6 ms·

I was talking with a colleague today who mentioned that he had looked at WASM for a particular use-case (file-verification IIRC) and had concluded that for now

I was talking with a colleague today who mentioned that he had looked at WASM for a particular use-case (file-verification IIRC) and had concluded that for now the overhead of copying memory made it run worse than well-written JavaScript. It is also my experience that the overhead of memory copying can really put a damper on performance improvements. Now, I get that sharing memory is a huge safety issue - it kind of inherently breaks the sandbox, but when I see the "nanoprocesses" bit in the article I worry about death by a thousand paper cuts (lots of tiny WASM module spending more time copying data than processing it). Are there ways/plans to minimize memory copies that don't conflict with the safety concerns?

JoshTriplett 7y ago
There will be ways to memory-map files, share memory between modules, and otherwise avoid copying memory unnecessarily. Shared memory doesn't break the sandbox. Sharing all memory by default would, but controlled sharing of specific memory doesn't. Think of it like inter-process shared memory, rather than threads sharing an entire address space.
- vanderZwan 7y ago
  Right, I was being sloppy - I guess was really thinking "memory addresses", not "memory". Anyway, that's great to hear! Any suggestions for discussions and such that one could follow to see how it develops?
- lambda 7y ago
  Reading through this, this sounds like mostly a capability based architecture, with process isolation replaced with a statically typed bytecode in which you can verify that each module can only use capabilities passed to it. I was wondering why the focus on copying memory between the processes. It should be possible to make capabilities which represent a pointer and a length (and maybe an access mode), which could be used to give a process direct access to shared memory safely. I don't know if that could be done with low enough overhead for small objects, it's possible that there would need to be a threshold below which you would just copy values to be efficient, but it seems like exploring fat pointer capabilities would be worthwhile. Memory mapping files or inter-process shared memory is the very coarse-grained version of this, using hardware protection. I feel like it should be possible to do something more efficient and finer grained with pointer capabilities and the static type checking that is done to verify WASM during compilation, but it may be a significant research project of its own.
  - tschneidereit 7y ago
    What you're describing will indeed be introduced with the WebAssembly GC proposal: https://github.com/WebAssembly/gc https://github.com/WebAssembly/gc For languages that can express unforgeable pointers as first-class concept, that is indeed a very attractive, fine-grained approach. Unfortunately bringing that to languages like C/C++/Rust is a different matter altogether. Since we want to support those languages as first-class citizens, we can't require GC support as a base concept, so we have to treat a nanoprocess as the unit of isolation from the outside. Once we have GC support, nothing will prevent languages that can use it from expressing finer-grained capabilities even within a nanoprocess, and that seems highly desirable indeed. (full disclosure: I'm a Mozilla employee and one of the people who set up the Bytecode Alliance.)
    - danielearwicker 7y ago
      That future possibiilty reminds me of https://en.wikipedia.org/wiki/Singularity_(operating_system) https://en.wikipedia.org/wiki/Singularity_(operating_system) - where process/address-space isolation was replaced with fine-grained static verification of high-level code (presumably not the first experiment in this area).
      - tschneidereit 7y ago
        Indeed: that and many other things are prior art in this space. And there is a lot of prior art for what we're working on—this is not meant as an academic research project! :)
        lambda 7y ago
        Yes, one of the answers I want to give any time someone asks "why will WASM succeed when the JVM didn't" is that there is 25 years more experience and research to draw upon.
        pjmlp 7y ago
        And yet bounds checking access validation was left out of the design, something that most of previous research projects took care to taint as unsafe packages when present.
sunfish 7y ago
Yes. We know that WebAssembly in its present form doesn't yet have all the functionality we'll want to make all this efficient, so we're active in many areas in the WebAssembly standards process helping move it forward.
swiley 7y ago
WASM has some pretty zany ideas about computing that make the “ASM” part feel a little strange. Web binary lisp sans tail call optimization is a little more fitting IMO.

JoshTriplett 7y ago

There will be ways to memory-map files, share memory between modules, and otherwise avoid copying memory unnecessarily. Shared memory doesn't break the sandbox. Sharing all memory by default would, but controlled sharing of specific memory doesn't. Think of it like inter-process shared memory, rather than threads sharing an entire address space.

vanderZwan 7y ago
Right, I was being sloppy - I guess was really thinking "memory addresses", not "memory". Anyway, that's great to hear! Any suggestions for discussions and such that one could follow to see how it develops?
lambda 7y ago
Reading through this, this sounds like mostly a capability based architecture, with process isolation replaced with a statically typed bytecode in which you can verify that each module can only use capabilities passed to it. I was wondering why the focus on copying memory between the processes. It should be possible to make capabilities which represent a pointer and a length (and maybe an access mode), which could be used to give a process direct access to shared memory safely. I don't know if that could be done with low enough overhead for small objects, it's possible that there would need to be a threshold below which you would just copy values to be efficient, but it seems like exploring fat pointer capabilities would be worthwhile. Memory mapping files or inter-process shared memory is the very coarse-grained version of this, using hardware protection. I feel like it should be possible to do something more efficient and finer grained with pointer capabilities and the static type checking that is done to verify WASM during compilation, but it may be a significant research project of its own.
- tschneidereit 7y ago
  What you're describing will indeed be introduced with the WebAssembly GC proposal: https://github.com/WebAssembly/gc https://github.com/WebAssembly/gc For languages that can express unforgeable pointers as first-class concept, that is indeed a very attractive, fine-grained approach. Unfortunately bringing that to languages like C/C++/Rust is a different matter altogether. Since we want to support those languages as first-class citizens, we can't require GC support as a base concept, so we have to treat a nanoprocess as the unit of isolation from the outside. Once we have GC support, nothing will prevent languages that can use it from expressing finer-grained capabilities even within a nanoprocess, and that seems highly desirable indeed. (full disclosure: I'm a Mozilla employee and one of the people who set up the Bytecode Alliance.)
  - danielearwicker 7y ago
    That future possibiilty reminds me of https://en.wikipedia.org/wiki/Singularity_(operating_system) https://en.wikipedia.org/wiki/Singularity_(operating_system) - where process/address-space isolation was replaced with fine-grained static verification of high-level code (presumably not the first experiment in this area).
    - tschneidereit 7y ago
      Indeed: that and many other things are prior art in this space. And there is a lot of prior art for what we're working on—this is not meant as an academic research project! :)
      - lambda 7y ago
        Yes, one of the answers I want to give any time someone asks "why will WASM succeed when the JVM didn't" is that there is 25 years more experience and research to draw upon.
        pjmlp 7y ago
        And yet bounds checking access validation was left out of the design, something that most of previous research projects took care to taint as unsafe packages when present.

sunfish 7y ago

Yes. We know that WebAssembly in its present form doesn't yet have all the functionality we'll want to make all this efficient, so we're active in many areas in the WebAssembly standards process helping move it forward.

swiley 7y ago

WASM has some pretty zany ideas about computing that make the “ASM” part feel a little strange. Web binary lisp sans tail call optimization is a little more fitting IMO.