7 ms·

JavaScript in JavaScript (js.js): smaller, faster, and with demos

174 points by jterrace 14y ago

RobertKohr 14y ago
Javascript sandbox for node.js: https://github.com/gf3/sandbox https://github.com/gf3/sandbox It allows you to run potentially malicious js code on the server.
FrancescoRizzi 14y ago
[Mandatory Xzibit meme comment.] but really... I'm still digesting the idea of js.js.
pizza 14y ago
Just a heads up, OP; I thought the title implied that js.js was somehow faster than javascript.
- jterrace 14y ago
  Hah, that's definitely not what I meant. It was in reference to the previous time js.js was (prematurely) posted to hacker news
- danbmil99 14y ago
  That would really be like Inception, where somehow embedded processes keep getting faster and faster instead of slower.
  - rplnt 14y ago
    The pypy is faster than cpython (the default, official implementation of Python) despite being written in Python. It is not running in cpython or pypy enviroment though. It can, but it is really slow then. It's translated to C I think, using Python again, then compiled. I might be wrong. It is a very confusing project. PS: Some "Python" in above sentences might actually be rpython. But as it is subset of python it probably doesn't matter.
    - mattdeboard 14y ago
      > The pypy is faster than cpython (the default, official implementation of Python) despite being written in Python This is far overreaching and as such very wrong. Also, "x language is faster than y language" is a meaningless comparison. Faster at what? In what cases? Pypy does some things faster than Cpython in some cases. >PS: Some "Python" in above sentences might actually be rpython. But as it is subset of python it probably doesn't matter. I don't know for sure that this is wrong, but it sure seems to be.
      - rplnt 14y ago
        Well, faster or equal, eventually in everything. Anything that pypy does slower than cpython is considered a bug as far as a I know. But I was not making a definitive academic statement or anything, just saying that it is, in general, faster. After all, it is faster in mother of all benchmarks, the fib function :) (edit: on my computer) As for the PS; RPython is statically typed Python (perhaps some other extra restrictions apply). Not type-annotated or anything, just pure python written in a certain way. So it is a subset. As for what "Python" should have been "RPython", it was the first one. The pypy interpreter is written in RPython. But my statement was still correct because RPython is Python.
  - Flow 14y ago
    I once read an article about HP making an interpreter of PA-RISC running on a PA-RISC CPU that was faster than the real thing. IIRC it was due to better cache locality.
- grogs 14y ago
  Same. Could not believe it, reread until I saw the all important colon.
greggman 14y ago
There's also caja (http://code.google.com/p/google-caja/ http://code.google.com/p/google-caja/) which goes about solving the problem in a slightly different way
- jterrace 14y ago
  There's narcissus too (https://github.com/mozilla/narcissus https://github.com/mozilla/narcissus)
GoodIntentions 14y ago
Smaller and faster is great, but does it have semi colons? I hear they're out of fashion.. Edit: posted this 4 minutes ago and already got 4 downvotes. Some of you guys really care about this don't you? Carry on, not like I was gonna save up karma for a free plane ticket or something :P
- Androsynth 14y ago
  that joke got old fast
  - ascendant 14y ago
    My first thought was a "yo dawg, I heard you like javascript" joke.
DHowett 14y ago
Somebody needs to get this set up with The Ruby Racer[0], and run a JavaScript JavaScript implementation in a Ruby JavaScript bridge. [0]: https://github.com/cowboyd/therubyracer https://github.com/cowboyd/therubyracer
- bri3d 14y ago
  Even more evil would be to use JRuby and TheRubyRhino: run a JavaScript JavaScript implementation in a Java JavaScript implementation bridged to a Java Ruby implementation! To boot, the Rhino approach is probably a lot slower, since TheRubyRacer uses libv8.
  - DHowett 14y ago
    You could probably get a hilarious optimization out of it[0] by using gcj to compile the set of classes that JRuby generates into a native binary. Or, you know, use dx and transcompile it to Dalvik bytecode. [0]: Unfortunately, JRuby gives gcj/gij a hard time - gcj hits an internal error and gij makes it report that gij is unsupported. :(
kibwen 14y ago
Very cool that they managed to get SpiderMonkey working through Emscripten. But I wonder if they could have just used Narcissus[1] instead and saved themselves some time. [1] http://en.wikipedia.org/wiki/Narcissus_%28JavaScript_engine%29 http://en.wikipedia.org/wiki/Narcissus_%28JavaScript_engine%...
- eagsalazar 14y ago
  Narcissus only runs on spidermonkey because it uses nonstandard spidermonkey extensions to work. Unless I'm misunderstanding the implications of the first paragraph in the link you provided. The very awesome twitter demo on the js.js site is one example of something you could no way do with narcissus except as a proof of concept in FF.
deleted 14y ago
[deleted]
DHowett 14y ago
The js.js Fibonacci Demo exhibits some weird characteristics versus the native implementation. Native result for iteration NaN: 1 js.js result for iteration NaN: 0 Native result for iteration 46: 1836311903 js.js result for iteration 46: 1836311903 Native result for iteration 47: 2971215073 js.js result for iteration 47: -1675624448
- jterrace 14y ago
  This is because I'm converting to an i32 rather than a double. It should be able to be fixed relatively easily.
lordlicorice 14y ago
What was the point of all of this? Why not just contribute sandboxing functionality to JavaScript itself? With a 200x slowdown, js.js is a total waste of time.
- kleiba 14y ago
  Some people's waste of time is other people's joy! If they just do it for the hack value, that's totally fine for me.
- eagsalazar 14y ago
  JS is very fast these days on all the modern browsers including ie9. There is plenty you could do. However if you really want speed I wonder if you could bridge access to certain useful functions by delegating access to, for example, sandboxedAnimate = function (sel, attr, duration, easing) {} in a closure. If you want to allow plugins on your site for example, 200X for basic stuff and full speed for jquery animations, etc would be more than enough 99.9% of the time. Also if you use CSS animations where there would be zero slowdown. So make that plenty fast 99.99% of the time.
  - eagsalazar 14y ago
    Yeah, providing sandboxed and controlled access to certain areas of the dom and certain functions is exactly what they appear to be doing in their TW example. However, that tiny demo looks like it takes up 800 lines of code! WTF?
    - jterrace 14y ago
      Yeah, I'm in no way proud of that beast of a code. There are a couple things at play here: 1. The js.js API is currently very low-level, which makes it verbose and difficult to use. There's a lot of room for improvement. 2. The twitter script was actually chosen because it's complex. It has a ton of boilerplate code that you'd probably be surprised is in there. 3. A lot of the code written could be generalized into a generic virtual DOM interface library that is not specific to this twitter script. Things like screen.width and screen.height are common properties that would be accessed by many different scripts and so could be generalized.
badusername 14y ago
Can someone explain a few use cases for this library, and the capabilities it brings?
- jterrace 14y ago
  The sandboxing of third-party scripts that we talk about in the paper (http://www.cs.princeton.edu/~jterrace/docs/jsjs.pdf http://www.cs.princeton.edu/~jterrace/docs/jsjs.pdf) is one possible use case
wyck 14y ago
should have been named inception.js
luser001 14y ago
Interesting project. As an aside, Tcl has had the ability to create sandboxed sub-interpreters whose calls can be intercepted for a long time now. http://www.tcl.tk/man/tcl8.5/TclCmd/interp.htm http://www.tcl.tk/man/tcl8.5/TclCmd/interp.htm Note that this is different from Python's Process module. There is no new process or even thread. Everything happens within one process.
- eiji 14y ago
  I believe this effort came about primarily to provide a safe interp for the Tcl plugin: http://www.tcl.tk/software/plugin/ http://www.tcl.tk/software/plugin/ http://www.tcl.tk/software/plugin/safetcl.html http://www.tcl.tk/software/plugin/safetcl.html
kstrauser 14y ago
It needs to run on PyPy for completeness.
6ren 14y ago
Could a tracing JIT compiler optimize even this case, of a main loop thousands of lines long? I get the impression they've fallen from favour, but optimizing code regardless of how it's arranged in methods, seems a better, more general approach.
kwamenum86 14y ago
Kudos. This is very impressive. However, I think iframes + postMessage + xframe DOM/BOM abstraction is the more clean, reliable, usable, etc. way to go. Or defining a sandbox API for browsers that doesn't require iframes. But this could even be a nice first step towards that sandbox API.

174 points by jterrace 14y ago

Javascript sandbox for node.js: https://github.com/gf3/sandbox https://github.com/gf3/sandbox It allows you to run potentially malicious js code on the server.

FrancescoRizzi 14y ago

[Mandatory Xzibit meme comment.] but really... I'm still digesting the idea of js.js.

pizza 14y ago

Just a heads up, OP; I thought the title implied that js.js was somehow faster than javascript.

jterrace 14y ago
Hah, that's definitely not what I meant. It was in reference to the previous time js.js was (prematurely) posted to hacker news
danbmil99 14y ago
That would really be like Inception, where somehow embedded processes keep getting faster and faster instead of slower.
- rplnt 14y ago
  The pypy is faster than cpython (the default, official implementation of Python) despite being written in Python. It is not running in cpython or pypy enviroment though. It can, but it is really slow then. It's translated to C I think, using Python again, then compiled. I might be wrong. It is a very confusing project. PS: Some "Python" in above sentences might actually be rpython. But as it is subset of python it probably doesn't matter.
  - mattdeboard 14y ago
    > The pypy is faster than cpython (the default, official implementation of Python) despite being written in Python This is far overreaching and as such very wrong. Also, "x language is faster than y language" is a meaningless comparison. Faster at what? In what cases? Pypy does some things faster than Cpython in some cases. >PS: Some "Python" in above sentences might actually be rpython. But as it is subset of python it probably doesn't matter. I don't know for sure that this is wrong, but it sure seems to be.
    - rplnt 14y ago
      Well, faster or equal, eventually in everything. Anything that pypy does slower than cpython is considered a bug as far as a I know. But I was not making a definitive academic statement or anything, just saying that it is, in general, faster. After all, it is faster in mother of all benchmarks, the fib function :) (edit: on my computer) As for the PS; RPython is statically typed Python (perhaps some other extra restrictions apply). Not type-annotated or anything, just pure python written in a certain way. So it is a subset. As for what "Python" should have been "RPython", it was the first one. The pypy interpreter is written in RPython. But my statement was still correct because RPython is Python.
- Flow 14y ago
  I once read an article about HP making an interpreter of PA-RISC running on a PA-RISC CPU that was faster than the real thing. IIRC it was due to better cache locality.
grogs 14y ago
Same. Could not believe it, reread until I saw the all important colon.

greggman 14y ago

There's also caja (http://code.google.com/p/google-caja/ http://code.google.com/p/google-caja/) which goes about solving the problem in a slightly different way

jterrace 14y ago
There's narcissus too (https://github.com/mozilla/narcissus https://github.com/mozilla/narcissus)

GoodIntentions 14y ago

Smaller and faster is great, but does it have semi colons? I hear they're out of fashion.. Edit: posted this 4 minutes ago and already got 4 downvotes. Some of you guys really care about this don't you? Carry on, not like I was gonna save up karma for a free plane ticket or something :P

Androsynth 14y ago
that joke got old fast
- ascendant 14y ago
  My first thought was a "yo dawg, I heard you like javascript" joke.

DHowett 14y ago

Somebody needs to get this set up with The Ruby Racer[0], and run a JavaScript JavaScript implementation in a Ruby JavaScript bridge. [0]: https://github.com/cowboyd/therubyracer https://github.com/cowboyd/therubyracer

bri3d 14y ago
Even more evil would be to use JRuby and TheRubyRhino: run a JavaScript JavaScript implementation in a Java JavaScript implementation bridged to a Java Ruby implementation! To boot, the Rhino approach is probably a lot slower, since TheRubyRacer uses libv8.
- DHowett 14y ago
  You could probably get a hilarious optimization out of it[0] by using gcj to compile the set of classes that JRuby generates into a native binary. Or, you know, use dx and transcompile it to Dalvik bytecode. [0]: Unfortunately, JRuby gives gcj/gij a hard time - gcj hits an internal error and gij makes it report that gij is unsupported. :(

kibwen 14y ago

Very cool that they managed to get SpiderMonkey working through Emscripten. But I wonder if they could have just used Narcissus[1] instead and saved themselves some time. [1] http://en.wikipedia.org/wiki/Narcissus_%28JavaScript_engine%29 http://en.wikipedia.org/wiki/Narcissus_%28JavaScript_engine%...

eagsalazar 14y ago
Narcissus only runs on spidermonkey because it uses nonstandard spidermonkey extensions to work. Unless I'm misunderstanding the implications of the first paragraph in the link you provided. The very awesome twitter demo on the js.js site is one example of something you could no way do with narcissus except as a proof of concept in FF.

deleted 14y ago

[deleted]

DHowett 14y ago

The js.js Fibonacci Demo exhibits some weird characteristics versus the native implementation. Native result for iteration NaN: 1 js.js result for iteration NaN: 0 Native result for iteration 46: 1836311903 js.js result for iteration 46: 1836311903 Native result for iteration 47: 2971215073 js.js result for iteration 47: -1675624448

jterrace 14y ago
This is because I'm converting to an i32 rather than a double. It should be able to be fixed relatively easily.

lordlicorice 14y ago

What was the point of all of this? Why not just contribute sandboxing functionality to JavaScript itself? With a 200x slowdown, js.js is a total waste of time.

kleiba 14y ago
Some people's waste of time is other people's joy! If they just do it for the hack value, that's totally fine for me.
eagsalazar 14y ago
JS is very fast these days on all the modern browsers including ie9. There is plenty you could do. However if you really want speed I wonder if you could bridge access to certain useful functions by delegating access to, for example, sandboxedAnimate = function (sel, attr, duration, easing) {} in a closure. If you want to allow plugins on your site for example, 200X for basic stuff and full speed for jquery animations, etc would be more than enough 99.9% of the time. Also if you use CSS animations where there would be zero slowdown. So make that plenty fast 99.99% of the time.
- eagsalazar 14y ago
  Yeah, providing sandboxed and controlled access to certain areas of the dom and certain functions is exactly what they appear to be doing in their TW example. However, that tiny demo looks like it takes up 800 lines of code! WTF?
  - jterrace 14y ago
    Yeah, I'm in no way proud of that beast of a code. There are a couple things at play here: 1. The js.js API is currently very low-level, which makes it verbose and difficult to use. There's a lot of room for improvement. 2. The twitter script was actually chosen because it's complex. It has a ton of boilerplate code that you'd probably be surprised is in there. 3. A lot of the code written could be generalized into a generic virtual DOM interface library that is not specific to this twitter script. Things like screen.width and screen.height are common properties that would be accessed by many different scripts and so could be generalized.

badusername 14y ago

Can someone explain a few use cases for this library, and the capabilities it brings?

jterrace 14y ago
The sandboxing of third-party scripts that we talk about in the paper (http://www.cs.princeton.edu/~jterrace/docs/jsjs.pdf http://www.cs.princeton.edu/~jterrace/docs/jsjs.pdf) is one possible use case

wyck 14y ago

should have been named inception.js

luser001 14y ago

Interesting project. As an aside, Tcl has had the ability to create sandboxed sub-interpreters whose calls can be intercepted for a long time now. http://www.tcl.tk/man/tcl8.5/TclCmd/interp.htm http://www.tcl.tk/man/tcl8.5/TclCmd/interp.htm Note that this is different from Python's Process module. There is no new process or even thread. Everything happens within one process.

eiji 14y ago
I believe this effort came about primarily to provide a safe interp for the Tcl plugin: http://www.tcl.tk/software/plugin/ http://www.tcl.tk/software/plugin/ http://www.tcl.tk/software/plugin/safetcl.html http://www.tcl.tk/software/plugin/safetcl.html

kstrauser 14y ago

It needs to run on PyPy for completeness.

6ren 14y ago

Could a tracing JIT compiler optimize even this case, of a main loop thousands of lines long? I get the impression they've fallen from favour, but optimizing code regardless of how it's arranged in methods, seems a better, more general approach.

kwamenum86 14y ago

Kudos. This is very impressive. However, I think iframes + postMessage + xframe DOM/BOM abstraction is the more clean, reliable, usable, etc. way to go. Or defining a sandbox API for browsers that doesn't require iframes. But this could even be a nice first step towards that sandbox API.