J
Jan de Mooij
jandemooij.nl · Personal blog · on HN since 2014
Jan de Mooij is a Mozilla engineer who writes about SpiderMonkey, JIT compilation, and JavaScript engine internals.
What HN saysCommenters cite his posts on Math.random() precision and W^X JIT code in Firefox. They treat him as a reliable source on browser engine changes.
17HN people shared it
11linked it in comments
12stories submitted
356story points
3 years agolast shared
2014people per year2026
Most-shared posts
- 1W^X JIT-code enabled in Firefox5 people · 8 points · first shared 2015 · discussion on HN
- 2Some SpiderMonkey Optimizations in Firefox Quantum3 people · 212 points · first shared 2017 · 5 comments on HN
- 3Math.random() and 32-bit precision3 people · 32 points · first shared 2015 · 1 comments on HN
- 4Testing Math.random(): Crushing the browser2 people · 38 points · first shared 2015 · 2 comments on HN
- 5Wx jit code enabled in firefox2 people · first shared 2021
- 6Math random and 32 bit precision2 people · first shared 2023
- 7Using Rust to generate Mercurial short-hash collisions1 people · 32 points · first shared 2015 · 3 comments on HN
- 8Fast arrow functions in Firefox 311 people · 22 points · first shared 2014 · 8 comments on HN
- 9CacheIR: A New Approach to Inline Caching in Firefox1 people · 6 points · first shared 2017 · discussion on HN
- 10Using segfaults to interrupt jit code1 people · 4 points · first shared 2014 · discussion on HN
- 11Making `this` a real binding in SpiderMonkey1 people · 2 points · first shared 2015 · discussion on HN
What HN people wrote when they linked it
masklinn · 2023-08-20
After the linked article as well as https://jandemooij.nl/blog/math-random-and-32-bit-precision/ which follows from it, the main three browsers (Chrome[0], Firefox[1], Safari[2]) actually switched to Xorshift128+. So these days Math.random is nowhere near as horrifying as it was back then, however it's still not a system or a userland CSPRNG, for that you need `crypto.getRandomValues()` (https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValue…
[0] https://v8.dev/blog/math-random
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=322529#c99
[2] https://bugs.webkit.org/show_bug.cgi?id=151641
moritzwarhier · 2023-08-20
Interesting to revisit.
Have there been more changes to Math.random() since 2015 when this bug was fixed?
https://jandemooij.nl/blog/math-random-and-32-bit-precision/
https://trac.webkit.org/changeset/192855/webkit
This StackExchange answer provides a good writeup, especially about some added requirements for Math.random() from ES6:
https://security.stackexchange.com/questions/84906/predicting-math-ran…
Are the 3 major browsers still all using xorshift128?
I don't have the capacity to quickly figure this out from public source code.
ievans · 2022-09-14
Thanks for the correction; my knowledge is a bit out of date, Firefox at least (not sure about Safari) switched to W^X JIT a good while back: https://jandemooij.nl/blog/wx-jit-code-enabled-in-firefox/. That's cool.
W^X is more difficult to exploit for sure, but as other commenters point out, unfortunately still possible.
floatboth · 2021-05-24
> [mapping memory WX] hasn't been forbidden on any of the prior platforms that Dolphin supports
Well, rarely completely forbidden, but e.g. I think OpenBSD has been W^X by default for quite some time (though IIRC with a WX allowed flag per… FS mount?). Now on FreeBSD it's not default but it's there, and if you turn it on, you have to mark WX-mapping binaries by running `elfctl -e +wxneeded`.
Firefox actually became W^X compliant all the way back in 2015: https://jandemooij.nl/blog/wx-jit-code-enabled-in-firefox/
ghj · 2020-08-11
I highly doubt js engines would compile a string down to a linked list. But you're right they might compile it to a circular buffer or deque which can have O(1) prepends.
Quick googling shows that this optimization might exist but only for firefox and only if you use "unshift":
https://lannonbr.com/blog/2020-01-27-shift-optimizations
https://jandemooij.nl/blog/2017/12/06/some-spidermonkey-optimizations-…
But it's very unlikely that the jit can optimize `str = ch + str;`
azdle · 2017-12-16
Mozilla people have been working on SpiderMonkey performance already: https://jandemooij.nl/blog/2017/12/06/some-spidermonkey-optimizations-… it's just not some wholesale replacement, so it probably never makes the top of the list for what they shout about. It also sounds like it has been a steady progression rather than a big jump, so maybe not quite as noticeable.
csirac2 · 2016-05-29
FWIW Firefox manages to use W^X in their JIT (the experimental patch back in 2011 had a very interesting idea: one process w writing out to memory mapped RW, another process with the same mapped executable): http://jandemooij.nl/blog/2015/12/29/wx-jit-code-enabled-in-firefox/
dchest · 2016-05-27
Firefox works fine with it: http://jandemooij.nl/blog/2015/12/29/wx-jit-code-enabled-in-firefox/
After that, the performance overhead was pretty small on all benchmarks and websites I tested: Kraken and Octane are less than 1% slower with W^X enabled. On (ancient) SunSpider the overhead is bigger, because most tests finish in a few milliseconds, so any compile-time overhead is measurable. Still, it's less than 3% on Windows and Linux. On OS X it's less than 4% because mprotect is slower there.
kpcyrd · 2016-04-11
In other news, the next firefox release is going to have W^X
https://www.mozilla.org/en-US/firefox/46.0beta/releasenotes/
http://jandemooij.nl/blog/2015/12/29/wx-jit-code-enabled-in-firefox/
ahoge · 2015-12-17
Those lines are showing up because the old algorithm can't produce all possible values in the 0-1 range. 32 bits of internal state simply aren't enough for that.
The problem is highlighted by the images in this article:
http://jandemooij.nl/blog/2015/11/27/math-random-and-32-bit-precision/
evilpie · 2015-12-17
Jan also wrote about this http://jandemooij.nl/blog/2015/11/27/math-random-and-32-bit-precision/ in the context of Spidermonkey.