The following content was originally written for our team blog.
At the time, I didn’t have a personal GitHub blog, so I’m posting it now after setting one up.
This research was not conducted alone but was a joint effort between two people.
To gain more experience, I plan to redo the entire process by myself from the beginning and will add any new insights I discover along the way.
What is V8?
Chrome V8 is an open-source JavaScript engine used in the Google Chrome web browser and the Node.js server environment.
V8 is designed to efficiently execute JavaScript code, aiming for fast performance and optimization.
Here is a table showing the global web browser market share, and as of December 2023, we can see that the Chrome browser holds a staggering 64.7% share.
The engine used by the Chrome browser, which I’m currently introducing, is the V8 engine.
Source: Browser Market Share Worldwide
It seems Chrome might need to make more of an effort so that searches for ‘V8 engine’ immediately bring up the Chrome V8 engine instead.
V8 Engine Components (Pipeline)
The V8 engine is composed of various components. To make it easier to understand, I have attached two images below.
The components of V8 are as follows:
- Parser
- Ignition
- Sparkplug
- Maglev
- TurboFan
Source: V8_pipeline
Source: Pipeline with Maglev
I will briefly explain each component.
-
Parser: Converts the JavaScript source code to an AST (Abstract Syntax Tree) structure.
You can view it easily through the site below:
-
Ignition: As V8’s interpreter, Ignition converts the parsed AST structure into bytecode.
It compiles and generates bytecode directly without first compiling the code into machine code, which allows it to be extremely fast.
Ignition also collects profiling information for later optimization.This image shows a portion of the bytecode:
Based on the profiling information collected by Ignition, V8 determines the level of optimization needed using a JIT compiler. There are three types of compilers involved in this process:
- Sparkplug: A JIT compiler that performs fast and simple optimizations.
- Maglev: A JIT compiler that performs mid-tier optimizations by analyzing the source code.
- TurboFan: V8’s most powerful optimizing JIT compiler, which conducts dynamic analysis followed by optimization and compilation.
Initially, only Ignition and TurboFan were used, but due to a gap in performance, Sparkplug was developed. Later, Maglev was added to fill the gap between Sparkplug and TurboFan.
Garbage Collection of V8
V8’s Garbage Collection differs from Java’s in some ways, though the core concepts are similar.
V8’s heap is divided into regions like the Young space and Old space, and each manages memory differently.
Young Space
The Young space manages newly created objects. Memory here is managed using Scavenging, also known as Minor GC.
Old Space
The Old space holds objects that have survived in the Young space for a long time. It uses the Mark-Sweep and Mark-Compact methods for memory management, collectively referred to as Major GC.
For a more detailed explanation, check out the following link:
V8 Sandbox (a.k.a. Ubercage)
V8 has a protection mechanism called the Sandbox, which prevents successful exploits by isolating objects that could be used for exploitation.
Rather than storing direct addresses of objects, V8 stores indices of tables to protect against exploits.
Comments