Hacker News Reader

Comment by fathyb | Hacker News Reader

Agreed that the problem here is Firefox, untrusted JS code should not cause a crash.

For the probing, according to the code:

    // Can't push large frames blindly on windows, so we must touch frame memory
    // incrementally, with no more than 4096 - 1 bytes between touches.
    //
    // This is used across all platforms for simplicity.

https://searchfox.org/mozilla-central/rev/c936f47f3a629ae49a...

View on HN

Technically of course Firefox failed to live with an old kernel and insane JS code.

Morally it's Google. Google is like Bitcoin. A huge natural ressource hog for a questionable benefit. Here the benefit is tracking users to make advertising billions. For that goal a billion of smart phones need several extra GB of memory an significantly larger batteries. What is the ecological footprint of that?

Typing on a seven year old smart phone with 2 GB (SailfishOS, so yes it is maintained. Maybe not perfectly, but better than many Androids half as old). It works quite well on reasonable pages even without add blocking. Of course super heavy pages won't work and for Google search I haven't even consented. Occasionally I get reminded of that when some site embeds it. Well, a good reminder for me not to use them.

This does not appear that crazy to me. In fact, today it's almost a recommended practice for large web applications and it's called "tree shaking". ECMAScript modules are inlined into the same scope. It makes the JIT work easier because it now works with symbols instead of `require(foo).bar` calls to speculate on. It makes most web apps run better, both in bandwidth and compute.

It's very likely to have affected users on other websites, but Google is a common denominator for debugging.

My uneducated guess: they're using the Google Closure Compiler to make smaller JavaScript bundles. It saves some bandwidth and allows for better optimizations. It seems like a reasonable engineering decision to ensure product decisions don't affect the user experience too negatively, something a lot of us are familiar with..

Right, optimization is good.

But first building insanely heavy functionality and then optimizing it is not sustainable approach.

The background is of course that increasingly heavy function is moved into the client. Technically and especially economically this makes sense for Google. But the environmental footprint is outsourced to client devices. Greenwashing in a way. Avoidance of computing is a better solution than all types of optimizations. Not everything that is technically feasible is good for the planet and mankind.

> In fact, today it's almost a recommended practice for large web applications and it's called "tree shaking". ECMAScript modules are inlined into the same scope. It makes the JIT work easier because it now works with symbols instead of `require(foo).bar` calls to speculate on. It makes most web apps run better, both in bandwidth and compute.

That's bundling, not tree shaking. Tree shaking is an optional additional process during bundling where unreachable code is automatically removed.

Bundling does not inline all symbols into a single scope, tree shaking does. I was one of the people implementing tree shaking in the first Parcel bundler. https://github.com/parcel-bundler/parcel/pull/1135

Scope hoisting is the technique used there (it's in the title of your link) to simplify tree shaking a.k.a dead code elimination. Also yeah it's unlikely to be what's happening in that bug due to Google using Closure compiler.

Nice rant. Absolutely unrelated to the technical article at hand, but nice rant.

Yeah I got that far but then I wasn't sure what exactly that was doing. Normal C++ doesn't directly move stack pointers around and do manual probing, so I was idly wondering whether those calls hid some inline assembly or how they worked.

Edit: Or perhaps that is not the stack of the C++ program but rather than stack of the Javascript program.

It does hide some assembly. Those calls are calling an assembler to generate native code at runtime for JIT compilation. The C++ compiler compiles an assembler, but this assembler runs at runtime. `MacroAssembler` itself is architecture independent, and calls into functions implemented in back-ends such as `MacroAssemblerARM` and `MacroAssemblerX64`.

So the code in this function is not performing the stack-probing, it generates code to perform it instead.

In general, there's no difference between the stack of the C++ program and the stack of the JS program. When SpiderMonkey just-in-time compiles a JS function, the result is native code that creates a stack frame on the same stack as the C++ code that implements SpiderMonkey. JS code and C++ code can be semi-arbitrarily interleaved on the stack: JS calls C++ calls JS calls C++...

The one exception about sharing the same stack is that the first few iterations of a function run in an interpreter implemented in C++, and that interpreter has its own stack that we heap-allocate. This particular bug occurred during the transition from the C++ interpreter to JIT code.

Reply on news.ycombinator.com