How V8 turns a + b into machine code

On the event-loop page, step 10 was a task that "executes the script". Inside that task, Blink passes the source text of main.jsx to V8 and asks it to compile and run. In Node, the same happens when require or import loads a file. Either way, V8 receives a string of characters and has to end up executing machine instructions.

V8 does not compile everything at once. The top-level code is parsed fully, but most function bodies are only pre-parsed: scanned quickly to find where they end and which variables they capture. A function is fully parsed and compiled to bytecode the first time it is called. Since add below is called, it goes all the way through.

The scanner reads characters and groups them into tokens, the lexical-analysis phase from compiler design. V8's scanner is hand-written for speed. For ASCII characters it looks up a precomputed table, one_char_tokens, then resolves multi-character operators by peeking ahead. That is how <, <=, << and <<= are told apart.

V8's parser is hand-written recursive descent, not generated by a tool like Bison. For binary operators it uses precedence climbing: every operator has a number (+ is 12, * is 13, ** is 14), and the parser keeps absorbing operators of the current precedence, recursing with a higher minimum precedence for the right-hand side. Associativity falls out of one line: ** is right-associative, so its right side is parsed at the same precedence instead of one higher.

Two things happen during parsing that surprise most people. When both operands are number literals, the parser folds them on the spot, so 2 * 3 + a never contains a multiplication. And a chain of the same operator, such as a - b - c, is collapsed into one n-ary node.

Ignition is a register machine with an accumulator. Most bytecodes read one operand from a register and the other from an implicit accumulator, then leave the result in the accumulator. Parameters live in registers a0, a1, a2; temporaries are r0, r1 and so on. The [n] operand after an arithmetic bytecode is a feedback slot: a place where Ignition records which types it actually saw, for the optimizing compilers to use later.

The generator below walks our tree. Watch three real V8 behaviours: a Smi literal on the right becomes an immediate operand (MulSmi [2]); a literal on the left of a commutative operator is moved to the right; and a parameter used as a left operand is read straight from its register, because V8's register optimizer removes the copy.

Each bytecode has a handler: a small piece of machine code generated when V8 is built. A handler does its work, then Dispatch() reads the next bytecode and jumps straight to that handler. There is no central switch statement; each handler ends by jumping to the next one. The arithmetic handlers also update the feedback slot with the types they saw.

JavaScript objects look like dictionaries, but V8 gives every object a hidden class it calls a Map: a description of which properties exist and at which offset. Objects created with the same properties in the same order share a Map. When getX(o) runs o.x, the property load's inline cache remembers "for this Map, x is at offset N", so the next lookup is a comparison and a load.

The cache has states. One Map seen is monomorphic. Up to four is polymorphic, a short list to check. The fifth different Map makes it megamorphic, falling back to a global lookup table. The limit 4 is a real V8 flag, shown below, and the transitions are exactly what V8 printed for us.

Interpreting is cheap to start but slow to run. V8 therefore has a ladder of compilers and moves a function up the ladder as it gets hotter. Sparkplug translates bytecode to machine code almost one-to-one, without optimizing. Maglev is a fast optimizing compiler. TurboFan spends the most time and produces the fastest code, using the feedback Ignition collected to speculate about types.

TurboFan compiles add assuming the feedback stays true. If Ignition only ever saw small integers (V8 calls them Smis), the machine code uses a plain integer add plus a cheap check. When a value breaks the assumption, the check fails and V8 deoptimizes: it rebuilds the interpreter frame and continues in Ignition at the exact same bytecode, with updated feedback. Step through what Node actually printed for this program:

Five questions in the style of a compilers or programming-languages exam. Write our answer on paper first, then open the model answer and mark ourselves honestly. The marks follow the usual pattern of university theory exams; they are not copied from any real paper.