3 ms·

Servo uses mozjs which is just rust bindings for SpiderMonkey which is still C++. All this effort to use rust and yet they would not rewrite the JS engine whic

Servo uses mozjs which is just rust bindings for SpiderMonkey which is still C++. All this effort to use rust and yet they would not rewrite the JS engine which is the biggest attack surface for memory vulns.

skybrian 18d ago
Why would it help? Rust doesn’t do anything to make generated assembly code safer.
- rafaelmn 18d ago
  You don't have to have a JIT to have a JS VM ?
  - skybrian 18d ago
    But you would want one to get competitive performance.
chiffaa 18d ago
Setting aside the fact that using Rust for a JIT won't help that much - a new JS engine is a huge undertaking, especially if the goal is to compete with V8. They could eventually switch to Boa[1] if they wanted more safety, but it's still ways off and doesn't seem necessary enough just yet Also, isn't the goal of Servo to effectively compete with CEF first and foremost? Because you don't need memory safety for that really
- chiffaa 17d ago
  I referenced Boa without linking, so: https://github.com/boa-dev/boa https://github.com/boa-dev/boa
alex_duf 17d ago
One thing at a time, it looks like implementing a rendering engine from scratch is already enough work for 20 years. First make it work, then make it better.
unionpivo 17d ago
They can always reimplement it later. Focus on core right now, you can change js engines further down the line if need be.
throawayonthe 17d ago
there is active work to make the js engine more pluggable https://github.com/servo/servo/issues/40600 https://github.com/servo/servo/issues/40600 (and safety work) https://servo.org/blog/2024/04/15/spidermonkey/ https://servo.org/blog/2024/04/15/spidermonkey/ https://github.com/servo/servo/wiki/Servo-and-SpiderMonkey-Report https://github.com/servo/servo/wiki/Servo-and-SpiderMonkey-R... the monthly updates always mention their refactoring work on the script crate

3 ms·

Servo uses mozjs which is just rust bindings for SpiderMonkey which is still C++. All this effort to use rust and yet they would not rewrite the JS engine whic

by computersuck 18d ago

skybrian 18d ago
Why would it help? Rust doesn’t do anything to make generated assembly code safer.
- rafaelmn 18d ago
  You don't have to have a JIT to have a JS VM ?
  - skybrian 18d ago
    But you would want one to get competitive performance.
chiffaa 18d ago
Setting aside the fact that using Rust for a JIT won't help that much - a new JS engine is a huge undertaking, especially if the goal is to compete with V8. They could eventually switch to Boa[1] if they wanted more safety, but it's still ways off and doesn't seem necessary enough just yet Also, isn't the goal of Servo to effectively compete with CEF first and foremost? Because you don't need memory safety for that really
- chiffaa 17d ago
  I referenced Boa without linking, so: https://github.com/boa-dev/boa https://github.com/boa-dev/boa
alex_duf 17d ago
One thing at a time, it looks like implementing a rendering engine from scratch is already enough work for 20 years. First make it work, then make it better.
unionpivo 17d ago
They can always reimplement it later. Focus on core right now, you can change js engines further down the line if need be.
throawayonthe 17d ago
there is active work to make the js engine more pluggable https://github.com/servo/servo/issues/40600 https://github.com/servo/servo/issues/40600 (and safety work) https://servo.org/blog/2024/04/15/spidermonkey/ https://servo.org/blog/2024/04/15/spidermonkey/ https://github.com/servo/servo/wiki/Servo-and-SpiderMonkey-Report https://github.com/servo/servo/wiki/Servo-and-SpiderMonkey-R... the monthly updates always mention their refactoring work on the script crate