My suggestion was to have Firefox support both Gecko (with uplifted component) and a pure Rust renderer, with the latter to be used in the Tor mode where securi

My suggestion was to have Firefox support both Gecko (with uplifted component) and a pure Rust renderer, with the latter to be used in the Tor mode where security (to preserve anonymity against resourceful adversaries) matters over compatibility. For security, instead of a JIT, a simple JavaScript bytecode interpreter written in Rust to be used exclusively in the Tor mode would be ideal, for maximum security at the cost of worse performance. Another option is a JIT that generates code that is easily proven to be safe (e.g. because it does a bounds check on all memory accesses and only does indirect jumps using a jump table, or because it's the only thing running in a process and jumps are still constrained with a read only jump table and read only code).