如何在 v8 中检查 object 属性是对象内属性、快速属性还是慢速属性？

Question

The post https://v8.dev/blog/fast-properties mentions there are three kinds of properties. How do I find out which one a property is?

I am expecting answers with a v8 native syntax function or a devtool feature.

Answer 1

(V8 developer here.)

Whether an object has dictionary-mode properties is a per-object (not per-property) decision. The alternative state is to have "fast" properties, which typically means a mix of in-object and out-of-object properties.

Any build of V8 running with --allow-natives-syntax can use %HasFastProperties(obj) to tell whether an object has "fast" properties (returned value is true ) or dictionary properties ( false ).

To see how many in-object properties a "fast"-mode object has, you need a Debug build, and use %DebugPrint(obj) .

To the best of my knowledge, DevTools does not expose this information. (Which is fine IMHO, as you shouldn't need to care about this, aside from curiosity.)

Side note: I think that "fast" and "slow" are very misleading descriptions, because they sound way too much like "good case" and "bad case", when in fact they have different strengths and weaknesses. Objects that track their precise property layout using their hidden class are fast at reading/writing the values of existing properties, but exceedingly slow at adding/removing properties. Objects that use a dictionary for their properties are a little slower at reading/writing property values, but much faster at adding/removing properties. So depending on your app's use case, you sometimes want the one and sometimes the other, and aside from pathological cases the engine is also pretty good at switching to the one or the other, and there's no object state that's clearly better than the other. (And if you know you'll be adding and removing many properties, using a Map is going to give you better performance than using plain objects.)

Answer 2

Here is long story short explanation for the difference between fast and slow properties. When an object is created in JS, a hidden class is attached to it. When a property is added to the object, “class transition” happens (the old hidden class switches to a new hidden class with the new property in it)

When V8 sees a class constructor function is declared, it creates a hidden class ex: C0. Now, when V8 sees on the next line a property being added, in our example: name it updates the C0 with the new property and switches from C0 to a new hidden class say C1, then it sees next property: age and switches to C2.

Adding new properties dynamically to the 2 person objects in this example is not an optimized solution because the order in which the two new properties (likes and dislikes) are instantiated is different. A different order results in the creation of two different hidden classes instead of sharing a common hidden class.

So: we create C0 for the constructor function person. It transits to C1 for name and then C2 for age. For person1, when it sees a property "likes" and it transits to C3a and for "dislikes" to C4a. BUT, for person2 V8 first sees the property "dislikes" being added to it and therefore instead of sharing the hidden class C3a, it creates a new hidden class C3b. It then creates a new hidden class for property likes say C4b.

Since the two objects do not share the hidden classes (when they could have shared them); the access to the properties of the object is slow because V8 is now not able to make use of inline caching. If the two had shared the hidden class, V8 would have used inline caching for faster access. So in the example below those are slow properties. Would have been fast if order was the same.

Hope this helps a bit.

 function person(name,age) { this.name = name; this.age = age; } let person1 = new person("jim", 28); let person2 = new person("jane", 27); person1.likes = "games"; person1.dislikes = "running"; person2.dislikes = "cities"; person2.likes = "nature";