Michael Lippautz
9f6bf59f26
Do not set Security_Impact-None when triaging V8 Sandbox bypass issues, leaving the impact set properly as for regular security bugs. TAG=agy CONV=ce6a2341-3ca1-49de-8dde-32daeb6e7c22 Change-Id: Id4eec99d773b824e515988d7b6ba9f13af218769 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8726388 Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Maksim Ivanov <emaxx@google.com> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Maksim Ivanov <emaxx@google.com> Cr-Commit-Position: refs/heads/main@{#111619}
V8 Internals Documentation
This directory contains deep-dive documentation into V8 internals, generated from source code analysis. For general documentation, see v8.dev/docs.
Table of Contents
General
- High-Level Overview: High-level overview of V8's architecture and execution pipeline.
- JavaScript Overview: High-level overview of JavaScript concepts for V8 developers.
- Security Bug Triaging: How V8 triages security bugs.
Heap and Memory
- Heap Overview: General overview of V8's paged heap and object layout.
- Garbage Collection: Overview of V8's generational GC.
- Marking and Sweeping: Deep dive into Major GC phases.
- Roots: How V8 manages root objects and static roots.
- Handles: V8's mechanism for safe heap object references (Indirect vs Direct).
- Heap Compaction: How V8 resolves memory fragmentation in the Old Generation.
- Pointer Compression: Technique to reduce memory footprint on 64-bit architectures.
- Pointer Tagging: How V8 encodes type information in pointers (Smis vs HeapObjects).
- Zone Allocator: Region-based memory manager for fast allocation and batch deallocation.
Object Model
- Objects and Maps: How JavaScript objects and Maps (hidden classes) are represented in V8's heap.
- Descriptor and Transition Arrays: How V8 tracks property additions and shares descriptor arrays between maps.
- Field Representations and Elements Kinds: How V8 specializes storage for properties and elements based on their types.
- Lookup Iterator: V8's central mechanism for resolving property accesses.
- Strings: Overview of V8's complex string representation and transitions.
Sandbox
- Architecture: V8's in-process sandbox to protect memory outside of it.
Torque
- Architecture: V8's domain-specific language for writing builtins.
- User Manual: The V8 Torque language manual.
Builtins
- Architecture: How V8 implements standard library and runtime helpers (Torque, CSA, C++, ASM).
- Torque Tutorial: Introduction to writing Torque builtins.
Code Generation
- Assembler and MacroAssembler: Low-level code generation abstractions.
- CodeStubAssembler: Portable macro-assembler for writing builtins and bytecode handlers.
- CodeStubAssembler Tutorial: Introduction to writing CodeStubAssembler builtins.
RegExp
- Architecture: Irregexp, V8's regular expression engine.
WebAssembly
- Architecture: V8's WebAssembly implementation, including Liftoff and Turboshaft tiers.
Snapshots
- Architecture: V8's snapshot and serializer system for fast startup.
Execution - Runtime
- Ignition (Interpreter): V8's register-based interpreter.
- Hidden Classes and Inline Caches: How V8 optimizes property access using Maps and ICs.
- Maps (Hidden Classes) Tutorial: Tutorial on how V8 builds hidden classes.
- Scopes and ScopeInfos: The relationship between compile-time Scopes and runtime ScopeInfos.
- Function Architecture: How V8 splits function data into context-independent (SFI) and context-dependent (JSFunction) parts, and how they are chained.
- Tiering and Interrupt Budget: How V8 decides to optimize functions.
- Exception Handling: How V8 implements exceptions using side-tables across all tiers.
- Deoptimization: How V8 transitions from optimized code back to the interpreter.
- Stack Walking: How V8 traverses and inspects call stack frames.
Compiler
Sparkplug
- Sparkplug (Baseline Compiler): Fast, non-optimizing compiler that mirrors the interpreter.
Maglev
- Maglev (Mid-Tier Compiler): Graph-based optimizing compiler.
- Maglev Register Allocator: Linear scan and node constraints.
TurboFan
- TurboFan (Optimizing Compiler): Top-tier optimizing compiler using Sea-of-Nodes and Turboshaft IRs.
Turboshaft
- Turboshaft and Turbolev: Next-generation IR and pipeline, including the Maglev frontend.
- Turboshaft IR Details: Operations and the side-effect system.
- Turboshaft Reducers: Composable optimization passes.
- Turboshaft Copying Approach: Semi-spaces for IR and cheap copies.
Common
- Why V8 Embraced CFG: The transition from TurboFan's SoN to Turboshaft's CFG and its benefits.
- Concurrency and Background Compilation: How V8 uses background threads safely.
Parsing
- Parser and AST: How V8 parses JavaScript into an Abstract Syntax Tree.
- Lazy Parsing and Preparser: How V8 delays parsing and handles closures.