调试V8中JS对应的汇编代码

1、调试未优化代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
gdb --args ~/v8/out/ia32.debug/d8 --print-code poc.js
bp v8::internal::FullCodeGenerator::MakeCode
run
c
finish   
//跟c命令配对执行多次，直至打印出需要的汇编指令
Run till exit from #0  v8::internal::FullCodeGenerator::MakeCode (info=0xff873eb8) at ../src/full-codegen.cc:283
--- Raw source ---
……

--- Code ---
source_position = 197
kind = FUNCTION
name = evil_object.toJSON
Instructions (size = 128)
0x2b3301a0     0  55             push ebp
0x2b3301a1     1  89e5           mov ebp,esp
……
bp * 0x2b3301a0

2、调试优化代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
gef>  bp v8::internal::Context::AddOptimizedFunctiongef>  run Thread 1 "d8" hit Breakpoint 1, v8::internal::Context::AddOptimizedFunction (this=0x1fe2a1083a79, function=0x1fe2a10ac281) at ../src/contexts.cc:413gef>  job function

0x1fe2a10ac281: [Function]
 - map = 0xe7a59804099 [FastProperties]
 - prototype = 0x1fe2a1084069
 - elements = 0x367f8ed82241 <FixedArray[0]> [FAST_HOLEY_ELEMENTS]
 - initial_map = 
 - shared_info = 0x1fe2a10abdd9 <SharedFunctionInfo Ctor>
 - name = 0x1fe2a10abae9 <String[4]: Ctor>
 - formal_parameter_count = 0
 - context = 0x1fe2a1083a79 <FixedArray[188]>
 - literals = 0x1fe2a10ac551 <FixedArray[1]>
 - 
code = 0x3e4da55066a1 <Code: OPTIMIZED_FUNCTION>
 - properties = {
   #length: 0x367f8edd2709 <AccessorInfo> (accessor constant)
   #name: 0x367f8edd2779 <AccessorInfo> (accessor constant)
   #arguments: 0x367f8edd27e9 <AccessorInfo> (accessor constant)
   #caller: 0x367f8edd2859 <AccessorInfo> (accessor constant)
   #prototype: 0x367f8edd28c9 <AccessorInfo> (accessor constant)
 }

gef> job 0x3e4da55066a1
0x3e4da55066a1: [Code]
kind = OPTIMIZED_FUNCTION
stack_slots = 5
compiler = crankshaft
Instructions (size = 218)
0x3e4da5506700     0  55             push rbp
0x3e4da5506701     1  4889e5         REX.W movq rbp,rsp
0x3e4da5506704     4  56             push rsi
0x3e4da5506705     5  57             push rdi
……
gef> bp *0x3e4da5506700
gef> c

Continuing.

Thread 1 "d8" hit Breakpoint 2, 0x00003e4da5506700 in ?? ()
……
 code:i386:x86-64
0x3e4da5506700    push rbp   $pc
0x3e4da5506701    mov rbp, rsp
0x3e4da5506704    push rsi
0x3e4da5506705    push rdi
0x3e4da5506706    sub rsp, 0x8
0x3e4da550670a    mov rax, QWORD PTR [rbp-0x8]