# V8 Snapshot and Serializer System

To achieve fast startup times, V8 uses a **Snapshot** system. Instead of parsing and compiling the standard library and initializing the heap from scratch every time a new Isolate is created, V8 captures a snapshot of a fully initialized heap and persists it.

When a new Isolate starts up, it simply restores the heap state from the snapshot, which is significantly faster.

## Key Components

### 1. `mksnapshot`

`mksnapshot` is a standalone executable tool built during the V8 build process.
*   **Purpose**: To run a minimal V8 instance, initialize the heap (including compiling builtins), and serialize the resulting heap state into a snapshot.
*   **Output**: It generates C++ files containing the snapshot data as byte arrays, which are then compiled and linked directly into the V8 binary (or written to external files).

### 2. Serializer and Deserializer

The core logic for saving and restoring heap state is in the `Serializer` and `Deserializer` classes (in `src/snapshot/`).

*   **Serialization**: The process of traversing the heap graph and writing objects to a stream (`SnapshotByteSink`).
    *   It handles pointers by converting them to references (e.g., back references to already seen objects or roots).
    *   It uses specialized serializers for different spaces.
*   **Deserialization**: The process of reading the byte stream and recreating the objects in the heap.
    *   It allocates objects and fills in their fields.
    *   It patches pointers based on the references in the stream.

## Serialization Bytecode

The snapshot data is not a raw memory dump. Instead, it is a stream of **bytecode instructions** that the `Deserializer` executes to reconstruct the heap. This design makes the snapshot format robust across different memory layouts and address spaces.

> [!IMPORTANT]
> The serialization format is trusted and strictly build- and version-dependent. Code caches and snapshots include the V8 version and critical build flags as metadata. The deserializer will bail out and reject the snapshot if a mismatch is detected.

The bytecode is defined in `src/snapshot/serializer-deserializer.h` (in `enum Bytecode`) and includes instructions for:
*   **Object Allocation**: Instructions to allocate an object of a specific size in a specific heap space (e.g., `kNewObject`).
*   **Reference Handling**:
    *   **Back References**: Pointing to an object already deserialized in the current stream.
    *   **Root References**: Pointing to a well-known object in the roots table (e.g., `kRootArrayConstants`).
    *   **Attached Objects**: References to objects provided externally to the deserializer.
*   **Data Filling**: Copying raw data into the allocated objects.
*   **Pointer Patching**: Instructions to resolve pointers between objects as they are created.
*   **Repetition**: Optimizing for repetitive data (e.g., `kFixedRepeatRoot`).

By using a bytecode interpreter for deserialization, V8 can handle complex object graphs and cyclic references efficiently during isolate startup.

## Types of Snapshots

V8 uses several distinct snapshots to organize heap data:

### 1. Read-Only Snapshot
*   **Purpose**: Contains objects that are immutable and shared across all Isolates (e.g., the `undefined` value, small integers, certain Maps).
*   **Benefit**: These objects can be placed in a read-only memory region and shared directly, saving memory and avoiding the need for locks.

### 2. Startup Snapshot
*   **Purpose**: Contains the rest of the initial heap state needed to start an Isolate, excluding custom contexts.
*   **Contents**: Includes builtins, initial symbols, and global objects.

### 3. Context Snapshot
*   **Purpose**: Contains the state of a fully initialized `NativeContext`.
*   **Benefit**: Allows embedders (like Chrome or Node.js) to create snapshots of a context with their own specific APIs already initialized.

### 4. Shared Heap Snapshot
*   **Purpose**: Contains objects that should be in the shared heap in the shared Isolate during startup (e.g., for `--shared-string-table`).
*   **Behavior**: When the shared heap is not in use, its contents are deserialized into each Isolate.

## Code Serialization (Code Cache)

Independent of the startup snapshot, V8 also uses serialization for **Code Caching**.
*   **Purpose**: To cache the generated code (Ignition bytecode or machine code) for user scripts.
*   **How it works**: When a script is run for the first time, V8 can serialize its `BytecodeArray` or optimized code and save it to disk. On subsequent loads, V8 can deserialize the code directly, bypassing parsing and compilation.
*   **Files**: Managed by `CodeSerializer` in `src/snapshot/code-serializer.cc`.

## Snapshot Compression

V8 can compress the snapshot data to reduce the size of the binary or external snapshot files.
*   **Implementation**: Managed by `SnapshotCompression` in `src/snapshot/snapshot-compression.h` & `.cc`.
*   **Configuration**: Controlled by the `V8_SNAPSHOT_COMPRESSION` build flag.

## File Structure

*   `src/snapshot/mksnapshot.cc`: Entry point for the snapshot creation tool.
*   `src/snapshot/serializer.h` & `.cc`: Base classes for serialization.
*   `src/snapshot/deserializer.h` & `.cc`: Base classes for deserialization.
*   `src/snapshot/read-only-serializer.cc` & `read-only-deserializer.cc`: Serializer and deserializer for the read-only space.
*   `src/snapshot/startup-serializer.cc` & `startup-deserializer.cc`: Serializer and deserializer for the startup heap.
*   `src/snapshot/context-serializer.cc` & `context-deserializer.cc`: Serializer and deserializer for contexts.
*   `src/snapshot/shared-heap-serializer.cc` & `shared-heap-deserializer.cc`: Serializer and deserializer for the shared heap.
*   `src/snapshot/code-serializer.cc`: Serializer for code caching.