V8 Internals Documentation

This directory contains deep-dive documentation into V8 internals, generated from source code analysis. For general documentation, see v8.dev/docs.

Table of Contents

General

• High-Level Overview: High-level overview of V8’s architecture and execution pipeline.
• JavaScript Overview: High-level overview of JavaScript concepts for V8 developers.
• Security Bug Triaging: How V8 triages security bugs.

Heap and Memory

• Heap Overview: General overview of V8’s paged heap and object layout.
• Garbage Collection: Overview of V8’s generational GC.
• Marking and Sweeping: Deep dive into Major GC phases.
• Roots: How V8 manages root objects and static roots.
• Handles: V8’s mechanism for safe heap object references (Indirect vs Direct).
• Heap Compaction: How V8 resolves memory fragmentation in the Old Generation.
• Pointer Compression: Technique to reduce memory footprint on 64-bit architectures.
• Pointer Tagging: How V8 encodes type information in pointers (Smis vs HeapObjects).
• Zone Allocator: Region-based memory manager for fast allocation and batch deallocation.

Object Model

• Objects and Maps: How JavaScript objects and Maps (hidden classes) are represented in V8’s heap.
• Descriptor and Transition Arrays: How V8 tracks property additions and shares descriptor arrays between maps.
• Field Representations and Elements Kinds: How V8 specializes storage for properties and elements based on their types.
• Lookup Iterator: V8’s central mechanism for resolving property accesses.
• Strings: Overview of V8’s complex string representation and transitions.

Sandbox

• Architecture: V8’s in-process sandbox to protect memory outside of it.

Torque

• Architecture: V8’s domain-specific language for writing builtins.
• User Manual: The V8 Torque language manual.

Builtins

• Architecture: How V8 implements standard library and runtime helpers (Torque, CSA, C++, ASM).
• Torque Tutorial: Introduction to writing Torque builtins.

Code Generation

• Assembler and MacroAssembler: Low-level code generation abstractions.
• CodeStubAssembler: Portable macro-assembler for writing builtins and bytecode handlers.
• CodeStubAssembler Tutorial: Introduction to writing CodeStubAssembler builtins.

RegExp

• Architecture: Irregexp, V8’s regular expression engine.

WebAssembly

• Architecture: V8’s WebAssembly implementation, including Liftoff and Turboshaft tiers.

Snapshots

• Architecture: V8’s snapshot and serializer system for fast startup.

Execution - Runtime

• Ignition (Interpreter): V8’s register-based interpreter.
• Hidden Classes and Inline Caches: How V8 optimizes property access using Maps and ICs.
• Maps (Hidden Classes) Tutorial: Tutorial on how V8 builds hidden classes.
• Scopes and ScopeInfos: The relationship between compile-time Scopes and runtime ScopeInfos.
• Function Architecture: How V8 splits function data into context-independent (SFI) and context-dependent (JSFunction) parts, and how they are chained.
• Tiering and Interrupt Budget: How V8 decides to optimize functions.
• Exception Handling: How V8 implements exceptions using side-tables across all tiers.
• Deoptimization: How V8 transitions from optimized code back to the interpreter.
• Stack Walking: How V8 traverses and inspects call stack frames.

Compiler

Sparkplug

• Sparkplug (Baseline Compiler): Fast, non-optimizing compiler that mirrors the interpreter.

Maglev

• Maglev (Mid-Tier Compiler): Graph-based optimizing compiler.
• Maglev Register Allocator: Linear scan and node constraints.

TurboFan

• TurboFan (Optimizing Compiler): Top-tier optimizing compiler using Sea-of-Nodes and Turboshaft IRs.

Turboshaft

• Turboshaft and Turbolev: Next-generation IR and pipeline, including the Maglev frontend.
• Turboshaft IR Details: Operations and the side-effect system.
• Turboshaft Reducers: Composable optimization passes.
• Turboshaft Copying Approach: Semi-spaces for IR and cheap copies.

Common

• Why V8 Embraced CFG: The transition from TurboFan’s SoN to Turboshaft’s CFG and its benefits.
• Concurrency and Background Compilation: How V8 uses background threads safely.

Parsing

• Parser and AST: How V8 parses JavaScript into an Abstract Syntax Tree.
• Lazy Parsing and Preparser: How V8 delays parsing and handles closures.