Hacker News Reader

Comment by computersuck | Hacker News Reader

Servo uses mozjs which is just rust bindings for SpiderMonkey which is still C++.

All this effort to use rust and yet they would not rewrite the JS engine which is the biggest attack surface for memory vulns.

View on HN

Setting aside the fact that using Rust for a JIT won't help that much - a new JS engine is a huge undertaking, especially if the goal is to compete with V8. They could eventually switch to Boa[1] if they wanted more safety, but it's still ways off and doesn't seem necessary enough just yet

Also, isn't the goal of Servo to effectively compete with CEF first and foremost? Because you don't need memory safety for that really

I referenced Boa without linking, so: https://github.com/boa-dev/boa

Why would it help? Rust doesn’t do anything to make generated assembly code safer.

You don't have to have a JIT to have a JS VM ?

But you would want one to get competitive performance.

One thing at a time, it looks like implementing a rendering engine from scratch is already enough work for 20 years. First make it work, then make it better.

there is active work to make the js engine more pluggable https://github.com/servo/servo/issues/40600 (and safety work)

https://servo.org/blog/2024/04/15/spidermonkey/

https://github.com/servo/servo/wiki/Servo-and-SpiderMonkey-R...

the monthly updates always mention their refactoring work on the script crate

They can always reimplement it later.

Focus on core right now, you can change js engines further down the line if need be.

Reply on news.ycombinator.com