7 ms·

Duktape is an embeddable JavaScript engine

70 points by EntICOnc 4y ago

steve_taylor 4y ago
I wonder how this compares to QuickJS. https://bellard.org/quickjs/ https://bellard.org/quickjs/
- Andoryuuta 4y ago
  There are some insights/comparisons in speed and memory usage in the Frida 14.0 [0] release notes, when they switched from Duktape to QuickJS. Overall, QuickJS seems to be slightly more performant and requires about a fifth of the memory usage for the runtime. [0]: https://frida.re/news/2020/10/28/frida-14-0-released/ https://frida.re/news/2020/10/28/frida-14-0-released/
  - lioeters 4y ago
    Figma has some articles on their plugin system, for which they considered Duktape, then Realms shim, and finally settled on QuickJS. How to build a plugin system on the web and also sleep well at night - https://www.figma.com/blog/how-we-built-the-figma-plugin-system/ https://www.figma.com/blog/how-we-built-the-figma-plugin-sys... An update on plugin security - https://www.figma.com/blog/an-update-on-plugin-security/ https://www.figma.com/blog/an-update-on-plugin-security/
    - jitl 4y ago
      I’ve open-sourced an implementation of these ideas, see related comment here: https://news.ycombinator.com/item?id=31970198 https://news.ycombinator.com/item?id=31970198
- zzo38computer 4y ago
  Some of the extensions look like good idea, such as extended JSON, and ignoring shebang lines (although I think that they might have wanted to make this standard). It will be useful to have variants of loadFile and some other functions that currently deal only with UTF-8 strings: [1] UTF-8 [2] ISO-8859-1 [3] ArrayBuffer Currently, only urlGet has a variant using ArrayBuffer, although it would be useful to allow that for loadFile too, to avoid having to open and measure and close the file to do it by yourself. Additionally, urlGet lacks some of the options of curl (such as whether or not to follow redirects). Typed arrays may also be necessary for command-line arguments and environment variables and file names in some cases, where they might not be valid UTF-8 (it is not guaranteed that they will be; this depends on the file system in use, though, since some are always Unicode; however, some allow mismatched surrogates so this must also be permitted). (Node.js allows this for file names, but it seems not for command-line arguments and environment variables.) Additionally, the locale might or might not be Unicode, but even if it is, that does not necessarily mean that the other things are. Assuming that everything is UTF-8 is an invalid assumption (it might not even be text in any encoding at all; it might even be null-terminated binary data), and programs that deal with Unicode often incorrectly ignore the locale.
atwood22 4y ago
Having used both QuickJS and Duktape, I have to say that QuickJS is a lot better. Mostly because it's faster and has newer language features. QuickJS has full support for ES2020, whereas Duktape is on ES2015. I guess Duktape is a little smaller, but that's the only advantage I found.
- Rochus 4y ago
  > Duktape is a little smaller, but that's the only advantage I found. It's not actually smaller; Duktape is about 4MB source files while QuickJS is about 2.7 MB. But Duktape has a nice C API similar to Lua. And QuickJS requires a recent C compiler whereas Duktape is happy with C89.
  - deleted 4y ago
    [deleted]
  - atwood22 4y ago
    For some reason I remember the compiled size for Duktape being smaller, but I could be misremembering. It's been a few years since I've used both libraries.
    - melissalobos 4y ago
      > For some reason I remember the compiled size for Duktape being smaller For any C library this is HEAVILY dependent on the compiler, compilation, and linking options used.
    - Rochus 4y ago
      Bellard has an evaluation on his website where the executable size of QuickJS is bigger than Duktape: https://bellard.org/quickjs/bench.html https://bellard.org/quickjs/bench.html. Both were compiler with gcc 4.9.2. I don't know the reason for the difference (both have large unicode tables etc.).
      - mananaysiempre 4y ago
nyanpasu64 4y ago
Polkit recently added Duktape as an alternative to mozjs as a scripting engine for policy rules: https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/97 https://gitlab.freedesktop.org/polkit/polkit/-/merge_request... It's scary to think that Poettering's Linux desktop is built around SpiderMonkey serving as the gatekeeper between users and root.
- intrepidhero 4y ago
  I saw that recently and it gave me pause. An entire scripting engine (and JS of all things?) For permission queries. That's a lot of rope for hanging yourself in a variety of ways when all you're doing is encoding a two dimensional table of users and permissions. Fortunately Debian's conservatism has kept them on policykit, which avoids this nonsense.
jitl 4y ago
Tangentially related: I maintain a library for using QuickJS, a JS interpreter with more modern language support, from NodeJS or the web called QuickJS-Emscripten: https://github.com/justjake/quickjs-emscripten https://github.com/justjake/quickjs-emscripten This was inspired by seeing Duktape WASM build on HN (https://github.com/maple3142/duktape-eval https://github.com/maple3142/duktape-eval) and Figma's blogposts about building a Javascript plugin runtime: - How Figma built the Figma plugin system: Describes the LowLevelJavascriptVm interface (https://www.figma.com/blog/how-we-built-the-figma-plugin-system/ https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...) - An update on plugin security: Figma switches to QuickJS (https://www.figma.com/blog/an-update-on-plugin-security/ https://www.figma.com/blog/an-update-on-plugin-security/)
achalkley 4y ago
I'm in the middle of making a Host JavaScript environment for M4 microcontrollers using duktape as the JavaScript interpreter. The microcontroller mounts as a flash drive and you can save your JS to the board directly.

70 points by EntICOnc 4y ago

steve_taylor 4y ago

I wonder how this compares to QuickJS. https://bellard.org/quickjs/ https://bellard.org/quickjs/

Andoryuuta 4y ago
There are some insights/comparisons in speed and memory usage in the Frida 14.0 [0] release notes, when they switched from Duktape to QuickJS. Overall, QuickJS seems to be slightly more performant and requires about a fifth of the memory usage for the runtime. [0]: https://frida.re/news/2020/10/28/frida-14-0-released/ https://frida.re/news/2020/10/28/frida-14-0-released/
- lioeters 4y ago
  Figma has some articles on their plugin system, for which they considered Duktape, then Realms shim, and finally settled on QuickJS. How to build a plugin system on the web and also sleep well at night - https://www.figma.com/blog/how-we-built-the-figma-plugin-system/ https://www.figma.com/blog/how-we-built-the-figma-plugin-sys... An update on plugin security - https://www.figma.com/blog/an-update-on-plugin-security/ https://www.figma.com/blog/an-update-on-plugin-security/
  - jitl 4y ago
    I’ve open-sourced an implementation of these ideas, see related comment here: https://news.ycombinator.com/item?id=31970198 https://news.ycombinator.com/item?id=31970198
zzo38computer 4y ago
Some of the extensions look like good idea, such as extended JSON, and ignoring shebang lines (although I think that they might have wanted to make this standard). It will be useful to have variants of loadFile and some other functions that currently deal only with UTF-8 strings: [1] UTF-8 [2] ISO-8859-1 [3] ArrayBuffer Currently, only urlGet has a variant using ArrayBuffer, although it would be useful to allow that for loadFile too, to avoid having to open and measure and close the file to do it by yourself. Additionally, urlGet lacks some of the options of curl (such as whether or not to follow redirects). Typed arrays may also be necessary for command-line arguments and environment variables and file names in some cases, where they might not be valid UTF-8 (it is not guaranteed that they will be; this depends on the file system in use, though, since some are always Unicode; however, some allow mismatched surrogates so this must also be permitted). (Node.js allows this for file names, but it seems not for command-line arguments and environment variables.) Additionally, the locale might or might not be Unicode, but even if it is, that does not necessarily mean that the other things are. Assuming that everything is UTF-8 is an invalid assumption (it might not even be text in any encoding at all; it might even be null-terminated binary data), and programs that deal with Unicode often incorrectly ignore the locale.

atwood22 4y ago

Having used both QuickJS and Duktape, I have to say that QuickJS is a lot better. Mostly because it's faster and has newer language features. QuickJS has full support for ES2020, whereas Duktape is on ES2015. I guess Duktape is a little smaller, but that's the only advantage I found.

Rochus 4y ago
> Duktape is a little smaller, but that's the only advantage I found. It's not actually smaller; Duktape is about 4MB source files while QuickJS is about 2.7 MB. But Duktape has a nice C API similar to Lua. And QuickJS requires a recent C compiler whereas Duktape is happy with C89.
- deleted 4y ago
  [deleted]
- atwood22 4y ago
  For some reason I remember the compiled size for Duktape being smaller, but I could be misremembering. It's been a few years since I've used both libraries.
  - melissalobos 4y ago
    > For some reason I remember the compiled size for Duktape being smaller For any C library this is HEAVILY dependent on the compiler, compilation, and linking options used.
  - Rochus 4y ago
    Bellard has an evaluation on his website where the executable size of QuickJS is bigger than Duktape: https://bellard.org/quickjs/bench.html https://bellard.org/quickjs/bench.html. Both were compiler with gcc 4.9.2. I don't know the reason for the difference (both have large unicode tables etc.).
    - mananaysiempre 4y ago

nyanpasu64 4y ago

Polkit recently added Duktape as an alternative to mozjs as a scripting engine for policy rules: https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/97 https://gitlab.freedesktop.org/polkit/polkit/-/merge_request... It's scary to think that Poettering's Linux desktop is built around SpiderMonkey serving as the gatekeeper between users and root.

intrepidhero 4y ago
I saw that recently and it gave me pause. An entire scripting engine (and JS of all things?) For permission queries. That's a lot of rope for hanging yourself in a variety of ways when all you're doing is encoding a two dimensional table of users and permissions. Fortunately Debian's conservatism has kept them on policykit, which avoids this nonsense.

jitl 4y ago

Tangentially related: I maintain a library for using QuickJS, a JS interpreter with more modern language support, from NodeJS or the web called QuickJS-Emscripten: https://github.com/justjake/quickjs-emscripten https://github.com/justjake/quickjs-emscripten This was inspired by seeing Duktape WASM build on HN (https://github.com/maple3142/duktape-eval https://github.com/maple3142/duktape-eval) and Figma's blogposts about building a Javascript plugin runtime: - How Figma built the Figma plugin system: Describes the LowLevelJavascriptVm interface (https://www.figma.com/blog/how-we-built-the-figma-plugin-system/ https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...) - An update on plugin security: Figma switches to QuickJS (https://www.figma.com/blog/an-update-on-plugin-security/ https://www.figma.com/blog/an-update-on-plugin-security/)

achalkley 4y ago

I'm in the middle of making a Host JavaScript environment for M4 microcontrollers using duktape as the JavaScript interpreter. The microcontroller mounts as a flash drive and you can save your JS to the board directly.