We have a bounty program. If you can find security bugs in Firefox, please let us pay you for them. You don't need to provide a fix; a testcase that crashes in an interesting way is often enough to qualify.…
I never got direct access to Mythos, so all I know is what I've seen from the quality of the bugs being produced. I also haven't been involved at the prompting end. So the best answer I can give is: I dunno, maybe it's…
If I had to guess, I'd say that AI is better at finding TOCTOU bugs than fuzzing because it starts by looking at the code and trying to find problems with it, which naturally leads it to experiment with questions like…
The same is also true of a good security researcher, and has been for a long time. The question is mostly whether it takes long enough to come up with a testcase that we've managed to ship the fix to all affected…
I work on SpiderMonkey, so I mostly looked at the JS bugs. It was a smorgasbord of various things. Broadly speaking I'd say the most impressive bugs were TOCTOU issues, where we checked something and later acted on it,…
Yeah, fuzzing, sanitizers, and bug bounties were our main pre-AI tools for finding bugs.
I work at Mozilla; I fixed a bunch of these bugs. In general, I would say that our use of "vulnerability" lines up with what jerrythegerbil calls "potential vulnerability". (In cases with a POC, we would likely use the…
One clear use case for GC in Rust is for implementing other languages (eg writing a JS engine). When people ask why SpiderMonkey hasn't been rewritten in Rust, one of the main technical blockers I generally bring up is…
I don't know how JSC handles it, but in SM `eval` has significant negative effects on surrounding code. (We also decline to optimize functions containing `with` statements, but that's less because it's impossible and…
This isn't about languages; it's about hardware. Should hardware be "higher-level" to support higher level languages? The author says no (and I am inclined to agree with him).
This doesn't read as AI-generated to me at all. The prose isn't polished enough to be AI. AI generation is unlikely to produce missing spaces like "...which are not readable to humans.SDB uses eBPF ...", or grammatical…
Copy and paste all four lines at once.
Taking a quick look at the JSC code, the main difference is that CacheIR is more pervasive and load-bearing. Even monomorphic cases go through CacheIR. The main justification for CacheIR isn't that it enables us to do…
asm.js solves this in the specific case where somebody has compiled their C/C++ code to target asm.js. It doesn't solve it for arbitrary JS code. asm.js is more like a weird frontend to wasm than a dialect of JS.
The main thing we're doing differently in SM is that all of our ICs are generated using a simple linear IR (CacheIR), instead of generating machine code directly. For example, a simple monomorphic property access…
We talk about this a bit in our CacheIR paper. Search for "IonBuilder". https://www.mgaudet.ca/s/mplr23main-preprint.pdf
I can't speak for any other engines, but in SpiderMonkey a BigInt is a GC-managed object with a one-word header containing the sign bit, the length, and some GC bookkeeping bits, along with a second word that is either…
The whole point is that the sandbox is an approach that can be used in JIT code, where Rust doesn't help. Take the fizzbuzz example with a missing bounds check. Rust can't prevent you from generating JIT code that omits…
Those are the intended semantics of JS, but that doesn't help you when you're the one implementing JS. Somebody has to actually enforce those restrictions. Note that the code snippet is introduced with "JSArray::buffer_…
Yes. The speedometer graphic was inherited from Speedometer 2. When Speedometer 2 was released, scores were in a reasonable car-speed range. The combination of hardware and software improvements meant that early…
"The score is a rescaled version of inverse time" is the key here. If you run all the tests in half the time, your Speedometer score will double. If your score improves by 1%, it implies that you are 1% faster on the…
It's hard to predict statically which branches will be dynamically unpredictable. A seasoned hardware architect once told me that Intel went all-in on predication for Itanium, under the assumption that a Sufficiently…
We do streaming baseline compilation as fast as the network can hand us bytes, but we also kick off a more optimized compilation in a background thread. A lot of optimizations can be baked into the generated wasm, but…
To be clear, Firefox doesn't care about this benchmark either. It just so happens that changes we made for Speedometer also improved our performance here, which is a fun coincidence but not important in the grand scheme…
It's possible. We have plans to do so. There are a bunch of finicky corner cases, though. For example, destructuring will call the `return` method of the iterator when it's done…
We have a bounty program. If you can find security bugs in Firefox, please let us pay you for them. You don't need to provide a fix; a testcase that crashes in an interesting way is often enough to qualify.…
I never got direct access to Mythos, so all I know is what I've seen from the quality of the bugs being produced. I also haven't been involved at the prompting end. So the best answer I can give is: I dunno, maybe it's…
If I had to guess, I'd say that AI is better at finding TOCTOU bugs than fuzzing because it starts by looking at the code and trying to find problems with it, which naturally leads it to experiment with questions like…
The same is also true of a good security researcher, and has been for a long time. The question is mostly whether it takes long enough to come up with a testcase that we've managed to ship the fix to all affected…
I work on SpiderMonkey, so I mostly looked at the JS bugs. It was a smorgasbord of various things. Broadly speaking I'd say the most impressive bugs were TOCTOU issues, where we checked something and later acted on it,…
Yeah, fuzzing, sanitizers, and bug bounties were our main pre-AI tools for finding bugs.
I work at Mozilla; I fixed a bunch of these bugs. In general, I would say that our use of "vulnerability" lines up with what jerrythegerbil calls "potential vulnerability". (In cases with a POC, we would likely use the…
One clear use case for GC in Rust is for implementing other languages (eg writing a JS engine). When people ask why SpiderMonkey hasn't been rewritten in Rust, one of the main technical blockers I generally bring up is…
I don't know how JSC handles it, but in SM `eval` has significant negative effects on surrounding code. (We also decline to optimize functions containing `with` statements, but that's less because it's impossible and…
This isn't about languages; it's about hardware. Should hardware be "higher-level" to support higher level languages? The author says no (and I am inclined to agree with him).
This doesn't read as AI-generated to me at all. The prose isn't polished enough to be AI. AI generation is unlikely to produce missing spaces like "...which are not readable to humans.SDB uses eBPF ...", or grammatical…
Copy and paste all four lines at once.
Taking a quick look at the JSC code, the main difference is that CacheIR is more pervasive and load-bearing. Even monomorphic cases go through CacheIR. The main justification for CacheIR isn't that it enables us to do…
asm.js solves this in the specific case where somebody has compiled their C/C++ code to target asm.js. It doesn't solve it for arbitrary JS code. asm.js is more like a weird frontend to wasm than a dialect of JS.
The main thing we're doing differently in SM is that all of our ICs are generated using a simple linear IR (CacheIR), instead of generating machine code directly. For example, a simple monomorphic property access…
We talk about this a bit in our CacheIR paper. Search for "IonBuilder". https://www.mgaudet.ca/s/mplr23main-preprint.pdf
I can't speak for any other engines, but in SpiderMonkey a BigInt is a GC-managed object with a one-word header containing the sign bit, the length, and some GC bookkeeping bits, along with a second word that is either…
The whole point is that the sandbox is an approach that can be used in JIT code, where Rust doesn't help. Take the fizzbuzz example with a missing bounds check. Rust can't prevent you from generating JIT code that omits…
Those are the intended semantics of JS, but that doesn't help you when you're the one implementing JS. Somebody has to actually enforce those restrictions. Note that the code snippet is introduced with "JSArray::buffer_…
Yes. The speedometer graphic was inherited from Speedometer 2. When Speedometer 2 was released, scores were in a reasonable car-speed range. The combination of hardware and software improvements meant that early…
"The score is a rescaled version of inverse time" is the key here. If you run all the tests in half the time, your Speedometer score will double. If your score improves by 1%, it implies that you are 1% faster on the…
It's hard to predict statically which branches will be dynamically unpredictable. A seasoned hardware architect once told me that Intel went all-in on predication for Itanium, under the assumption that a Sufficiently…
We do streaming baseline compilation as fast as the network can hand us bytes, but we also kick off a more optimized compilation in a background thread. A lot of optimizations can be baked into the generated wasm, but…
To be clear, Firefox doesn't care about this benchmark either. It just so happens that changes we made for Speedometer also improved our performance here, which is a fun coincidence but not important in the grand scheme…
It's possible. We have plans to do so. There are a bunch of finicky corner cases, though. For example, destructuring will call the `return` method of the iterator when it's done…