeWithCEntryImpl(function, centry, context, args);
15.    }
16.  //.....separation.........................
17.    TNode<Type> HeapConstant(Handle<Type> object) {
18.        return UncheckedCast<Type>(UntypedHeapConstant(object));
19.      }
20.  //...separation.........................
21.  TNode<Object> CodeAssembler::CallRuntimeWithCEntryImpl(
22.        Runtime::FunctionId function, TNode<Code> centry, TNode<Object> context,
23.        std::initializer_list<TNode<Object>> args) {
24.      constexpr size_t kMaxNumArgs = 6;
25.      DCHECK_GE(kMaxNumArgs, args.size());
26.      int argc = static_cast<int>(args.size());
27         auto call_descriptor = Linkage::GetRuntimeCallDescriptor(zone(), function, argc, Operator::kNoProperties,
                      Runtime::MayAllocate(function) ? CallDescriptor::kNoFlags
                                     : CallDescriptor::kNoAllocate);
28.      for (auto arg : args) inputs.Add(arg);
29.      inputs.Add(ref);
30.      inputs.Add(arity);
31.      inputs.Add(context);
32.      CallPrologue();
33.      Node* return_value =
34.          raw_assembler()->CallN(call_descriptor, inputs.size(), inputs.data());
35.      HandleException(return_value);
36.      CallEpilogue();
37.      return UncheckedCast<Object>(return_value);
38.    }

In line 2, the first parameter is FunctionID which is the enum ID motioned above; the second is the current context that will be explained in the future; the last is an args list passed to a specific Runtime function.
In CallRuntimeImpl, line 11 takes out the result size where is stored in the kIntrinsicFunctions; line14 calls CallRuntimeWithCEntryImpl.
In CallRuntimeWithCEntryImpl, line 26 counts the arguments; line 28-31 adds the arguments and context to the inputs array; line 33 calls the specific Runtime.

Note: Sea of Nodes is the prerequisite knowledge if you want to fully understand the principle of CallRuntimeImpl.

Debugging CallRuntimeImpl can only be done in the assembly environment, I have some experience and skills but is boring and complicated, if you want to know, plz contact me.

Okay, that wraps it up for this share. I’ll see you guys next time, take care!
Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8 — Chapter 15: How can we debug V8 more easily

灰豆 — Fri, 02 Sep 2022 01:34:15 +0000

Original source: https://medium.com/@huidou/lets-understand-chrome-v8-chapter-15-how-can-we-debug-v8-more-easily-85a6ae1d736d
Welcome to other chapters of Let’s Understand Chrome V8

Debugging is undoubtedly the most efficient way to analyze V8, unfortunately, most of V8’s code is hard to debug. Most parts of the kernel code of V8 are implemented by CodeStubAssembler, namely CSA. You can roughly think that CSA is the assembly language. Debugging assembly is not acceptable, let alone debugging in such a huge project V8.

Is there any way to make our debugging easier? In this article I’ll talk about my experience debugging builtins. Specifically, I’d like to talk about how to debug bytecode. Would you like to see the details of a bytecode execution? Let’s go! Absolutely, you also can skip these boring theories, and go to Section 3.

Tip: V8 is mainly implemented in two languages, C++ and assembly. Specifically, the bytecodes are implemented in CSA.

1. Runtime

What is Runtime? Does it help with debugging bytecode? Of course, Yes!

Most of the Runtime in V8 is written in C++, and the Runtime and Bytecode can call each other. During a bytecode execution, we can manually call a Runtime to return to the C++ environment, which is easier for us to watch the details. This is the help that the Runtime gives.

Let’s learn about Runtime, and how to define our Runtimes.

1.  #define FOR_EACH_INTRINSIC_GENERATOR(F, I)    \
2.    I(AsyncFunctionAwaitCaught, 2, 1)           \
3.    I(AsyncFunctionAwaitUncaught, 2, 1)         \
4.    I(AsyncFunctionEnter, 2, 1)                 \
5.    I(AsyncFunctionReject, 3, 1)                \
6.    I(AsyncFunctionResolve, 3, 1)               \
7.    I(AsyncGeneratorAwaitCaught, 2, 1)          \
8.    I(GeneratorGetResumeMode, 1, 1)
9.  #define FOR_EACH_INTRINSIC_MODULE(F, I) \ //omit....................
10.    F(DynamicImportCall, 2, 1)            \
11.    I(GetImportMetaObject, 0, 1)          \
12.    F(GetModuleNamespace, 1, 1)
13.  #define FOR_EACH_INTRINSIC_NUMBERS(F, I) \
14.    F(GetHoleNaNLower, 0, 1)               \
15.    F(GetHoleNaNUpper, 0, 1)               \
16.    I(IsSmi, 1, 1)                         \
17.    F(IsValidSmi, 1, 1)                    \
18.    F(MaxSmi, 0, 1)                        \
19.    F(NumberToString, 1, 1)                \
20.    F(StringParseFloat, 1, 1)              \ //omit....................
21.    F(StringParseInt, 2, 1)                \
22.    F(StringToNumber, 1, 1)
23.  #define FOR_EACH_INTRINSIC_OBJECT(F, I)                         \
24.    F(AddDictionaryProperty, 3, 1)                                \
25.    F(NewObject, 2, 1)

The above code is a Runtime macro template, each line is a Runtime function, and you can see all the code in runtime.h.

I elaborate on the example in line 25.The keyword F is a macro, the number 2 is the parameter counter, and the number 1 is the return value counter. The keyword I also is a macro (see line 11).

The code of NewObject is below.

RUNTIME_FUNCTION(Runtime_NewObject) {
  HandleScope scope(isolate);
  DCHECK_EQ(2, args.length());
  CONVERT_ARG_HANDLE_CHECKED(JSFunction, target, 0);
  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, new_target, 1);
  RETURN_RESULT_OR_FAILURE(
      isolate,
      JSObject::New(target, new_target, Handle<AllocationSite>::null()));
}

In the above code, RUNTIME_FUNCTION is still a macro. We expand it to get the complete NewObject code, which is below.

1.  static V8_INLINE Object __RT_impl_Runtime_NewObject(Arguments args,              
2.                                                 Isolate* isolate);           
3.  V8_NOINLINE static Address Stats_Runtime_NewObject(int args_length, Address* args_object, 
4.                                       Isolate* isolate) {                    
5.    RuntimeCallTimerScope timer(isolate, RuntimeCallCounterId::kRuntime_NewObject);      
6.    TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.runtime"),                     
7.                 "V8.Runtime_" "Runtime_NewObject");                                        
8.    Arguments args(args_length, args_object);                                 
9.    return (__RT_impl_Runtime_NewObject(args, isolate)).ptr();                          
10.   }                                                                           
11.   Address Name(int args_length, Address* args_object, Isolate* isolate) {        
12.     DCHECK(isolate->context().is_null() || isolate->context().IsContext());   
13.     CLOBBER_DOUBLE_REGISTERS();                                               
14.     if (V8_UNLIKELY(TracingFlags::is_runtime_stats_enabled())) {              
15.       return Stats_Runtime_NewObject(args_length, args_object, isolate);                 
16.     }                                                                         
17.     Arguments args(args_length, args_object);                                 
18.     return (__RT_impl_Runtime_NewObject(args, isolate)).ptr();                          
19.   }                                                                          
20.  //................................ 
21.   static Object __RT_impl_Runtime_NewObject(Arguments args, Isolate* isolate)
22.  {
23.    HandleScope scope(isolate);
24.    DCHECK_EQ(2, args.length());
25.    CONVERT_ARG_HANDLE_CHECKED(JSFunction, target, 0);
26.    CONVERT_ARG_HANDLE_CHECKED(JSReceiver, new_target, 1);
27.    RETURN_RESULT_OR_FAILURE(
28.        isolate,
29.        JSObject::New(target, new_target, Handle<AllocationSite>::null()));
30.  }

The above code runs in a C++ environment, so you can debug it with C++ code.

2. Creating a runtime

I summarize the creation of the runtime as two points:

Class Runtime, which contains all the runtime function names.

class Runtime : public AllStatic {
 public:
  enum FunctionId : int32_t {
#define F(name, nargs, ressize) k##name,
#define I(name, nargs, ressize) kInline##name,
    FOR_EACH_INTRINSIC(F) FOR_EACH_INLINE_INTRINSIC(I)
#undef I
#undef F
        kNumFunctions,
  };
//omit.......................

If you define a new function, the name will also appear in this enumeration.

The runtime_table is a pointer array that holds the addresses of all runtime functions. This array is managed by v8::i::islolate. You need to choose a location to add your runtime. Below is my runtime.

#define FOR_EACH_INTRINSIC_TEST(F, I)         \
  F(Abort, 1, 1)                              \
  F(AbortJS, 1, 1)                            \
  F(AbortCSAAssert, 1, 1)                     \
  F(ArraySpeciesProtector, 0, 1)              \
  F(ClearFunctionFeedback, 1, 1)              \
  F(ClearMegamorphicStubCache, 0, 1)          \
  F(CloneWasmModule, 1, 1)                    \
  F(CompleteInobjectSlackTracking, 1, 1)      \
  F(ConstructConsString, 2, 1)                \
  F(ConstructDouble, 2, 1)                    \
  F(ConstructSlicedString, 2, 1)              \
  F(MyRuntime,1,1)                            //Here is my runtime

The last line is my function, the name is MyRuntime, it has one parameter and one return value, and the code is below.

1.RUNTIME_FUNCTION(Runtime_MyRuntime) {
1.  SealHandleScope shs(isolate);
2.  DCHECK_EQ(1, args.length());
3. //function body，
4.  return ReadOnlyRoots(isolate).undefined_value();
6.}

In the above code, line 1 RUNTIME_FUNCTION is a V8 macro. Line 2 is SealHandleScope (which will be explained in a later article). On line 4, you can write your code, namely function body.

Below is the way that calls the MyRuntime in bytecode — LdaConstant.

IGNITION_HANDLER(LdaConstant, InterpreterAssembler) {
  TNode<Object> constant = LoadConstantPoolEntryAtOperandIndex(0);
  TNode<Context> context = GetContext();
  SetAccumulator(constant);
  CallRuntime(Runtime::kMyRuntime, context, constant);//Here is calling MyRuntime
  Dispatch();
}

During LdaConstant is executing, our MyRuntime is called, Figure 1 is the call stack of MyRuntime.

3. Easter egg

In fact, V8 has several functions that can be used to debug builtins like bytecode, such as Runtime_DebugPrint:

1.  RUNTIME_FUNCTION(Runtime_DebugPrint) {
2.    SealHandleScope shs(isolate);
3.    DCHECK_EQ(1, args.length());
4.    MaybeObject maybe_object(*args.address_of_arg_at(0));
5.    DebugPrintImpl(maybe_object);
6.    return args[0];
7.  }
8.  //...........separation......................
9.  void CodeStubAssembler::Print(const char* prefix,
10.                                TNode<MaybeObject> tagged_value) {
11.    if (prefix != nullptr) {
12.      std::string formatted(prefix);
13.      formatted += ": ";
14.      Handle<String> string = isolate()->factory()->NewStringFromAsciiChecked(
15.          formatted.c_str(), AllocationType::kOld);
16.      CallRuntime(Runtime::kGlobalPrint, NoContextConstant(),
17.                  HeapConstant(string));
18.    }
19.    // CallRuntime only accepts Objects, so do an UncheckedCast to object.
20.    // DebugPrint explicitly checks whether the tagged value is a MaybeObject.
21.    TNode<Object> arg = UncheckedCast<Object>(tagged_value);
22.    CallRuntime(Runtime::kDebugPrint, NoContextConstant(), arg);
23.  }

In the above code, the void Print(const char* s) is defined in code-stub-assembler.h. The Print is the Easter Egg I said. With the Print, you can output information in the bytecode execution. The technology behind Print is the call each other between Runtime and Bytecode that I mentioned above because the 22nd line calls Runtime_DebugPrint on the 1st line.

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8 — Chapter 14: What in V8 is the JS Dynamically Type?

灰豆 — Thu, 01 Sep 2022 01:59:49 +0000

Original source: https://medium.com/@huidou/lets-understand-chrome-v8-chapter-14-what-in-v8-is-the-js-dynamically-type-c68bb09caa4f
Welcome to other chapters of Let’s Understand Chrome V8

JavaScript is a dynamically typed language, so we don’t care about the data type, just use var to define the variable we want. But in C++, you have to figure out and read up a lot about integers and longs and chars and so on to just a very simple hello world program. It’s C++ which is a statically typed language. So, how does a static language like C++ power the dynamically typed JavaScript? That’s what I would like to talk about in this article.

1. Map layout

In C++, a JavaScript object is just a piece of memory with no type. C++ doesn’t know how many and what values are in this memory. In JavaScript philosophy, these values can change dynamically, so how can C++ know the latest type in order to maintain a JavaScript object?

Look at Figure 1, let’s talk about the map class used by V8, namely the hidden class.

From a JavaScript developer’s perspective, you can only see blue memory, which is your JavaScript object;
In V8, I can see all memory, green memory (map), and blue memory (JavaScript objects).

The map size is 80bytes, and it is used to protect the type of a JavaScript object, which is the layout of the blue memory — what data is stored, strings, arrays, or other? How to read this data? Namely, the addressing method. Note: Map only saves the addressing method, not the data in a JavaScript object.

Before maintaining a JavaScript object, V8 takes out the addressing method from the map first, then can read and write blue memory correctly. V8 updates the latest addressing method into the JavasCript object’s map in time once its type changes. In this way, JavaScript developers can alter the object type freely.

To sum up, in C++, the data type is still static, and the most important thing is to update the map in time when the type changes. It is the truth that you’d like to know. The technology behind the dynamic features is powered by C++.

The description of the map is below.

1.  Map layout:
2.  // +---------------+---------------------------------------------+
3.  // |   _ Type _    | _ Description _                             |
4.  // +---------------+---------------------------------------------+
5.  // | TaggedPointer | map - Always a pointer to the MetaMap root  |
6.  // +---------------+---------------------------------------------+
7.  // | Int           | The first int field                         |
8.  //  `---+----------+---------------------------------------------+
9.  //      | Byte     | [instance_size]                             |
10.  //      +----------+---------------------------------------------+
11.  //      | Byte     | If Map for a primitive type:                |
12.  //      |          |   native context index for constructor fn   |
13.  //      |          | If Map for an Object type:                  |
14.  //      |          |   inobject properties start offset in words |
15.  //      +----------+---------------------------------------------+
16.  //      | Byte     | [used_or_unused_instance_size_in_words]     |
17.  //      |          | For JSObject in fast mode this byte encodes |
18.  //      |          | the size of the object that includes only   |
19.  //      |          | the used property fields or the slack size  |
20.  //      |          | in properties backing store.                |
21.  //      +----------+---------------------------------------------+
22.  //      | Byte     | [visitor_id]                                |
23.  // +----+----------+---------------------------------------------+
24.  // | Int           | The second int field                        |
25.  //  `---+----------+---------------------------------------------+
26.  //      | Short    | [instance_type]                             |
27.  //      +----------+---------------------------------------------+
28.  //      | Byte     | [bit_field]                                 |
29.  //      |          |   - has_non_instance_prototype (bit 0)      |
30.  //      |          |   - is_callable (bit 1)                     |
31.  //      |          |   - has_named_interceptor (bit 2)           |
32.  //      |          |   - has_indexed_interceptor (bit 3)         |
33.  //      |          |   - is_undetectable (bit 4)                 |
34.  //      |          |   - is_access_check_needed (bit 5)          |
35.  //      |          |   - is_constructor (bit 6)                  |
36.  //      |          |   - has_prototype_slot (bit 7)              |
37.  //      +----------+---------------------------------------------+
38.  //      | Byte     | [bit_field2]                                |
39.  //      |          |   - new_target_is_base (bit 0)              |
40.  //      |          |   - is_immutable_proto (bit 1)              |
41.  //      |          |   - unused bit (bit 2)                      |
42.  //      |          |   - elements_kind (bits 3..7)               |
43.  // +----+----------+---------------------------------------------+
44.  // | Int           | [bit_field3]                                |
45.  // |               |   - enum_length (bit 0..9)                  |
46.  // |               |   - number_of_own_descriptors (bit 10..19)  |
47.  // |               |   - is_prototype_map (bit 20)               |
48.  // |               |   - is_dictionary_map (bit 21)              |
49.  // |               |   - owns_descriptors (bit 22)               |
50.  // |               |   - is_in_retained_map_list (bit 23)        |
51.  // |               |   - is_deprecated (bit 24)                  |
52.  // |               |   - is_unstable (bit 25)                    |
53.  // |               |   - is_migration_target (bit 26)            |
54.  // |               |   - is_extensible (bit 28)                  |
55.  // |               |   - may_have_interesting_symbols (bit 28)   |
56.  // |               |   - construction_counter (bit 29..31)       |
57.  // |               |                                             |
58.  // +*************************************************************+
59.  // | Int           | On systems with 64bit pointer types, there  |
60.  // |               | is an unused 32bits after bit_field3        |
61.  // +*************************************************************+
62.  // | TaggedPointer | [prototype]                                 |
63.  // +---------------+---------------------------------------------+
64.  // | TaggedPointer | [constructor_or_backpointer]                |
65.  // +---------------+---------------------------------------------+
66.  // | TaggedPointer | [instance_descriptors]                      |
67.  // +*************************************************************+
68.  // ! TaggedPointer ! [layout_descriptors]                        !
69.  // !               ! Field is only present if compile-time flag  !
70.  // !               ! FLAG_unbox_double_fields is enabled         !
71.  // !               ! (basically on 64 bit architectures)         !
72.  // +*************************************************************+
73.  // | TaggedPointer | [dependent_code]                            |
74.  // +---------------+---------------------------------------------+
75.  // | TaggedPointer | [prototype_validity_cell]                   |
76.  // +---------------+---------------------------------------------+
77.  // | TaggedPointer | If Map is a prototype map:                  |
78.  // |               |   [prototype_info]                          |
79.  // |               | Else:                                       |
80.  // |               |   [raw_transitions]                         |
81.  // +---------------+---------------------------------------------+

The size and layout of the map are predefined constants that do not change. Each heap-managed object has a map. The shape of both two objects is same, in other words, the two objects have the same internal members and member positions which means that they have the same addressing method, so they share the same map.

See the code below.

function Point(x,y) {
    this.x = x;
    this.y = y;
}

var fun1 = new Point(1,2);
var fun2 = new Point(3,4);
fun2.z = 80;

The fun1 and fun2 come from the same constructor, they have the same shape, so they share the same map. But after fun2.z=80, the shape of fun2 is changed, so V8 assigns a new map for it.

Class map is below.

1.  class Map : public HeapObject {
2.   public:
3.  //.............omit..................
4.     DECL_PRIMITIVE_ACCESSORS(bit_field, byte)
5.     DECL_PRIMITIVE_ACCESSORS(relaxed_bit_field, byte)
6.   // Bit positions for |bit_field|.
7.   #define MAP_BIT_FIELD_FIELDS(V, _)          \
8.     V(HasNonInstancePrototypeBit, bool, 1, _) \
9.     V(IsCallableBit, bool, 1, _)              \
10.     V(HasNamedInterceptorBit, bool, 1, _)     \
11.     V(HasIndexedInterceptorBit, bool, 1, _)   \
12.     V(IsUndetectableBit, bool, 1, _)          \
13.     V(IsAccessCheckNeededBit, bool, 1, _)     \
14.     V(IsConstructorBit, bool, 1, _)           \
15.     V(HasPrototypeSlotBit, bool, 1, _)
16.     DEFINE_BIT_FIELDS(MAP_BIT_FIELD_FIELDS)
17.   #undef MAP_BIT_FIELD_FIELDS
18.     // Bit field 2.
19.     DECL_PRIMITIVE_ACCESSORS(bit_field2, byte)
20.   // Bit positions for |bit_field2|.
21.   #define MAP_BIT_FIELD2_FIELDS(V, _)      \
22.     V(NewTargetIsBaseBit, bool, 1, _)      \
23.     V(IsImmutablePrototypeBit, bool, 1, _) \
24.     V(UnusedBit, bool, 1, _)               \
25.     V(ElementsKindBits, ElementsKind, 5, _)
26.     DEFINE_BIT_FIELDS(MAP_BIT_FIELD2_FIELDS)
27.   #undef MAP_BIT_FIELD2_FIELDS
28.     DECL_PRIMITIVE_ACCESSORS(bit_field3, uint32_t)
29.     V8_INLINE void clear_padding();
30.      DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
31.                                    TORQUE_GENERATED_MAP_FIELDS)
32.      //.............omit..................
33.      OBJECT_CONSTRUCTORS(Map, HeapObject);
34.  };

Below is the expansion of the DEFINE_FIELD_OFFSET_CONSTANTS macro.

1.    enum {
2.  TORQUE_GENERATED_MAP_FIELDS_StartOffset= 7,
3.  kInstanceSizeInWordsOffset=8, kInstanceSizeInWordsOffsetEnd = 8,
4.  kInObjectPropertiesStartOrConstructorFunctionIndexOffset=9, kInObjectPropertiesStartOrConstructorFunctionIndexOffsetEnd = 9,
5.  kUsedOrUnusedInstanceSizeInWordsOffset=10, kUsedOrUnusedInstanceSizeInWordsOffsetEnd = 10,
6.  kVisitorIdOffset=11, kVisitorIdOffsetEnd = 11,
7.  kInstanceTypeOffset=12, kInstanceTypeOffsetEnd = 13,
8.  kBitFieldOffset=14, kBitFieldOffsetEnd = 14,
9.  kBitField2Offset=15, kBitField2OffsetEnd = 15,
10.  kBitField3Offset=16, kBitField3OffsetEnd = 19,
11.  kOptionalPaddingOffset=20, kOptionalPaddingOffsetEnd = 23,
12.  kStartOfStrongFieldsOffset=24, kStartOfStrongFieldsOffsetEnd = 23,
13.  kPrototypeOffset=24, kPrototypeOffsetEnd = 31,
14.  kConstructorOrBackPointerOffset=32, kConstructorOrBackPointerOffsetEnd = 39,
15.  kInstanceDescriptorsOffset=40, kInstanceDescriptorsOffsetEnd = 47,
16.  kLayoutDescriptorOffset=48, kLayoutDescriptorOffsetEnd = 55,
17.  kDependentCodeOffset=56, kDependentCodeOffsetEnd = 63,
18.  kPrototypeValidityCellOffset=64, kPrototypeValidityCellOffsetEnd = 71,
19.  kEndOfStrongFieldsOffset=72, kEndOfStrongFieldsOffsetEnd = 71,
20.  kStartOfWeakFieldsOffset=72, kStartOfWeakFieldsOffsetEnd = 71,
21.  kTransitionsOrPrototypeInfoOffset=72, kTransitionsOrPrototypeInfoOffsetEnd = 79,
22.  kEndOfWeakFieldsOffset=80, kEndOfWeakFieldsOffsetEnd = 79,
23.  kSize=80, kSizeEnd = 79,
24.    }

The enumeration here is consistent with the map description mentioned above. Note that, in the new version of V8 in the future, the map may change, and new member variables may appear in this enumeration.

A map is a heap-managed object of V8. When new a map, V8 uses the following function to allocate memory from the V8 heap.

1.  AllocationResult Heap::AllocateRaw(int size_in_bytes, AllocationType type,
2.                                     AllocationOrigin origin,
3.                                     AllocationAlignment alignment) {
4.  //.....omit.......
5.    if (AllocationType::kYoung == type) {
6.  //.....omit.......
7.    } else if (AllocationType::kOld == type) {
8.  //.....omit.......
9.    } else if (AllocationType::kCode == type) {
10.      if (size_in_bytes <= code_space()->AreaSize() && !large_object) {
11.        allocation = code_space_->AllocateRawUnaligned(size_in_bytes);
12.      } else {
13.        allocation = code_lo_space_->AllocateRaw(size_in_bytes);
14.      }
15.    } else if (AllocationType::kMap == type) {
16.      allocation = map_space_->AllocateRawUnaligned(size_in_bytes);
17.    } else if (AllocationType::kReadOnly == type) {
18.  #ifdef V8_USE_SNAPSHOT
19.      DCHECK(isolate_->serializer_enabled());
20.  #endif
21.      DCHECK(!large_object);
22.      DCHECK(CanAllocateInReadOnlySpace());
23.      DCHECK_EQ(AllocationOrigin::kRuntime, origin);
24.      allocation =
25.          read_only_space_->AllocateRaw(size_in_bytes, alignment, origin);
26.    } else {
27.      UNREACHABLE();
28.    }
29.    return allocation;
30.  }

When line 15 is true, the type is kMap and size_in_bytes is 80, which means that is allocating memory for a new map. Figure 2 is the call stack.

2. Map initialization

During the V8 startup, the below CreateInitialMaps initialize empty maps for all JavaScript types. The empty map descript the minimum requirements for a JavaScript object. When you new a JavaScript object, V8 fills some necessary information (object type, size …) into the corresponding empty map.

1.  bool Heap::CreateInitialMaps() {
2.    HeapObject obj;
3.    {
4.      AllocationResult allocation = AllocatePartialMap(MAP_TYPE, Map::kSize);
5.      if (!allocation.To(&obj)) return false;
6.    }
7.    Map new_meta_map = Map::unchecked_cast(obj);
8.    set_meta_map(new_meta_map);
9.    new_meta_map.set_map_after_allocation(new_meta_map);
10.  //...................omit...................
11.    ReadOnlyRoots roots(this);
12.    {  // Partial map allocation
13.  #define ALLOCATE_PARTIAL_MAP(instance_type, size, field_name)                \
14.    {                                                                          \
15.      Map map;                                                                 \
16.      if (!AllocatePartialMap((instance_type), (size)).To(&map)) return false; \
17.      set_##field_name##_map(map);                                             \
18.    }
19.      ALLOCATE_PARTIAL_MAP(FIXED_ARRAY_TYPE, kVariableSizeSentinel, fixed_array);
20.      ALLOCATE_PARTIAL_MAP(WEAK_FIXED_ARRAY_TYPE, kVariableSizeSentinel,
21.                           weak_fixed_array);
22.      ALLOCATE_PARTIAL_MAP(WEAK_ARRAY_LIST_TYPE, kVariableSizeSentinel,
23.  //..................omit...................
24.  #undef ALLOCATE_PARTIAL_MAP
25.    }
26.    // Allocate the empty array.
27.    {
28.      AllocationResult alloc =
29.          AllocateRaw(FixedArray::SizeFor(0), AllocationType::kReadOnly);
30.      if (!alloc.To(&obj)) return false;
31.      obj.set_map_after_allocation(roots.fixed_array_map(), SKIP_WRITE_BARRIER);
32.      FixedArray::cast(obj).set_length(0);
33.    }
34.    set_empty_fixed_array(FixedArray::cast(obj));
35.  //...................omit....................
36.    FinalizePartialMap(roots.meta_map());
37.    FinalizePartialMap(roots.fixed_array_map());
38.    FinalizePartialMap(roots.weak_fixed_array_map());
39.    {
40.      if (!AllocateRaw(FixedArray::SizeFor(0), AllocationType::kReadOnly)
41.               .To(&obj)) {
42.        return false;
43.      }
44.      obj.set_map_after_allocation(roots.closure_feedback_cell_array_map(),
45.                                   SKIP_WRITE_BARRIER);
46.      FixedArray::cast(obj).set_length(0);
47.      set_empty_closure_feedback_cell_array(ClosureFeedbackCellArray::cast(obj));
48.    }
49.    DCHECK(!InYoungGeneration(roots.empty_fixed_array()));
50.    roots.bigint_map().SetConstructorFunctionIndex(
51.        Context::BIGINT_FUNCTION_INDEX);
52.    return true;
53.  }

Lines 4, 5, 6, 7, and 8 create meta_data for all maps. From lines 13 to 22, use the macro ALLOCATE_PARTIAL_MAP to create empty maps for ARRAY_LIST and ARRAY. From lines 27 to 34, create empty maps for other types. The map creations are in batches because the subsequent creation needs to use the previous results.

On line 36, all empty maps are saved to roots_table, as shown in Figure 3.

Root_table is defined by the following macro.

#define READ_ONLY_ROOT_LIST(V)     \
  STRONG_READ_ONLY_ROOT_LIST(V)    \
  INTERNALIZED_STRING_ROOT_LIST(V) \
  PRIVATE_SYMBOL_ROOT_LIST(V)      \
  PUBLIC_SYMBOL_ROOT_LIST(V)       \
  WELL_KNOWN_SYMBOL_ROOT_LIST(V)   \
  STRUCT_MAPS_LIST(V)              \
  ALLOCATION_SITE_MAPS_LIST(V)     \
  DATA_HANDLER_MAPS_LIST(V)

#define MUTABLE_ROOT_LIST(V)                \
  STRONG_MUTABLE_IMMOVABLE_ROOT_LIST(V)     \
  STRONG_MUTABLE_MOVABLE_ROOT_LIST(V)       \
  V(StringTable, string_table, StringTable) \
  SMI_ROOT_LIST(V)

#define ROOT_LIST(V)     \
  READ_ONLY_ROOT_LIST(V) \
  MUTABLE_ROOT_LIST(V)

Root_table holds not only the map but also other heap objects. Through the parameters of the macro template, we can roughly guess the role of each element. If you want to dive deeper, please debug.

_Okay, that wraps it up for this share. I’ll see you guys next time, take care!
_
Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8 — Chapter 13: String Ojbect Analysis

灰豆 — Mon, 29 Aug 2022 02:27:35 +0000

Original source: https://medium.com/@huidou/lets-understand-chrome-v8-chapter-13-string-ojbect-analysis-f594b1cdfd48
Welcome to other chapters of Let’s Understand Chrome V8

A Javascript object is a collection of properties and some member methods. Use the “.” symbol to operate property values. We know that the string is not an object, so why does it have properties? Because V8 converts a string into an object first when operating properties of the string. The conversion is invisible to developers. But in V8, you can see the conversion detail and understand the source code of the String object.

In this paper, we’ll talk about the conversion from a string to a string object.

1. String variable

1.var s = "hello world!";
2.var word = s.substring(s.indexOf(" ")+1,s.length);
3.console.log(word)

Look at the above code, the string s is not an object, but when we call .indexOf(), V8 will convert s to a string object. Let’s talk about conversion from the following two questions.

(1) In the 1st line, let’s take a look at what type of the s is?

(2) In the 2nd line, when we call .indexOf, how does V8 convert it to an object?

Look at the code below, which is the bytecode data of our case.

1.  [generated bytecode for function:  (0x03d78d381bd1 <SharedFunctionInfo>)]
2.  Parameter count 1
3.  Register count 6
4.  Frame size 48
5.           000003D78D381D06 @    0 : 12 00             LdaConstant [0]
6.           000003D78D381D08 @    2 : 26 fa             Star r1
7.           000003D78D381D0A @    4 : 0b                LdaZero
8.           000003D78D381D0B @    5 : 26 f9             Star r2
9.           000003D78D381D0D @    7 : 27 fe f8          Mov <closure>, r3
10.           000003D78D381D10 @   10 : 61 2d 01 fa 03    CallRuntime [DeclareGlobals], r1-r3
11.      0 E> 000003D78D381D15 @   15 : a7                StackCheck
12.      8 S> 000003D78D381D16 @   16 : 12 01             LdaConstant [1]
13.      8 E> 000003D78D381D18 @   18 : 15 02 04          StaGlobal [2], [4]
14.     36 S> 000003D78D381D1B @   21 : 13 02 00          LdaGlobal [2], [0]
15.           000003D78D381D1E @   24 : 26 f9             Star r2
16.     38 E> 000003D78D381D20 @   26 : 29 f9 03          LdaNamedPropertyNoFeedback r2, [3]
17.           000003D78D381D23 @   29 : 26 fa             Star r1
18.     48 E> 000003D78D381D25 @   31 : 13 02 00          LdaGlobal [2], [0]
19.           000003D78D381D28 @   34 : 26 f7             Star r4
20.     50 E> 000003D78D381D2A @   36 : 29 f7 04          LdaNamedPropertyNoFeedback r4, [4]
21.           000003D78D381D2D @   39 : 26 f8             Star r3
22.           000003D78D381D2F @   41 : 12 05             LdaConstant [5]
23.           000003D78D381D31 @   43 : 26 f6             Star r5
24.     50 E> 000003D78D381D33 @   45 : 5f f8 f7 02       CallNoFeedback r3, r4-r5
25.     62 E> 000003D78D381D37 @   49 : 40 01 06          AddSmi [1], [6]
26.           000003D78D381D3A @   52 : 26 f8             Star r3
27.     65 E> 000003D78D381D3C @   54 : 13 02 00          LdaGlobal [2], [0]
28.           000003D78D381D3F @   57 : 26 f7             Star r4
29.     67 E> 000003D78D381D41 @   59 : 29 f7 06          LdaNamedPropertyNoFeedback r4, [6]
30.           000003D78D381D44 @   62 : 26 f7             Star r4
31.  //....omit......
32.  Constant pool (size = 10)
33.  000003D78D381C71: [FixedArray] in OldSpace
34.   - map: 0x03ac45880169 <Map>
35.   - length: 10
36.             0: 0x03d78d381c11 <FixedArray[8]>
37.             1: 0x03d78d381b69 <String[#12]: hello world!>
38.             2: 0x03d78d381b51 <String[#1]: s>
39.             3: 0x02ed266ea9e9 <String[#9]: substring>
40.             4: 0x02ed266e8121 <String[#7]: indexOf>
41.             5: 0x006d3e183c21 <String[#1]:  >
42.             6: 0x03ac45884819 <String[#6]: length>
43.             7: 0x03ac45885301 <String[#4]: word>
44.             8: 0x02ed266f2441 <String[#7]: console>
45.             9: 0x02ed266f1a81 <String[#3]: log>
46.  Handler Table (size = 0)

Before diving in, let’s take a look at a concept — constant pool(from lines 32 to 45), which is a string-type array generated during JavaScript compilation and used to store constants. The 37th line is the string hello world! and the 38th line code is the string s, these two lines are the variable s we are talking about.

Let’s look at lines 12 and 13, LdaConstant loads the constant-pool[1] into the accumulator, and StaGlobal uses the constant-pool[2] as the name to store the accumulator. What is the meaning of these two lines? They are declaring the string variable s(var s = “hello world!”) for our case.

Debug line 13 to find out how to store the value of variable s in detail. If we can see how to store s, we can see his type incidentally.

After Debugging, we find the following code will be called.

RUNTIME_FUNCTION(Runtime_StoreGlobalICNoFeedback_Miss) {
  HandleScope scope(isolate);
  DCHECK_EQ(2, args.length());
  // Runtime functions don't follow the IC's calling convention.
  Handle<Object> value = args.at(0);
  Handle<Name> key = args.at<Name>(1);

  // TODO(mythria): Replace StoreGlobalStrict/Sloppy with StoreNamed.
  StoreGlobalIC ic(isolate, Handle<FeedbackVector>(), FeedbackSlot(),
                   FeedbackSlotKind::kStoreGlobalStrict);
  RETURN_RESULT_OR_FAILURE(isolate, ic.Store(key, value));
}
//.................separation...................................
#define RETURN_RESULT_OR_FAILURE(isolate, call)      \
  do {                                               \
    Handle<Object> __result__;                       \
    Isolate* __isolate__ = (isolate);                \
    if (!(call).ToHandle(&__result__)) {             \
      DCHECK(__isolate__->has_pending_exception());  \
      return ReadOnlyRoots(__isolate__).exception(); \
    }                                                \
    DCHECK(!__isolate__->has_pending_exception());   \
    return *__result__;                              \
  } while (false)

In the above code, the RETURN_RESULT_OR_FAILURE is a macro template. We go on with debugging the code and step into the WriteDataValue() which is below.

void LookupIterator::WriteDataValue(Handle<Object> value,
                                    bool initializing_store) {
  DCHECK_EQ(DATA, state_);
  Handle<JSReceiver> holder = GetHolder<JSReceiver>();
  if (IsElement()) {
    Handle<JSObject> object = Handle<JSObject>::cast(holder);
    ElementsAccessor* accessor = object->GetElementsAccessor(isolate_);
    accessor->Set(object, number_, *value);
  } else if (holder->HasFastProperties(isolate_)) {
    if (property_details_.location() == kField) {
  //omit.........................

In WriteDataValue, determine whether the parameter value is a global object. In our case, the value is our s apparently, which is a global object and meets the condition in Figure 1.

Look at the green marks in Figure 1, the value is our hello world!, and its type is ONE_BYTE_INTERNALIZED_STRING, which solves question 1 exactly.

2. String object

Let’s take a look at question 2, how to convert a string variable to an object.

Our case is calling .substring(). In the bytecode array of the case, lines 14 and 15 have stored the variable s in register r2, line 16 needs to load .substring() for r2, and the below bytecode LdaNamedPropertyNoFeedback is responsible for loading properties.

1.  IGNITION_HANDLER(LdaNamedPropertyNoFeedback, InterpreterAssembler) {
2.    TNode<Object> object = LoadRegisterAtOperandIndex(0);
3.    TNode<Name> name = CAST(LoadConstantPoolEntryAtOperandIndex(1));
4.    TNode<Context> context = GetContext();
5.    TNode<Object> result =
6.        CallBuiltin(Builtins::kGetProperty, context, object, name);
7.    SetAccumulator(result);
8.    CallRuntime(Runtime::kDebugPrint, context, object, name,result);//This is the debug command I wrote,@huidou
9.    Dispatch();
10.  }
11.  //.........................separation.........................................
12.  TF_BUILTIN(GetProperty, CodeStubAssembler) {
13.    Node* object = Parameter(Descriptor::kObject);
14.    Node* key = Parameter(Descriptor::kKey);
15.    Node* context = Parameter(Descriptor::kContext);
16.    // TODO(duongn): consider tailcalling to GetPropertyWithReceiver(object,
17.    // object, key, OnNonExistent::kReturnUndefined).
18.    Label if_notfound(this), if_proxy(this, Label::kDeferred),
19.        if_slow(this, Label::kDeferred);
20.    CodeStubAssembler::LookupInHolder lookup_property_in_holder =
21.        [=](Node* receiver, Node* holder, Node* holder_map,
22.            Node* holder_instance_type, Node* unique_name, Label* next_holder,
23.            Label* if_bailout) {
24.          VARIABLE(var_value, MachineRepresentation::kTagged);
25.          Label if_found(this);
26.          TryGetOwnProperty(context, receiver, holder, holder_map,
27.                            holder_instance_type, unique_name, &if_found,
28.                            &var_value, next_holder, if_bailout);
29.          BIND(&if_found);
30.          Return(var_value.value());
31.        };
32.    CodeStubAssembler::LookupInHolder lookup_element_in_holder =
33.        [=](Node* receiver, Node* holder, Node* holder_map,
34.            Node* holder_instance_type, Node* index, Label* next_holder,
35.            Label* if_bailout) {
36.          // Not supported yet.
37.          Use(next_holder);
38.          Goto(if_bailout);
39.        };
40.    TryPrototypeChainLookup(object, object, key, lookup_property_in_holder,
41.                            lookup_element_in_holder, &if_notfound, &if_slow,
42.                            &if_proxy);
43.    BIND(&if_notfound);
44.    Return(UndefinedConstant());
45.    BIND(&if_slow);
46.    TailCallRuntime(Runtime::kGetProperty, context, object, key);
47.    BIND(&if_proxy);
48.    {
49.      // Convert the {key} to a Name first.
50.      TNode<Object> name = CallBuiltin(Builtins::kToName, context, key);
51.      // The {object} is a JSProxy instance, look up the {name} on it, passing
52.      // {object} both as receiver and holder. If {name} is absent we can safely
53.      // return undefined from here.
54.      TailCallBuiltin(Builtins::kProxyGetProperty, context, object, name, object,
55.                      SmiConstant(OnNonExistent::kReturnUndefined));
56.    }
57.  }

In the process of debugging LdaNamedPropertyNoFeedback, we can only see the assembly code, but not the C++ source code. The bytecode is stored separately in the snapshot_blob file and loaded by V8 in the deserialized way without the symbol table, so we can’t see C++.

The 8th line of code is my additional CallRuntime, which is used to return to the C++ environment for watching variables.

Look at Figure 2. With the help of line 8, we can get back to the C++ environment. Here, we can only watch variables, not debug. We will return to the assembly environment if we do a step. Figure 3 is the call stack.

To sum up, in Figure 2, the args[0] is ‘hello world!’, which is the global variable s declared before. Note that its type is still ONE_BYTE_INTERNALIZED_STRING. Let’s look at args[2], its type is JS_FUNCTION, which is the address of the substring() method.

At this point, the . operation is completed, and s is still a string. Actually, it doesn’t prevent V8 from calling the substring and returning the value. This is the implementation style of V8, the engineering method and technical principle may be dissimilar.

3. Summary

In v8, the String is subdivided into many subtypes which are below.

switch (map.instance_type()) {
    case CONS_STRING_TYPE:
    case CONS_ONE_BYTE_STRING_TYPE:
    case THIN_STRING_TYPE:
    case THIN_ONE_BYTE_STRING_TYPE:
    case SLICED_STRING_TYPE:
    case SLICED_ONE_BYTE_STRING_TYPE:
    case EXTERNAL_STRING_TYPE:
    case EXTERNAL_ONE_BYTE_STRING_TYPE:
    case UNCACHED_EXTERNAL_STRING_TYPE:
    case UNCACHED_EXTERNAL_ONE_BYTE_STRING_TYPE:
    case STRING_TYPE:
    case ONE_BYTE_STRING_TYPE:
    //omit........................

When using .substring(), the variable s is still a string. In the V8 implementation, the string is a heap-managed object, but as I’ve mentioned, its type is the string.
Below is the function I use to debug a bytecode, it is Runtime, and the usage is CallRuntime(Runtime::kDebugPrint, context, your args0, your args1….). You can see how I use it in the code above.

1.  RUNTIME_FUNCTION(Runtime_DebugPrint) {
2.    SealHandleScope shs(isolate);
3.    //DCHECK_EQ(1, args.length());
4.    MaybeObject maybe_object(*args.address_of_arg_at(0));
5.    StdoutStream os;
6.    if (maybe_object->IsCleared()) {
7.      os << "[weak cleared]";
8.    } else {
9.      Object object = maybe_object.GetHeapObjectOrSmi();
10.      bool weak = maybe_object.IsWeak();
11.  #ifdef DEBUG
12.      if (object.IsString() && !isolate->context().is_null()) {
13.        DCHECK(!weak);
14.        // If we have a string, assume it's a code "marker"
15.        // and print some interesting cpu debugging info.
16.        object.Print(os);
17.        JavaScriptFrameIterator it(isolate);
18.        JavaScriptFrame* frame = it.frame();
19.        os << "fp = " << reinterpret_cast<void*>(frame->fp())
20.           << ", sp = " << reinterpret_cast<void*>(frame->sp())
21.           << ", caller_sp = " << reinterpret_cast<void*>(frame->caller_sp())
22.           << ": ";
23.      } else {
24.        os << "DebugPrint: ";
25.        if (weak) {
26.          os << "[weak] ";
27.        }
28.        object.Print(os);
29.      }
30.      if (object.IsHeapObject()) {
31.        HeapObject::cast(object).map().Print(os);
32.      }
33.  #else
34.      if (weak) {
35.        os << "[weak] ";
36.      }
37.      // ShortPrint is available in release mode. Print is not.
38.      os << Brief(object);
39.  #endif
40.    }
41.    os << std::endl;
42.    return args[0];  // return TOS
43.  }

By the way, you can also use the function in your JavaScript source via the allow-natives-syntax option.

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8 — Chapter 12: What is JSFunction?

灰豆 — Sun, 28 Aug 2022 01:06:33 +0000

Original source: https://medium.com/@huidou/lets-understand-chrome-v8-chapter-12-what-is-jsfunction-2a03cd2291c6
Welcome to other chapters of Let’s Understand Chrome V8

The data structure that saves bytecodes is SharedFunction, and the SharedFunction bound to the context is JSFunction. What is the difference? In my opinion, a SharedFunction is like a DLL, a common library that can be shared by multiple programs; and, a JSFunction is a specific executable program. In this paper, we’ll talk about the JSFunction’s code and the memory layout.

1. JSFunction’s code

Below is the definition of JSFunction:

1.  class JSFunction : public JSObject {
2.    public:
3.     DECL_ACCESSORS(prototype_or_initial_map, HeapObject)
4.     DECL_ACCESSORS(shared, SharedFunctionInfo)
5.     static const int kLengthDescriptorIndex = 0;
6.     static const int kNameDescriptorIndex = 1;
7.     static const int kMaybeHomeObjectDescriptorIndex = 2;
8.     inline Context context();
9.     inline bool has_context() const;
10.    inline void set_context(HeapObject context);
11.    inline JSGlobalProxy global_proxy();
12.    inline NativeContext native_context();
13.    inline int length();
14.    static Handle<Object> GetName(Isolate* isolate, Handle<JSFunction> function);
15.    static Handle<NativeContext> GetFunctionRealm(Handle<JSFunction> function);
16.    inline Code code() const;
17.    inline void set_code(Code code);
18.    inline void set_code_no_write_barrier(Code code);
19.    inline AbstractCode abstract_code();
20.    inline bool IsInterpreted();
21.    inline bool ChecksOptimizationMarker();
22.    inline bool IsOptimized();
23.    inline bool HasOptimizedCode();
24.    inline bool HasOptimizationMarker();
25.    void MarkForOptimization(ConcurrencyMode mode);
26.    inline bool IsMarkedForOptimization();
27.    inline bool IsMarkedForConcurrentOptimization();
28.    inline bool IsInOptimizationQueue();
29.    inline void ClearOptimizedCodeSlot(const char* reason);
30.    inline void SetOptimizationMarker(OptimizationMarker marker);
31.    inline void ClearOptimizationMarker();
32.    int ComputeInstanceSizeWithMinSlack(Isolate* isolate);
33.    inline void CompleteInobjectSlackTrackingIfActive();
34.    DECL_ACCESSORS(raw_feedback_cell, FeedbackCell)
35.    inline FeedbackVector feedback_vector() const;
36.    inline bool has_feedback_vector() const;
37.    V8_EXPORT_PRIVATE static void EnsureFeedbackVector(
38.        Handle<JSFunction> function);
39.    inline bool has_closure_feedback_cell_array() const;
40.    inline ClosureFeedbackCellArray closure_feedback_cell_array() const;
41.    static void EnsureClosureFeedbackCellArray(Handle<JSFunction> function);
42.    static void InitializeFeedbackCell(Handle<JSFunction> function);
43.    void ClearTypeFeedbackInfo();
44.    inline bool NeedsResetDueToFlushedBytecode();
45.    inline void ResetIfBytecodeFlushed();
46.    DECL_GETTER(has_prototype_slot, bool)
47.    DECL_GETTER(initial_map, Map)
48.    static void SetInitialMap(Handle<JSFunction> function, Handle<Map> map,
49.                              Handle<HeapObject> prototype);
50.    DECL_GETTER(has_initial_map, bool)
51.    V8_EXPORT_PRIVATE static void EnsureHasInitialMap(
52.        Handle<JSFunction> function);
53.    static V8_WARN_UNUSED_RESULT MaybeHandle<Map> GetDerivedMap(
54.        Isolate* isolate, Handle<JSFunction> constructor,
55.        Handle<JSReceiver> new_target);
56.    DECL_GETTER(has_prototype, bool)
57.    DECL_GETTER(has_instance_prototype, bool)
58.    DECL_GETTER(prototype, Object)
59.    DECL_GETTER(instance_prototype, HeapObject)
60.    DECL_GETTER(has_prototype_property, bool)
61.    DECL_GETTER(PrototypeRequiresRuntimeLookup, bool)
62.    static void SetPrototype(Handle<JSFunction> function, Handle<Object> value);
63.    inline bool is_compiled() const;
64.    static int GetHeaderSize(bool function_has_prototype_slot) {
65.      return function_has_prototype_slot ? JSFunction::kSizeWithPrototype
66.                                         : JSFunction::kSizeWithoutPrototype;
67.    }
68.    void PrintName(FILE* out = stdout);
69.    DECL_CAST(JSFunction)
70.    static V8_WARN_UNUSED_RESULT int CalculateExpectedNofProperties(
71.        Isolate* isolate, Handle<JSFunction> function);
72.    static void CalculateInstanceSizeHelper(InstanceType instance_type,
73.                                            bool has_prototype_slot,
74.                                            int requested_embedder_fields,
75.                                            int requested_in_object_properties,
76.                                            int* instance_size,
77.                                            int* in_object_properties);
78.    DECL_PRINTER(JSFunction)
79.    DECL_VERIFIER(JSFunction)
80.    static Handle<String> GetName(Handle<JSFunction> function);
81.    static V8_WARN_UNUSED_RESULT bool SetName(Handle<JSFunction> function,
82.                                              Handle<Name> name,
83.                                              Handle<String> prefix);
84.    static Handle<String> GetDebugName(Handle<JSFunction> function);
85.    static Handle<String> ToString(Handle<JSFunction> function);
86.  //
87.    DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
88.                                  TORQUE_GENERATED_JSFUNCTION_FIELDS)
89.    static constexpr int kSizeWithoutPrototype = kPrototypeOrInitialMapOffset;
90.    static constexpr int kSizeWithPrototype = kSize;
91.    OBJECT_CONSTRUCTORS(JSFunction, JSObject);
92.  };

Three index members are defined from lines 5 to 7, which are static members and apply to all SharedFunction instances. Lines 10, 11, and 12 bind the context and the global receiver. Line 17 binds InterpreterEntryTrampoline , which is the entry point for executing bytecode. Lines 18 to 45 define the functions for optimization and de-optimization, which are used in TurboFan. Let’s talk about the process of new JSFunction.

(1) Create SharedFunction and install bytecode

1.  void InstallBytecodeArray(Handle<BytecodeArray> bytecode_array,
2.                            Handle<SharedFunctionInfo> shared_info,
3.                            ParseInfo* parse_info, Isolate* isolate) {
4.    if (!FLAG_interpreted_frames_native_stack) {
5.      shared_info->set_bytecode_array(*bytecode_array);
6.      return;
7.    }
8.    Handle<Code> code = isolate->factory()->CopyCode(Handle<Code>::cast(
9.        isolate->factory()->interpreter_entry_trampoline_for_profiling()));
10.    Handle<InterpreterData> interpreter_data =
11.        Handle<InterpreterData>::cast(isolate->factory()->NewStruct(
12.            INTERPRETER_DATA_TYPE, AllocationType::kOld));
13.    interpreter_data->set_bytecode_array(*bytecode_array);
14.    interpreter_data->set_interpreter_trampoline(*code);
15.    shared_info->set_interpreter_data(*interpreter_data);
16.    Handle<Script> script = parse_info->script();
17.    Handle<AbstractCode> abstract_code = Handle<AbstractCode>::cast(code);
18.    int line_num =
19.        Script::GetLineNumber(script, shared_info->StartPosition()) + 1;
20.    int column_num =
21.        Script::GetColumnNumber(script, shared_info->StartPosition()) + 1;
22.    String script_name = script->name().IsString()
23.                             ? String::cast(script->name())
24.                             : ReadOnlyRoots(isolate).empty_string();
25.    CodeEventListener::LogEventsAndTags log_tag = Logger::ToNativeByScript(
26.        CodeEventListener::INTERPRETED_FUNCTION_TAG, *script);
27.    PROFILE(isolate, CodeCreateEvent(log_tag, *abstract_code, *shared_info,
28.                                     script_name, line_num, column_num));
29.  }

When creating a new JSFunction instance, we need to create an SharedFunction instance first. An important step when creating the SharedFunction instance is to install the bytecode, see line 13 of the above code.

(2) New JSFunction

Through the below code, you will see that creating JS is the process of binding a SharedFunction and a context actually.

1.  Local<Script> UnboundScript::BindToCurrentContext() {
2.    auto function_info =
3.        i::Handle<i::SharedFunctionInfo>::cast(Utils::OpenHandle(this));
4.    i::Isolate* isolate = function_info->GetIsolate();
5.    i::Handle<i::JSFunction> function =
6.        isolate->factory()->NewFunctionFromSharedFunctionInfo(
7.            function_info, isolate->native_context());
8.    return ToApiHandle<Script>(function);
9.  }
10.  //..................分隔线........................................
11.  Handle<JSFunction> Factory::NewFunctionFromSharedFunctionInfo(
12.      Handle<Map> initial_map, Handle<SharedFunctionInfo> info,
13.      Handle<Context> context, AllocationType allocation) {
14.    DCHECK_EQ(JS_FUNCTION_TYPE, initial_map->instance_type());
15.    Handle<JSFunction> result =
16.        NewFunction(initial_map, info, context, allocation);
17.    // Give compiler a chance to pre-initialize.
18.    Compiler::PostInstantiation(result);
19.    return result;
20.  }

Line 2 of the above code casts this to the SharedFunctionInfo (this is the SharedFunctionInfo originally). Line 5, call NewFunctionFromSharedFunctionInfo to create JSFunction. Note: its parameters are S and C, see line 11. Finally, call NewFunction which is below.

1.  Handle<JSFunction> Factory::NewFunction(Handle<Map> map,
2.                                          Handle<SharedFunctionInfo> info,
3.                                          Handle<Context> context,
4.                                          AllocationType allocation) {
5.    Handle<JSFunction> function(JSFunction::cast(New(map, allocation)),
6.                                isolate());
7.    function->initialize_properties(isolate());
8.    function->initialize_elements();
9.    function->set_shared(*info);
10.    function->set_code(info->GetCode());
11.    function->set_context(*context);
12.    function->set_raw_feedback_cell(*many_closures_cell());
13.    int header_size;
14.    if (map->has_prototype_slot()) {
15.      header_size = JSFunction::kSizeWithPrototype;
16.      function->set_prototype_or_initial_map(*the_hole_value());
17.    } else {
18.      header_size = JSFunction::kSizeWithoutPrototype;
19.    }
20.    InitializeJSObjectBody(function, map, header_size);
21.    return function;
22.  }

The 9th and 11th lines of code above set the SharedFunctionInfo and the context to the corresponding positions, which is the bind mentioned above.

What is the GetCode on line 10? See below.

1.  Code SharedFunctionInfo::GetCode() const {
2.    Isolate* isolate = GetIsolate();
3.    Object data = function_data();
4.    if (data.IsSmi()) {
5.      DCHECK(HasBuiltinId());
6.      return isolate->builtins()->builtin(builtin_id());
7.    } else if (data.IsBytecodeArray()) {
8.      DCHECK(HasBytecodeArray());
9.      return isolate->builtins()->builtin(Builtins::kInterpreterEntryTrampoline);
10.    } else if (data.IsAsmWasmData()) {
11.      DCHECK(HasAsmWasmData());
12.      return isolate->builtins()->builtin(Builtins::kInstantiateAsmJs);
13.    } else if (data.IsUncompiledData()) {
14.      DCHECK(HasUncompiledData());
15.      return isolate->builtins()->builtin(Builtins::kCompileLazy);
16.    } else if (data.IsFunctionTemplateInfo()) {
17.      DCHECK(IsApiFunction());
18.      return isolate->builtins()->builtin(Builtins::kHandleApiCall);
19.    } else if (data.IsWasmExportedFunctionData()) {
20.      DCHECK(HasWasmExportedFunctionData());
21.      return wasm_exported_function_data().wrapper_code();
22.    } else if (data.IsInterpreterData()) {
23.      Code code = InterpreterTrampoline();
24.      DCHECK(code.IsCode());
25.      DCHECK(code.is_interpreter_trampoline_builtin());
26.      return code;
27.    } else if (data.IsWasmJSFunctionData()) {
28.      return wasm_js_function_data().wrapper_code();
29.    } else if (data.IsWasmCapiFunctionData()) {
30.      return wasm_capi_function_data().wrapper_code();
31.    }
32.    UNREACHABLE();
33.  }

Our test case (see Chapter 4) is the bytecode array, so the return value of GetCode is kInterpreterEntryTrampoline. The role of GetCode is to return an entry method according to the type of SharedFunctionInfo, which is used to jump to the corresponding bytecode and execute it (see Chapter 8).

To sum up, when creating JS, the bytecode type, context, and entry method are what we care about, and the others are not important. Figure 1 shows the call stack.

2. JSFunction’s memory layout

The JSFunction is V8’s heap-managed object and uses memory offsets to represent internal members. Code is below:

#define TORQUE_GENERATED_JSFUNCTION_FIELDS(V) \
V(kStartOfStrongFieldsOffset, 0) \
V(kSharedFunctionInfoOffset, kTaggedSize) \
V(kContextOffset, kTaggedSize) \
V(kFeedbackCellOffset, kTaggedSize) \
V(kEndOfStrongFieldsOffset, 0) \
V(kStartOfWeakFieldsOffset, 0) \
V(kCodeOffset, kTaggedSize) \
V(kPrototypeOrInitialMapOffset, kTaggedSize) \
V(kEndOfWeakFieldsOffset, 0) \
V(kSize, 0) \

#define DEFINE_ONE_FIELD_OFFSET(Name, Size) Name, Name##End = Name + (Size)-1,

#define DEFINE_FIELD_OFFSET_CONSTANTS(StartOffset, LIST_MACRO) \
  enum {                                                       \
    LIST_MACRO##_StartOffset = StartOffset - 1,                \
    LIST_MACRO(DEFINE_ONE_FIELD_OFFSET)                        \
  };

The TORQUE_GENERATED_JSFUNCTION_FIELDS defines the offset of all members, and StartOffset is the base address. V8 reads and writes members by StartOffset+offset. Take set_code as an example to explain, the code is below.

void JSFunction::set_code(Code value) {
  DCHECK(!ObjectInYoungGeneration(value));
  RELAXED_WRITE_FIELD(*this, kCodeOffset, value);
#ifndef V8_DISABLE_WRITE_BARRIERS
  MarkingBarrier(*this, RawField(kCodeOffset), value);
#endif
}

Macro template RELAXED_WRITE_FIELD is below.

#define RELAXED_WRITE_FIELD(p, offset, value) \
  TaggedField<Object>::Relaxed_Store(p, offset, value)
//...........................................
template <typename T, int kFieldOffset>
void TaggedField<T, kFieldOffset>::Relaxed_Store(HeapObject host, int offset,
                                                 T value) {
  AsAtomicTagged::Relaxed_Store(location(host, offset),
                                full_to_tagged(value.ptr()));
}
//........................................
  template <typename T>
  static void Relaxed_Store(T* addr,
                            typename std::remove_reference<T>::type new_value) {
    STATIC_ASSERT(sizeof(T) <= sizeof(AtomicStorageType));
    base::Relaxed_Store(to_storage_addr(addr),
                        cast_helper<T>::to_storage_type(new_value));
  }

The above two Relaxed_Store implement the write operation of set_code. Figure 2 shows the call stack.

The read operation is the same as the write mentioned above. The bytes are read from the offset and converted to the expected type. The code is below, please analyze it by yourself.

#define RELAXED_READ_FIELD(p, offset) \
  TaggedField<Object>::Relaxed_Load(p, offset)
//............................................
  template <typename T>
  static T Relaxed_Load(T* addr) {
    STATIC_ASSERT(sizeof(T) <= sizeof(AtomicStorageType));
    return cast_helper<T>::to_return_type(
        base::Relaxed_Load(to_storage_addr(addr)));
  }

By the way, Relaxed_Load is a base method, which is used frequently when V8 manages heap objects.

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8 — Chapter 11: Bytecode Dispatch

灰豆 — Tue, 23 Aug 2022 11:26:09 +0000

Original source: https://medium.com/@huidou/lets-understand-chrome-v8-chapter-11-bytecode-dispatch-ab6415e32bbd
Welcome to other chapters of Let’s Understand Chrome V8

Dispatch is responsible for scheduling bytecode, which is equivalent to register EIP++ and jumps to the next bytecode. Dispatch consists of two parts, one is a dispatch table and the other is the physical register. The table is an array that contains all bytecode addresses. V8 uses the physical register to dispatch bytecode for getting greater efficiency.

1. Dispatch Table

The dispatch table is an array of pointers, which is used to store the address of the bytecode processing program. The array type is Code, and the Code Class is below:

1.  class Code : public HeapObject {
2.   public:
3.    NEVER_READ_ONLY_SPACE
4.    using Flags = uint32_t;
5.  #define CODE_KIND_LIST(V)   \
6.    V(OPTIMIZED_FUNCTION)     \
7.    V(BYTECODE_HANDLER)       \
8.    V(STUB)                   \
9.    V(BUILTIN)                \
10.   V(REGEXP)                 \
11.    V(WASM_FUNCTION)          \
12.    V(WASM_TO_CAPI_FUNCTION)  \
13.    V(WASM_TO_JS_FUNCTION)    \
14.    V(JS_TO_WASM_FUNCTION)    \
15.    V(JS_TO_JS_FUNCTION)      \
16.    V(WASM_INTERPRETER_ENTRY) \
17.    V(C_WASM_ENTRY)
18.    enum Kind {
19.  #define DEFINE_CODE_KIND_ENUM(name) name,
20.      CODE_KIND_LIST(DEFINE_CODE_KIND_ENUM)
21.  #undef DEFINE_CODE_KIND_ENUM
22.          NUMBER_OF_KINDS
23.    };
24.    static const char* Kind2String(Kind kind);
25.  #ifdef ENABLE_DISASSEMBLER
26.    const char* GetName(Isolate* isolate) const;
27.    V8_EXPORT_PRIVATE void Disassemble(const char* name, std::ostream& os,
28.                                       Address current_pc = kNullAddress);
29.  #endif
30.  //................omit................
31.  };

Note: In the isolate, there is another pointer array that is the same type as the dispatch table. It holds all the Builtins addresses, which can confuse beginners easily.

The dispatch table is maintained by BuildWithMacroAssembler, code is below:

1.  Code BuildWithMacroAssembler(Isolate* isolate, int32_t builtin_index,
2.                               MacroAssemblerGenerator generator,
3.                               const char* s_name) {
4.    HandleScope scope(isolate);
5.    // Canonicalize handles, so that we can share constant pool entries pointing
6.    // to code targets without dereferencing their handles.
7.    CanonicalHandleScope canonical(isolate);
8.    constexpr int kBufferSize = 32 * KB;
9.    byte buffer[kBufferSize];
10.   MacroAssembler masm(isolate, BuiltinAssemblerOptions(isolate, builtin_index),
11.                        CodeObjectRequired::kYes,
12.                        ExternalAssemblerBuffer(buffer, kBufferSize));
13.    masm.set_builtin_index(builtin_index);
14.    DCHECK(!masm.has_frame());
15.    generator(&masm);
16.    int handler_table_offset = 0;
17.    // JSEntry builtins are a special case and need to generate a handler table.
18.    DCHECK_EQ(Builtins::KindOf(Builtins::kJSEntry), Builtins::ASM);
19.    DCHECK_EQ(Builtins::KindOf(Builtins::kJSConstructEntry), Builtins::ASM);
20.    DCHECK_EQ(Builtins::KindOf(Builtins::kJSRunMicrotasksEntry), Builtins::ASM);
21.    if (Builtins::IsJSEntryVariant(builtin_index)) {
22.      handler_table_offset = HandlerTable::EmitReturnTableStart(&masm);
23.      HandlerTable::EmitReturnEntry(
24.          &masm, 0, isolate->builtins()->js_entry_handler_offset());
25.    }
26.    //.....................................................
27.    //................omit.............................
28.  }

You can see Chapter 9 regarding how to debug the BuildWithMacroAssembler. When the value of the parameter builtin_index is 65, the function pointer generator points to Generate_InterpreterEnterBytecodeDispatch which is responsible for maintaining the Dispatch table, code is below:

1.  static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
2.    // Set the return address to the correct point in the interpreter entry
3.    // trampoline.
4.    Label builtin_trampoline, trampoline_loaded;
5.    Smi interpreter_entry_return_pc_offset(
6.        masm->isolate()->heap()->interpreter_entry_return_pc_offset());
7.    DCHECK_NE(interpreter_entry_return_pc_offset, Smi::kZero);
8.    // If the SFI function_data is an InterpreterData, the function will have a
9.    // custom copy of the interpreter entry trampoline for profiling. If so,
10.   // get the custom trampoline, otherwise grab the entry address of the global
11.    // trampoline.
12.    __ movq(rbx, Operand(rbp, StandardFrameConstants::kFunctionOffset));
13.    __ LoadTaggedPointerField(
14.        rbx, FieldOperand(rbx, JSFunction::kSharedFunctionInfoOffset));
15.    __ LoadTaggedPointerField(
16.        rbx, FieldOperand(rbx, SharedFunctionInfo::kFunctionDataOffset));
17.    __ CmpObjectType(rbx, INTERPRETER_DATA_TYPE, kScratchRegister);
18.    __ j(not_equal, &builtin_trampoline, Label::kNear);
19.    __ movq(rbx,
20.            FieldOperand(rbx, InterpreterData::kInterpreterTrampolineOffset));
21.    __ addq(rbx, Immediate(Code::kHeaderSize - kHeapObjectTag));
22.    __ jmp(&trampoline_loaded, Label::kNear);
23.    __ bind(&builtin_trampoline);
24.    // TODO(jgruber): Replace this by a lookup in the builtin entry table.
25.    __ movq(rbx,
26.            __ ExternalReferenceAsOperand(
27.                ExternalReference::
28.                    address_of_interpreter_entry_trampoline_instruction_start(
29.                        masm->isolate()),
30.                kScratchRegister));
31.    __ bind(&trampoline_loaded);
32.    __ addq(rbx, Immediate(interpreter_entry_return_pc_offset.value()));
33.    __ Push(rbx);
34.    // Initialize dispatch table register.
35.    __ Move(
36.        kInterpreterDispatchTableRegister,
37.        ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
38.    // Get the bytecode array pointer from the frame.
39.    __ movq(kInterpreterBytecodeArrayRegister,
40.            Operand(rbp, InterpreterFrameConstants::kBytecodeArrayFromFp));
41.    if (FLAG_debug_code) {
42.      // Check function data field is actually a BytecodeArray object.
43.      __ AssertNotSmi(kInterpreterBytecodeArrayRegister);
44.      __ CmpObjectType(kInterpreterBytecodeArrayRegister, BYTECODE_ARRAY_TYPE,
45.                       rbx);
46.      __ Assert(
47.          equal,
48.          AbortReason::kFunctionDataShouldBeBytecodeArrayOnInterpreterEntry);
49.    }
50.    // Get the target bytecode offset from the frame.
51.    __ movq(kInterpreterBytecodeOffsetRegister,
52.            Operand(rbp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
53.    __ SmiUntag(kInterpreterBytecodeOffsetRegister,
54.                kInterpreterBytecodeOffsetRegister);
55.    // Dispatch to the target bytecode.
56.    __ movzxbq(r11, Operand(kInterpreterBytecodeArrayRegister,
57.                            kInterpreterBytecodeOffsetRegister, times_1, 0));
58.    __ movq(kJavaScriptCallCodeStartRegister,
59.            Operand(kInterpreterDispatchTableRegister, r11,
60.                    times_system_pointer_size, 0));
61.    __ jmp(kJavaScriptCallCodeStartRegister);
62.  }
63.  //================================separation=========================
64.  void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
65.    Generate_InterpreterEnterBytecode(masm);
66.  }

In the above code, the Generate_InterpreterEnterBytecodeDispatch is the entry point of bytecode dispatch, and the Generate_InterpreterEnterBytecode is the key code that implements the bytecode dispatch. Here are two important concepts:

The Generate_InterpreterEnterBytecodeDispatch is a Builtin and its index is 65. (The index may be dissimilar in different V8 versions)
V8 uses a physical register to manage the dispatch table, the name of the register is kInterpreterDispatchTableRegister. Using the physical register can avoid the push and pop of the dispatch table frequently, to improve efficiency.

Here are the key lines of code：

(1) Line 35, loads the dispatch table to the A register. Line 37 of code, take out the table address from the isolate. The implementation of A is in the below three functions.

ExternalReference ExternalReference::interpreter_dispatch_table_address(
     Isolate* isolate) {
   return ExternalReference(isolate->interpreter()->dispatch_table_address());
 }
interpreter::Interpreter* interpreter() const {
     return interpreter_;
   }
Address dispatch_table_address() {
      return reinterpret_cast<Address>(&dispatch_table_[0]);
    }

(2) Line 39 takes out the bytecode array from the stack.

(3) Line 51 takes out the offset of the target bytecode from the bytecode array.

(4) Lines 56 and 58 calculate the target bytecode address and store the address in kJavaScriptCallCodeStartRegister.

(5) Line 61 jumps to register kJavaScriptCallCodeStartRegister and executes bytecode. Figure 1 is the call stack.

2. TailCall

The Dispatch() is the last step in a bytecode, so its alias is the tail call. Let’s look at a few bytecodes：

1.  IGNITION_HANDLER(StaGlobal, InterpreterAssembler) {
2.    TNode<Context> context = GetContext();
3.  //omit..............
4.     Goto(&end);
5.     Bind(&no_feedback);
6.     CallRuntime(Runtime::kStoreGlobalICNoFeedback_Miss, context, value, name);
7.     Goto(&end);
8.     Bind(&end);
9.     Dispatch();// !!! this is the tail call.
10.   }
11.   IGNITION_HANDLER(LdaContextSlot, InterpreterAssembler) {
12.     TNode<Context> context = CAST(LoadRegisterAtOperandIndex(0));
13.     TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
14.     TNode<Uint32T> depth = BytecodeOperandUImm(2);
15.     TNode<Context> slot_context = GetContextAtDepth(context, depth);
16.     TNode<Object> result = LoadContextElement(slot_context, slot_index);
17.     SetAccumulator(result);
18.     Dispatch(); //!!! here also is.
19.   }
20.   IGNITION_HANDLER(LdaImmutableContextSlot, InterpreterAssembler) {
21.     TNode<Context> context = CAST(LoadRegisterAtOperandIndex(0));
22.     TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
23.     TNode<Uint32T> depth = BytecodeOperandUImm(2);
24.     TNode<Context> slot_context = GetContextAtDepth(context, depth);
25.     TNode<Object> result = LoadContextElement(slot_context, slot_index);
26.     SetAccumulator(result);
27.     Dispatch(); //!!! here 
28.   }

The above three bytecodes all end with Dispatch(). Below is the code of Dispatch:

1.  void InterpreterAssembler::Dispatch() {
2.    Comment("========= Dispatch");
3.    DCHECK_IMPLIES(Bytecodes::MakesCallAlongCriticalPath(bytecode_), made_call_);
4.    TNode<IntPtrT> target_offset = Advance();
5.    TNode<WordT> target_bytecode = LoadBytecode(target_offset);
6.    if (Bytecodes::IsStarLookahead(bytecode_, operand_scale_)) {
7.      target_bytecode = StarDispatchLookahead(target_bytecode);
8.    }
9.    DispatchToBytecode(target_bytecode, BytecodeOffset());
10. }

The 2nd line is the comment function. When debugging, we can use its output information to locate the execution position. The 4th line takes out the offset of the target(next) bytecode. The 5th line loads the target bytecode. The 9th line calls DspatchToBytecode() which calls DispatchToBytecodeHandlerEntry() eventually.

void InterpreterAssembler::DispatchToBytecodeHandlerEntry(
    TNode<RawPtrT> handler_entry, TNode<IntPtrT> bytecode_offset) {
  // Propagate speculation poisoning.
  TNode<RawPtrT> poisoned_handler_entry =
      UncheckedCast<RawPtrT>(WordPoisonOnSpeculation(handler_entry));
  TailCallBytecodeDispatch(InterpreterDispatchDescriptor{},
                           poisoned_handler_entry, GetAccumulatorUnchecked(),
                           bytecode_offset, BytecodeArrayTaggedPointer(),
                           DispatchTablePointer());
}

In DispatchToBytecodeHandlerEntry, parameter 1 is the target bytecode and 2 is the offset of the bytecode. Parameter 1 is used to load the bytecode handler and 2 is used to load operands. Then call TailCallBytecodeDispatch, which is below:

0.  template <class... TArgs>
1.  void CodeAssembler::TailCallBytecodeDispatch(
2.      const CallInterfaceDescriptor& descriptor, TNode<RawPtrT> target,
3.      TArgs... args) {
4.    DCHECK_EQ(descriptor.GetParameterCount(), sizeof...(args));
5.    auto call_descriptor = Linkage::GetBytecodeDispatchCallDescriptor(
6.        zone(), descriptor, descriptor.GetStackParameterCount());
7.    Node* nodes[] = {target, args...};
8.    CHECK_EQ(descriptor.GetParameterCount() + 1, arraysize(nodes));
9.    raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes);
10.  }

In the above code, the 5th line creates the descriptor, as below:

0.  CallDescriptor* Linkage::GetBytecodeDispatchCallDescriptor(
1.      Zone* zone, const CallInterfaceDescriptor& descriptor,
2.      int stack_parameter_count) {
3.    const int register_parameter_count = descriptor.GetRegisterParameterCount();
4.    const int parameter_count = register_parameter_count + stack_parameter_count;
5.    DCHECK_EQ(descriptor.GetReturnCount(), 1);
6.    LocationSignature::Builder locations(zone, 1, parameter_count);
7.    locations.AddReturn(regloc(kReturnRegister0, descriptor.GetReturnType(0)));
8.    for (int i = 0; i < parameter_count; i++) {
9.      if (i < register_parameter_count) {
10.        // The first parameters go in registers.
11.        Register reg = descriptor.GetRegisterParameter(i);
12.        MachineType type = descriptor.GetParameterType(i);
13.        locations.AddParam(regloc(reg, type));
14.      } else {
15.        int stack_slot = i - register_parameter_count - stack_parameter_count;
16.        locations.AddParam(LinkageLocation::ForCallerFrameSlot(
17.            stack_slot, MachineType::AnyTagged()));
18.      }
19.    }
20.    MachineType target_type = MachineType::Pointer();
21.    LinkageLocation target_loc = LinkageLocation::ForAnyRegister(target_type);
22.    const CallDescriptor::Flags kFlags =
23.        CallDescriptor::kCanUseRoots | CallDescriptor::kFixedTargetRegister;
24.    return new (zone) CallDescriptor(  // --
25.        CallDescriptor::kCallAddress,  // kind
26.        target_type,                   // target MachineType
27.        target_loc,                    // target location
28.        locations.Build(),             // location_sig
29.        stack_parameter_count,         // stack_parameter_count
30.        Operator::kNoProperties,       // properties
31.        kNoCalleeSaved,                // callee-saved registers
32.        kNoCalleeSaved,                // callee-saved fp
33.        kFlags,                        // flags
34.        descriptor.DebugName());
35.  }

In GetBytecodeDispatchCallDescriptor, parameter 2 is the target bytecode, and parameter 3 is the stack parameter count. This function is used to apply for register resources and create a CallDescriptor. The CallDescriptor gives what parameters to supply when executing a bytecode. The comments on lines 24 to 25 give its layout.

In TailCallBytecodeDispatch, the TailCallN() on the 9th line is below, we see that it’s parameter 1 is CallDescriptor.

1.  void RawMachineAssembler::TailCallN(CallDescriptor* call_descriptor,
2.                                      int input_count, Node* const* inputs) {
3.    // +1 is for target.
4.    DCHECK_EQ(input_count, call_descriptor->ParameterCount() + 1);
5.    Node* tail_call =
6.        MakeNode(common()->TailCall(call_descriptor), input_count, inputs);
7.    schedule()->AddTailCall(CurrentBlock(), tail_call);
8.    current_block_ = nullptr;
9.  }

The 5th line generates a node. In the 7th line AddTailCall() adds the node to the end of the current basic block. So far, the dispatch is completed and the next bytecode is started to execute. Figure 2 shows the function call stack.

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com

Let’s Understand Chrome V8 — Chapter 10: Ignition Execution Unit

灰豆 — Mon, 22 Aug 2022 13:49:48 +0000

Original source: https://medium.com/@huidou/lets-understand-chrome-v8-chapter-10-ignition-execution-unit-66073e14f6aa
Welcome to other chapters of Let’s Understand Chrome V8

Execution is responsible for executing the bytecode. In this paper, we’ll talk about the workflow from S to E and several kernel functions.

Our test case:

function JsPrint(a){
    if(a >5){
        return "Debug";
    }
}
console.log(JsPrint(6));

Workflow

The GetSharedFunctionInfoForScript() compiles JS source code into bytecodes.

0.  MaybeHandle<SharedFunctionInfo> Compiler::GetSharedFunctionInfoForScript(
1.      Isolate* isolate, Handle<String> source,
2.      const Compiler::ScriptDetails& script_details,
3.      ScriptOriginOptions origin_options, v8::Extension* extension,
4.      ScriptData* cached_data, ScriptCompiler::CompileOptions compile_options,
5.      ScriptCompiler::NoCacheReason no_cache_reason, NativesFlag natives) {
6.  //.omit.............
7.    // Do a lookup in the compilation cache but not for extensions.
8.    MaybeHandle<SharedFunctionInfo> maybe_result;
9.    IsCompiledScope is_compiled_scope;
10.    if (extension == nullptr) {
11.      bool can_consume_code_cache =
12.          compile_options == ScriptCompiler::kConsumeCodeCache;
13.      if (can_consume_code_cache) {
14.        compile_timer.set_consuming_code_cache();
15.      }
16.      // First check per-isolate compilation cache.
17.      maybe_result = compilation_cache->LookupScript(
18.          source, script_details.name_obj, script_details.line_offset,
19.          script_details.column_offset, origin_options, isolate->native_context(),
20.          language_mode);
21.      if (!maybe_result.is_null()) {
22.        compile_timer.set_hit_isolate_cache();
23.      } 
24.    }
25.  //.....omit..............
26.    if (maybe_result.is_null()) {
27.      ParseInfo parse_info(isolate);
28.      // No cache entry found compile the script.
29.      NewScript(isolate, &parse_info, source, script_details, origin_options,
30.                natives);
31.      // Compile the function and add it to the isolate cache.
32.      if (origin_options.IsModule()) parse_info.set_module();
33.      parse_info.set_extension(extension);
34.      parse_info.set_eager(compile_options == ScriptCompiler::kEagerCompile);
35.      parse_info.set_language_mode(
36.          stricter_language_mode(parse_info.language_mode(), language_mode));
37.      maybe_result = CompileToplevel(&parse_info, isolate, &is_compiled_scope);
38.      Handle<SharedFunctionInfo> result;
39.      if (extension == nullptr && maybe_result.ToHandle(&result)) {
40.        DCHECK(is_compiled_scope.is_compiled());
41.        compilation_cache->PutScript(source, isolate->native_context(),
42.                                     language_mode, result);
43.      } else if (maybe_result.is_null() && natives != EXTENSION_CODE) {
44.        isolate->ReportPendingMessages();
45.      }
46.    }
47.    return maybe_result;
48.  }

In the 17th line of code, lookup compilation_cache, cache hit indicates that there are already bytecodes, and don’t need to recompile. The 26th line of code indicates that cache miss, so call the CompileToplevel on the 37th line to generate bytecodes.

Bytecode needs to be bound to a context before execution, as below:

0.  Local<Script> UnboundScript::BindToCurrentContext() {
1.    auto function_info =
2.        i::Handle<i::SharedFunctionInfo>::cast(Utils::OpenHandle(this));
3.    i::Isolate* isolate = function_info->GetIsolate();
4.    i::Handle<i::JSFunction> function =
5.        isolate->factory()->NewFunctionFromSharedFunctionInfo(
6.            function_info, isolate->native_context());
7.    return ToApiHandle<Script>(function);
8.  }

After binding, we get an important member — JSFunction, which is the input expected by the execution.

0.  bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
1.                            Local<Value> name, PrintResult print_result,
2.                            ReportExceptions report_exceptions,
3.                            ProcessMessageQueue process_message_queue) {
4.    bool success = true;
5.    {
6.      PerIsolateData* data = PerIsolateData::Get(isolate);
7.      Local<Context> realm =
8.          Local<Context>::New(isolate, data->realms_[data->realm_current_]);
9.      Context::Scope context_scope(realm);
10.      MaybeLocal<Script> maybe_script;
11.      Local<Context> context(isolate->GetCurrentContext());
12.      ScriptOrigin origin(name);
13.      if (options.compile_options == ScriptCompiler::kConsumeCodeCache) {
14.  //.......omit
15.      } else if (options.stress_background_compile) {
16.  //.......omit
17.      } else {
18.        ScriptCompiler::Source script_source(source, origin);
19.        maybe_script = ScriptCompiler::Compile(context, &script_source,
20.                                               options.compile_options);
21.      }
22.      maybe_result = script->Run(realm);
23.  //......omit
24.      if (options.code_cache_options ==
25.          ShellOptions::CodeCacheOptions::kProduceCacheAfterExecute) {
26.        // Serialize and store it in memory for the next execution.
27.        ScriptCompiler::CachedData* cached_data =
28.            ScriptCompiler::CreateCodeCache(script->GetUnboundScript());
29.        StoreInCodeCache(isolate, source, cached_data);
30.        delete cached_data;
31.      }
32.      if (process_message_queue && !EmptyMessageQueues(isolate)) success = false;
33.      data->realm_current_ = data->realm_switch_;
34.    }
35.    DCHECK(!try_catch.HasCaught());
36.    return success;
37.  }

The above function is the entrance for executing JS. Line 19 compiles the JS to bytecode. Line 22 executes the bytecode. Debug line 22 to step into the Run(realm).

0.  MaybeLocal<Value> Script::Run(Local<Context> context) {
1.    auto isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
2.    TRACE_EVENT_CALL_STATS_SCOPED(isolate, "v8", "V8.Execute");
3.    ENTER_V8(isolate, context, Script, Run, MaybeLocal<Value>(),
4.             InternalEscapableScope);
5.    i::HistogramTimerScope execute_timer(isolate->counters()->execute(), true);
6.    i::AggregatingHistogramTimerScope timer(isolate->counters()->compile_lazy());
7.    i::TimerEventScope<i::TimerEventExecute> timer_scope(isolate);
8.    auto fun = i::Handle<i::JSFunction>::cast(Utils::OpenHandle(this));
9.    i::Handle<i::Object> receiver = isolate->global_proxy();
10.    Local<Value> result;
11.    has_pending_exception = !ToLocal<Value>(
12.        i::Execution::Call(isolate, fun, receiver, 0, nullptr), &result);
13.    RETURN_ON_FAILED_EXECUTION(Value);
14.    RETURN_ESCAPED(result);
15.  }

The 8th line casts this pointer to JSFunction. For our case, the variable fun is console.log(JsPrint(6)), then call the 12th line — call().

In call(), the Invoke() will be called which is below.

0.  V8_WARN_UNUSED_RESULT MaybeHandle<Object> Invoke(Isolate* isolate,
1.                                                   const InvokeParams& params) {
2.  //...............omit
3.    Object value;
4.    Handle<Code> code =
5.        JSEntry(isolate, params.execution_target, params.is_construct);
6.    {
7.      SaveContext save(isolate);
8.      SealHandleScope shs(isolate);
9.      if (FLAG_clear_exceptions_on_js_entry) isolate->clear_pending_exception();
10.      if (params.execution_target == Execution::Target::kCallable) {
11.        // clang-format off
12.        // {new_target}, {target}, {receiver}, return value: tagged pointers
13.        // {argv}: pointer to array of tagged pointers
14.        using JSEntryFunction = GeneratedCode<Address(
15.            Address root_register_value, Address new_target, Address target,
16.            Address receiver, intptr_t argc, Address** argv)>;
17.        // clang-format on
18.        JSEntryFunction stub_entry =
19.            JSEntryFunction::FromAddress(isolate, code->InstructionStart());
20.        Address orig_func = params.new_target->ptr();
21.        Address func = params.target->ptr();
22.        Address recv = params.receiver->ptr();
23.        Address** argv = reinterpret_cast<Address**>(params.argv);
24.        RuntimeCallTimerScope timer(isolate, RuntimeCallCounterId::kJS_Execution);
25.        value = Object(stub_entry.Call(isolate->isolate_data()->isolate_root(),
26.                                       orig_func, func, recv, params.argc, argv));
27.      } else {
28.  //..................omit     
29.      }
30.    }

Line 18 gets the address of the builtin, its index is 40, and its name is JSEntry. This builtin builds the execution environment for bytecodes. Then step into line 25, where the bytecode is executed. After that, we can only debug the assembly code, but c++. Figure 1 is the call stack.

Before stepping into bytecodes, Generate_JSEntryVariant will be called.

0.  void Generate_JSEntryVariant(MacroAssembler* masm, StackFrame::Type type,
1.                               Builtins::Name entry_trampoline) {
2.    Label invoke, handler_entry, exit;
3.    Label not_outermost_js, not_outermost_js_2;
4.    {  // NOLINT. Scope block confuses linter.
5.      NoRootArrayScope uninitialized_root_register(masm);
6.      // Set up frame.
7.      __ pushq(rbp);
8.      __ movq(rbp, rsp);
9.      // Push the stack frame type.
10.      __ Push(Immediate(StackFrame::TypeToMarker(type)));
11.      // Reserve a slot for the context. It is filled after the root register has
12.      // been set up.
13.      __ AllocateStackSpace(kSystemPointerSize);
14.      // Save callee-saved registers (X64/X32/Win64 calling conventions).
15.      __ pushq(r12);
16.      __ pushq(r13);
17.      __ pushq(r14);
18.      __ pushq(r15);
19.  #ifdef _WIN64
20.      __ pushq(rdi);  // Only callee save in Win64 ABI, argument in AMD64 ABI.
21.      __ pushq(rsi);  // Only callee save in Win64 ABI, argument in AMD64 ABI.
22.  #endif
23.      __ pushq(rbx);
24.  //.....................omit............................
25.    __ ret(0);
26.  }
27.  }  // namespace
28.  //==================separation===============================
29.  void Builtins::Generate_JSEntry(MacroAssembler* masm) {
30.    Generate_JSEntryVariant(masm, StackFrame::ENTRY,
31.                            Builtins::kJSEntryTrampoline);
32.  }

Look at the 30th line of code, the generator function of the 40th builtin is B, and its analysis method refers to my previous paper. Figure 2 shows the corresponding assembly code.

You can also see a bit of C++ in Figure 2, but this is the last chance to see C++. After that, only the assembly code.

Our case uses the console.log which is a global function. It is below.

1.  #define RUNTIME_FUNCTION_RETURNS_TYPE(Type, InternalType, Convert, Name)      \
2.    static V8_INLINE InternalType __RT_impl_##Name(Arguments args,              \
3.                                                   Isolate* isolate);           \
4.                                                                                \
5.    V8_NOINLINE static Type Stats_##Name(int args_length, Address* args_object, \
6.                                         Isolate* isolate) {                    \
7.      RuntimeCallTimerScope timer(isolate, RuntimeCallCounterId::k##Name);      \
8.      TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.runtime"),                     \
9.                   "V8.Runtime_" #Name);                                        \
10.     Arguments args(args_length, args_object);                                 \
11.      return Convert(__RT_impl_##Name(args, isolate));                          \
12.    }                                                                           \
13.                                                                                \
14.    Type Name(int args_length, Address* args_object, Isolate* isolate) {        \
15.      DCHECK(isolate->context().is_null() || isolate->context().IsContext());   \
16.      CLOBBER_DOUBLE_REGISTERS();                                               \
17.      if (V8_UNLIKELY(TracingFlags::is_runtime_stats_enabled())) {              \
18.        return Stats_##Name(args_length, args_object, isolate);                 \
19.      }                                                                         \
20.      Arguments args(args_length, args_object);                                 \
21.      return Convert(__RT_impl_##Name(args, isolate));                          \
22.    }                                                                           \
23.                                                                                \
24.    static InternalType __RT_impl_##Name(Arguments args, Isolate* isolate)
25.  #define CONVERT_OBJECT(x) (x).ptr()
26.  #define CONVERT_OBJECTPAIR(x) (x)
27.  #define RUNTIME_FUNCTION(Name) \
28.    RUNTIME_FUNCTION_RETURNS_TYPE(Address, Object, CONVERT_OBJECT, Name)
29.  //=================separation==============================
30.  //==================separation===============================
31.  Object DeclareGlobals(Isolate* isolate, Handle<FixedArray> declarations,
32.                        int flags, Handle<JSFunction> closure) {
33.    HandleScope scope(isolate);
34.    Handle<JSGlobalObject> global(isolate->global_object());
35.    Handle<Context> context(isolate->context(), isolate);
36.    Handle<FeedbackVector> feedback_vector = Handle<FeedbackVector>::null();
37.    Handle<ClosureFeedbackCellArray> closure_feedback_cell_array =
38.        Handle<ClosureFeedbackCellArray>::null();
39.    if (closure->has_feedback_vector()) {
40.      feedback_vector =
41.          Handle<FeedbackVector>(closure->feedback_vector(), isolate);
42.      closure_feedback_cell_array = Handle<ClosureFeedbackCellArray>(
43.          feedback_vector->closure_feedback_cell_array(), isolate);
44.    } else {
45.      closure_feedback_cell_array = Handle<ClosureFeedbackCellArray>(
46.          closure->closure_feedback_cell_array(), isolate);
47.    }
48.    // Traverse the name/value pairs and set the properties.
49.    int length = declarations->length();
50.    FOR_WITH_HANDLE_SCOPE(isolate, int, i = 0, i, i < length, i += 4, {
51.      Handle<String> name(String::cast(declarations->get(i)), isolate);
52.      FeedbackSlot slot(Smi::ToInt(declarations->get(i + 1)));
53.      Handle<Object> possibly_feedback_cell_slot(declarations->get(i + 2),
54.                                                 isolate);
55.      Handle<Object> initial_value(declarations->get(i + 3), isolate);
56.      bool is_var = initial_value->IsUndefined(isolate);
57.      bool is_function = initial_value->IsSharedFunctionInfo();
58.      DCHECK_NE(is_var, is_function);
59.      Handle<Object> value;
60.      if (is_function) {
61.        DCHECK(possibly_feedback_cell_slot->IsSmi());
62.        Handle<FeedbackCell> feedback_cell =
63.            closure_feedback_cell_array->GetFeedbackCell(
64.                Smi::ToInt(*possibly_feedback_cell_slot));
65.        // Copy the function and update its context. Use it as value.
66.        Handle<SharedFunctionInfo> shared =
67.            Handle<SharedFunctionInfo>::cast(initial_value);
68.        Handle<JSFunction> function =
69.            isolate->factory()->NewFunctionFromSharedFunctionInfo(
70.                shared, context, feedback_cell, AllocationType::kOld);
71.        value = function;
72.      } else {
73.        value = isolate->factory()->undefined_value();
74.      }
75.      // Compute the property attributes. According to ECMA-262,
76.      // the property must be non-configurable except in eval.
77.      bool is_eval = DeclareGlobalsEvalFlag::decode(flags);
78.      int attr = NONE;
79.      if (!is_eval) attr |= DONT_DELETE;
80.      // ES#sec-globaldeclarationinstantiation 5.d:
81.      // If hasRestrictedGlobal is true, throw a SyntaxError exception.
82.      Object result = DeclareGlobal(isolate, global, name, value,
83.                                    static_cast<PropertyAttributes>(attr), is_var,
84.                                    is_function, RedeclarationType::kSyntaxError,
85.                                    feedback_vector, slot);
86.      if (isolate->has_pending_exception()) return result;
87.    });
88.    return ReadOnlyRoots(isolate).undefined_value();
89.  }
90.  //==================separation===============================
91.  //==================separation===============================
92.  RUNTIME_FUNCTION(Runtime_DeclareGlobals) {
93.    HandleScope scope(isolate);
94.    DCHECK_EQ(3, args.length());
95.    CONVERT_ARG_HANDLE_CHECKED(FixedArray, declarations, 0);
96.    CONVERT_SMI_ARG_CHECKED(flags, 1);
97.    CONVERT_ARG_HANDLE_CHECKED(JSFunction, closure, 2);
98.    return DeclareGlobals(isolate, declarations, flags, closure);
99.  }

RUNTIME_FUNCTION(Runtime_DeclareGlobals) is a runtime function defined by a macro template. The function checks the parameters and then calls DeclareGlobals() to perform the corresponding operation.

In our case, DeclareGlobals() lookup the global object console, then takes out the log() from the console, and gets the address of console.log(). Finally, pass the parameter JsPrint(6) into log() which will start a new compilation and execution.

Okay, that wraps it up for this share. I’ll see you guys next time, take care!

Please reach out to me if you have any issues. WeChat: qq9123013 Email: v8blink@outlook.com