Javascript：如何查看像toString这样的本机函数的源代码实现

Question

I am looking to see how some Javascript functions work under the hood. For eg I want to learn how Chrome's V8 Engine implements the Unary (-) operation or the String.prototype.toString() method.

How can I see the native C/C++ implementation? I have seen many answers here linking to the Chromium repository and the V8 repository, but these are giant and not very beginner friendly, and there aren't really any guides anywhere as far as I could find.

I'm looking for something like this:

// Pseudo code
function -(arg) {
  return arg * -1
}

Obviously, I understand that I wouldn't find this written in Javascript . I'm just looking for a similar level of detail.

I'm yet to find an answer that concisely shows how to find the native implementation of Javascript functions anywhere. Could someone point me in the right direction?

The ECMA specs here give the following specs for the Unary - operation:

Unary - Operator

The unary - operator converts its operand to Number type and then negates it. Note that negating +0 produces −0, and negating −0 produces +0.

The production UnaryExpression : - UnaryExpression is evaluated as follows:

Let expr be the result of evaluating UnaryExpression . Let oldValue be ToNumber(GetValue(expr)) . If oldValue is NaN , return NaN . Return the result of negating oldValue ; that is, compute a Number with the same magnitude but opposite sign.

This is quite useful, but what I'm trying to understand is, how

compute a Number with the same magnitude but opposite sign

Is calculated. Is it the number * -1 or something else? Or is it multiple ways?

Answer 1

There is no piece of code or single implementation of individual operators in V8. V8 is a just-in-time compiler that executes all JavaScript by compiling it to native code on the fly. V8 supports about 10 different CPU architectures and for each has 4 tiers of compilers. That already makes 40 different implementations of every operator. In many of those, compilation goes through a long pipeline of stages that transform the input to the actual machine code. And in each case the exact transformation depends on the type information that is available at compile time (collected on previous runs).

To understand what's going on you would need to understand a significant part of V8's complicated architecture, so it is pretty much impossible to answer your question in an SO reply. If you are just interested in the semantics, I rather suggest looking at the EcmaScript language definition.

(The snippet you cite is just a helper function for the converting compiler-internal type information for unary operators in one of the many stages.)

Edit: the excerpt from the EcmaScript definition you cite in the updated question is the right place to look. Keep in mind that all JavaScript numbers are IEEE floating point numbers. The sentence is basically saying that - just inverts the sign bit of such a number. You'd have to refer to the IEEE 754 standard for more details. Multiplication with -1.0 is a much more complicated operation, but will have the same result in most cases (probably with the exception of NaN operands).