V8

“Chromium has V8 which is the faster JS engine”

“V8's zones are interesting in this area”

“JavaScript V8 Engine with JIT enabled”

“Java -> GWT/J2CL -> JS -> V8 (in Chrome) -> native”

“Even the V8 team gave up on documentation”

“escapeable at both the engine level in V8, Gecko and JavaScriptCore”

“the V8 team released a blog when they introduced jitless mode”

“The V8 vulnerability being exploited today”

“I chained this bug with an n-day sandbox escape and flagged the v8CTF.”

“V8 also has its own sandbox”

“the virtues of v8 sandboxing / isolates!”

“V8 does have APIs for code caching and startup snapshots”

“V8 21M, Score 47285, ES6 98%”

“near-V8 speeds”

“V8's Orinoco is also pretty good now.”

“I think the speed of V8 speaks for itself.”

“V8 was significantly faster than LuaJIT”

“wouldn't be up there without V8 and friends”

“People reported challenges building V8 (whether upstream or the Node.js variant) on s390x with z13 support.”

“If any JS and v8 have tons of CVE's.”

“V8 isolates”

“update v8 as they make weird changes every now and then”

“runs server side inside a V8 isolate”

I agree, but there’s a tiny caveat that this is for one specific benchmark that, I think, doesn’t reflect most real-world code. I’m basing that on the 1.6% improvement they got on speeding up sqrt. That surprised me, because, to get such an improvement, the benchmark must spend over 1.6% of its time in there, to start with. Looking in the git repo, it seems that did happen in the nbody simulation (https://github.com/

“V8 and JSC totally crapped out”

“"Efficient structs" in v8 are just inefficient Java classes.”

No, serde-wasm-bindgen implements the serde Serializer interface by calling into JS to directly construct the JS objects on the JS heap without an intermediate serialization/deserialization. You pay the cost of one or more FFI calls for every object though. https://docs.rs/serde-wasm-bindgen/

“V8 JSON nowadays is highly optimized”

“It's not a full optimizing JIT like V8's TurboFan”

“V8 isolates bring ~20MB of binary”

“V8 is a JIT compiler that uses the Ignition [1] interpreter”

“For now it's fast enough”

“There's been a constant stream of v8 VM sandbox escape discoveries since its dawn of course.”

“The js engines of the time were not efficient with that design.”

“simply because of how good V8 is”

“Titan Planet now use v8 to run js bundles no more boa”

“V8 execution of JavaScript's for-of loops is fast”

“If V8 produces different optimized codes for different loops”

Right - I trust workerd in the context of Cloudflare because I know it has a team of people who's job it is to keep it secure who are on-call 24/7. The problem I have is that I'm just one person and I don't want to be on call 24/7 ready to react to sandbox escapes, so I'm hoping I can find a solution that someone else built where they are willing to say "this is safe: you can feed in a string of untrusted JavaScript

“The challenge with V8 is finding a wrapper for it that doesn't come with a big warning NOT to use it as a sandbox for untrusted code”