🔗 V8 JSObject Memory Exercise

In this exercise you will inspect how basic JS objects are laid out in memory.

You can launch a v8 REPL under gdb with exercise run v8 --gdb.

🔗 Create Objects to Inspect

Create several objects which we will inspect the underlying memory of. Here are some ideas:

  • Create an empty object {}
  • Create an object with a single property {'a': 4142}
  • Create an object and assign properties and elements {'a': 4142, 'b': 42, 0: 61, 2: 62}
  • Create an object with integers, doubles, and references {'a': 4142, 'b': 1.1, 'c': {}, 'd': []}

🔗 Inspect the Memory of the Objects

For each of the objects you created:

  • Use %DebugPrint to dump the object's information
    • NOTE: The order of the %DebugPrint output does not match the actual order of values in memory
    • Observe how each object of each "different shape" has different Map pointers
    • If you make two objects with the same shape (same property names and types) they may share the same Map pointer
    • Notice how there may be "inline properties", a "property array", and an "element array"
  • Break into gdb by hitting ctrl-c or using %SystemBreak()
  • Dump the memory of each object using x/32xg <address> (remember to remove the tag bit!)
    • Try to match the memory to our object layout diagrams
  • Try printing the memory of the property and element arrays (remember to remove the tag bit!)

🔗 Map Transitions

Using %DebugPrint we can see what Map pointer each object is using. If we modify the object in specific ways (such as adding properties), we can observe this Map pointer changing.

  • Create an object with a single property foo = {'a': 4142}

    • Use %DebugPrint to check foo Map pointer

  • Now create a new object using the same original property name bar = {'a': 2000}

    • Use %DebugPrint to check bar Map pointer, it should be the same as foo

  • Add a new property to the object foo['b'] = 6262

    • Use %DebugPrint to check foo Map pointer again, did it change?

  • Add a new property to the object bar['b'] = 4000

    • Use %DebugPrint to check bar Map pointer again, it should match foo again