Untrusted code mode
In response to the latest speculative side-channel attack called Spectre, V8 introduced an untrusted code mode. If you embed V8, consider leveraging this mode in case your application processes user-generated, not-trustworthy code. Please note that the mode is enabled by default, including in Chrome.
Streaming compilation for WebAssembly code
The WebAssembly API provides a special function to support streaming compilation in combination with the
const module = await WebAssembly.compileStreaming(fetch('foo.wasm'));
With V8 v6.5 and Chrome 65, we take advantage of this API and compile WebAssembly modules already while we are still downloading the module bytes. As soon as we download all bytes of a single function, we pass the function to a background thread to compile it.
Our measurements show that with this API, the WebAssembly compilation in Chrome 65 can keep up with up to 50 Mbit/sec download speed on high-end machines. This means that if you download WebAssembly code with 50 Mbit/sec, compilation of that code finishes as soon as the download finishes.
For the graph below we measure the time it takes to download and compile a WebAssembly module with 67 MB and about 190,000 functions. We do the measurements with 25 Mbit/sec, 50 Mbit/sec, and 100 Mbit/sec download speed.
When the download time is longer than the compile time of the WebAssembly module, e.g. in the graph above with 25 Mbit/sec and 50 Mbit/sec, then
WebAssembly.compileStreaming()finishes compilation almost immediately after the last bytes are downloaded.
When the download time is shorter than the compile time, then
WebAssembly.compileStreaming()takes about as long as it takes to compile the WebAssembly module without downloading the module first.
lengthof the array — in v6.5, we note when that happens, and stop inlining the array builtin called at that site on future optimization attempts.
We also widened the fast-path by inlining many builtins that were formerly excluded because of a side-effect between the load of the function to call and the call itself, for example a function call. And
String.prototype.indexOfgot a 10× performance improvement in function calls.
In V8 v6.4, we’d inlined support for
Array.prototype.filter. In V8 v6.5 we’ve added inlining support for:
Furthermore, we’ve widened the fast path on all these builtins. At first we would bail out on seeing arrays with floating-point numbers, or (even more bailing out) if the arrays had “holes” in them, e.g.
[3, 4.5, , 6]. Now, we handle holey floating-point arrays everywhere except in
findIndex, where the spec requirement to convert holes into
undefinedthrows a monkey-wrench into our efforts (for now…!).
The following image shows the improvement delta compared to V8 v6.4 in our inlined builtins, broken down into integer arrays, double arrays, and double arrays with holes. Time is in milliseconds.
git log branch-heads/6.4..branch-heads/6.5 include/v8.hto get a list of the API changes.
Developers with an active V8 checkout can use
git checkout -b 6.5 -t branch-heads/6.5to experiment with the new features in V8 v6.5. Alternatively you can subscribe to Chrome’s Beta channel and try the new features out yourself soon.