Shumway - Mozilla
mozilla.github.io
mozilla.github.io
1. We haven't implemented some feature well enough. 2. We can't implement a feature in JavaScript/HTML5 and we have to emulate it in a very slow way. In these cases, we can either improve the Web Platform to support these features natively, or work with various game developers to avoid using them.
Actionscript runs in a VM, that's native code. It seems like Mozilla's argument is that the AS VM is buggy and, thus, is/was/could be exploited often, so it's a security liability.
Their solution to this problem (as far as I understood) is to interprete the SWF bytecode using JavaScript/HTML5, because JavaScript runs in a sandbox.
Isn't anyone concerned that this is not the best solution to the problem? What's the difference between bugs in the AS VM and bugs in the JS VM? The JS VM is native code too, I don't see anyone rushing to replace it.
If the JS VM is more mature, then this is just a matter of getting the AS VM to that maturity level. If someone wrote clang while gcc existed for many years, why can't Mozilla focus their efforts on writing a better AS VM, instead of writing an emulation layer?
Given that both AS and JS are ECMAScripts, why can't AS be compiled in a way that allows it to run on the JS VMs?
If the bytecode generated by the AS compiler doesn't match what a JS VM can execute, then, since the AS bytecode will necessarily mimic features available in the language (and the languages are similar), why can't we translate the AS bytecode into JS bytecode?
That's essentially what Shumway does. Unless things have significantly changed over the last year when I last looked at it, Shumway's AVM2 implementation is a JIT that compiles ActionScript to JavaScript (and thereby produces JS bytecode by going through "eval"). The tricky thing is that, because of extra features that ActionScript has that JS doesn't (namespaces, most notably) it has to speculate and recompile as needed to get good performance. So Shumway isn't an ahead-of-time static JIT, but it is a dynamically recompiling JIT.
Also I guess Mozilla would rather trust themselves with security than a third party with a pretty bad track record in that department.
The biggest advantage of Flash is that Flashblock fairly reliably turns it off, so that ads that use Flash for animation don't get a chance to run.
In the absence of Flash, I worry about gobs of marketing JS animating pages with fewer generic ways of turning them off.
I guess you need Flash installed to make Shumway work ?