4 ms·

Firefox on iOS is just Safari with different chrome (oh how ironic a word, but I mean the browser UI) since Apple doesn't allow third parties to JIT (which is e

Firefox on iOS is just Safari with different chrome (oh how ironic a word, but I mean the browser UI) since Apple doesn't allow third parties to JIT (which is essentially required for JS, so everyone uses iOS' builtin webview)

stingraycharles 6y ago
What is this jit requirement? I always thought it was about executing custom code that cannot be vetted during the app review process.
- hellodanylo 6y ago
  I think JIT and custom code is the same requirement in this discussion. In Chrome's case, the V8 engine is a JIT compiler from JS to ARM instructions. The code of V8 can be vetted during the review process, but the ARM instructions that it will generate (just in time) can not. > 3.3.2 An Application may not download or install executable code. Interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded. The only exception to the foregoing is scripts and code downloaded and run by Apple's built-in WebKit framework.
  - dunham 6y ago
    Additionally, JIT would need a special entitlement to be able to change a page of memory from writable to executable. This is a little dangerous from a security perspective, and even Apple only grants it to apps the specifically need it.
    - m4rtink 6y ago
      Thats all nice and good, but completely removing the posibility of running any non-vendor JIT application is totally stupid and unacceptable. And iOS being a total walled garden only adds insult to injury, as users simply can't install such applications even if they want to.
    - stingraycharles 6y ago
      Aha so that is what it’s all about. That makes so much more sense now, and a very reasonable explanation. Does this also apply to jailbroken iOS devices? I can imagine that it’s fairly difficult to disable a security feature such as this in the kernel?
      - dunham 6y ago
        I don't know the exact details of how jailbreaking tweaks code-signing. But as I understand it apps are signed and have an entitlements file bundled inside. That file determines whether the kernel will allow stuff like changing pages to executable, running in the background, notifications, etc. Safari happens to have this extra entitlement in its embedded entitlements.plist. The signature checks out, so the the kernel allows the functionality. For example, there is an entitlement to allow a debugger to attach, which dev builds of apps typically have, but Apple won't allow for apps in the store. I would think that if jailbreak short circuited the signature stuff, you could put whatever entitlements you want in there. But there may be some additional constraints. Now that I'm thinking of it, I wonder if dev builds of apps can have the entitlement to do the JIT magic. I don't know if they place any constraints on the dev signing keys.
  - stingraycharles 6y ago
    Oh I was confused as I associated a JIT with internal vm optimizations such as seen in the JVM. Then we’re just talking about the same thing but calling it a different name.
- kroltan 6y ago
  Hmm, you're correct actually. Any downloaded code is prohibited. I thought it was only JIT due to my background with native apps, my bad.
chrisseaton 6y ago
I don’t think JIT is required for JS, that’s just how people choose to implement it.
- jandrese 6y ago
  I think a JIT compiler is basically required to run Javascript at an acceptable speed on a mobile device. The world has moved on from the time when you could get away with an interpreted Javascript engine.
- kroltan 6y ago
  Conceptually, yeah, it's not required. But in practice there are a whole lot of websites that make heavy (HEAVY) use of JS, and performance would not be acceptable for a lot of users. I'm not saying those websites are correct in doing that, but in effect browsers are expected to have JIT to maintain any userbase at all, because such websites are so numerous that it would make it seem it is an actual browser "issue" in the eyes of laypeople.
  - Chyzwar 6y ago
    Depends. Hermes[1] JS engine from Facebook do not have JIT and provide better perf for React Native. Modern V8 have both interpreter Ignition[2] and TurboFan[3] JITed compiler. My understanding is that on most websites Ignition will be sufficient but when using omething like SPA application TurboFan will gradually speedup bytecode generated by Ignition using JIT like technology. I am not sure if JIT is required. There are even ideas to compile Typescript to WebAssembly[4]. You could create a compiler that compile strict subset of JS to more performant Webassembly and it would outperform modern JS engines. [1] https://github.com/facebook/hermes [2] https://v8.dev/docs/ignition [3] https://v8.dev/docs/turbofan [4] https://www.assemblyscript.org/
stefan_ 6y ago
We know. Does Goldman Sachs know? > Building products that put clients first.

stingraycharles 6y ago

What is this jit requirement? I always thought it was about executing custom code that cannot be vetted during the app review process.

hellodanylo 6y ago
I think JIT and custom code is the same requirement in this discussion. In Chrome's case, the V8 engine is a JIT compiler from JS to ARM instructions. The code of V8 can be vetted during the review process, but the ARM instructions that it will generate (just in time) can not. > 3.3.2 An Application may not download or install executable code. Interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded. The only exception to the foregoing is scripts and code downloaded and run by Apple's built-in WebKit framework.
- dunham 6y ago
  Additionally, JIT would need a special entitlement to be able to change a page of memory from writable to executable. This is a little dangerous from a security perspective, and even Apple only grants it to apps the specifically need it.
  - m4rtink 6y ago
    Thats all nice and good, but completely removing the posibility of running any non-vendor JIT application is totally stupid and unacceptable. And iOS being a total walled garden only adds insult to injury, as users simply can't install such applications even if they want to.
  - stingraycharles 6y ago
    Aha so that is what it’s all about. That makes so much more sense now, and a very reasonable explanation. Does this also apply to jailbroken iOS devices? I can imagine that it’s fairly difficult to disable a security feature such as this in the kernel?
    - dunham 6y ago
      I don't know the exact details of how jailbreaking tweaks code-signing. But as I understand it apps are signed and have an entitlements file bundled inside. That file determines whether the kernel will allow stuff like changing pages to executable, running in the background, notifications, etc. Safari happens to have this extra entitlement in its embedded entitlements.plist. The signature checks out, so the the kernel allows the functionality. For example, there is an entitlement to allow a debugger to attach, which dev builds of apps typically have, but Apple won't allow for apps in the store. I would think that if jailbreak short circuited the signature stuff, you could put whatever entitlements you want in there. But there may be some additional constraints. Now that I'm thinking of it, I wonder if dev builds of apps can have the entitlement to do the JIT magic. I don't know if they place any constraints on the dev signing keys.
- stingraycharles 6y ago
  Oh I was confused as I associated a JIT with internal vm optimizations such as seen in the JVM. Then we’re just talking about the same thing but calling it a different name.
kroltan 6y ago
Hmm, you're correct actually. Any downloaded code is prohibited. I thought it was only JIT due to my background with native apps, my bad.

chrisseaton 6y ago

I don’t think JIT is required for JS, that’s just how people choose to implement it.

jandrese 6y ago
I think a JIT compiler is basically required to run Javascript at an acceptable speed on a mobile device. The world has moved on from the time when you could get away with an interpreted Javascript engine.
kroltan 6y ago
Conceptually, yeah, it's not required. But in practice there are a whole lot of websites that make heavy (HEAVY) use of JS, and performance would not be acceptable for a lot of users. I'm not saying those websites are correct in doing that, but in effect browsers are expected to have JIT to maintain any userbase at all, because such websites are so numerous that it would make it seem it is an actual browser "issue" in the eyes of laypeople.
- Chyzwar 6y ago
  Depends. Hermes[1] JS engine from Facebook do not have JIT and provide better perf for React Native. Modern V8 have both interpreter Ignition[2] and TurboFan[3] JITed compiler. My understanding is that on most websites Ignition will be sufficient but when using omething like SPA application TurboFan will gradually speedup bytecode generated by Ignition using JIT like technology. I am not sure if JIT is required. There are even ideas to compile Typescript to WebAssembly[4]. You could create a compiler that compile strict subset of JS to more performant Webassembly and it would outperform modern JS engines. [1] https://github.com/facebook/hermes [2] https://v8.dev/docs/ignition [3] https://v8.dev/docs/turbofan [4] https://www.assemblyscript.org/

stefan_ 6y ago

We know. Does Goldman Sachs know? > Building products that put clients first.