Skip to content
Advertisement

Tag: v8

Are v8’s optimizations deterministic? Extracting the sequence of JS functions executed by any given webpage

I am trying to reconstruct the exact sequence of executed Javascript functions (call graph) from log data gathered using the Tracing Profiler, particularly from the category “v8.cpu_profiler”. Unfortunately, the number of nodes (function definitions) and edges (function calls) I obtain fluctuates across runs even if I interact with the test Web application in exactly the same way. Currently, I use

What is the meaning of the prefix ‘Speculative’ and ‘Checked’ of Turbofan operators?

In the Turbofan IR, there are several operators whose name begins with ‘Speculative’ or ‘Checked’ (e.g. SpeculativeSafeIntegerAdd, CheckedInt32Add, CheckedFloat64ToInt32, …). What is the meaning of those prefix? Answer “SpeculativeSafeIntegerAdd” means “type feedback suggests that this + adds small integers, but that assumption must be guarded with a type check”. It’s an intermediate-level node that will be lowered further eventually. “CheckedInt32Add”

In V8, what is lazy deoptimization, and how does it happen?

According to V8 source code and turbofan materials, there is a type of deoptimization called lazy deoptimization which is described as follows(v8/src/common/globals.h): Lazy: the code has been marked as dependent on some assumption which is checked elsewhere and can trigger deoptimization the next time the code is executed. However, when observing the execution of ‘v8/test/mjsunit/compiler/deopt-lazy-shape-mutation.js’ with d8, I found that

Canvas API implementation

I recently started to learn a bit about how javascript work under the hood, and came to know that (in the context of chrome) v8 engine and web APIs are different. Here’s some questions I have regarding the canvas API specifically: Why do we need to use getImageData() every time we want to access the pixels of a given canvas?

Concurrency optimization job in V8

When concurrency optimization is triggered, a new optimization job will be dispatched to a child-thread to complete. How does Runtime know that the optimization job has been completed? I’ve found that in runtime function StackGuard, the optimized code will be set in JSFunction, but I don’t know how this function is triggered. Answer When an optimization job is complete, it

Three different `this` behaviours for three different JS engines

I was learning about the this keyword and how it means different things with regards to regular functions vs ES6 arrow functions and function expressions and I came across something odd when trying to run the following code in Chrome, Deno and Node. So I prepared following: Example: Deno output: Node output: Chrome output: According to my understanding of this,

Do get accessors incur a per-instance allocation cost?

Say I have a class defined like this: And then I create several instances like so: Are these get accessors allocated for each instance? That is, would the memory usage of each of those objects increase if I were to add more get accessors, or are the get accessors allocated once and simply shared amongst all the instances? I tried

Hooking Function Constructor (JavaScript)

Does anyone know of a way to detect when a new function is created? I know you can hook the function class constructor but that will only detect new Function() calls, not function func(){} declarations. I assume the JS engine just creates a default function class when it sees a function declaration instead of looking at the global Function class.

Advertisement