1899830 - [meta] Remove JIT usage from the parent process

Status: NEW

(Core :: JavaScript Engine: JIT, enhancement, P3)

Description

[Gian-Carlo Pascutto [:gcp]]

The fact that we have a JIT in the parent makes it impossible to use various security features there. In terms of defense in depth, it would be nice to get rid of this.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript Engine: JIT' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The component has been changed since the backlog priority was decided, so we're resetting it.
For more information, please visit BugBot documentation.

Comment 3

[Darkspirit]

What would the performance implications of javascript.options.main_process_disable_jit=true be? (bug 1883457)
I didn't notice any difference with that setting so far. Could it be set to true for Nightly as well as a test?

Comment 4

[Tom Ritter [:tjr] (OOTO until mid-August)]

Is Bug 1614096 still a blocker for this?

Comment 5

[Jan de Mooij [:jandem]]

I looked into this a while ago for the iOS investigation. The main blockers for this:

• DevTools has source map parsing code written in Rust and compiled to WebAssembly that runs in the parent process, but WebAssembly isn't supported without a JIT backend. We could move this code to a different process or rewrite it somehow to not use Wasm.
• There's also Wasm SIMD detection code for Firefox Translations that runs in the parent.
• DevTools performance regresses significantly when we disable the JITs. Other tests were mostly unaffected.

Comment 6

[Alexandre Poirot [:ochameau]]

(In reply to Jan de Mooij [:jandem] from comment #5)

I looked into this a while ago for the iOS investigation. The main blockers for this:

• DevTools has source map parsing code written in Rust and compiled to WebAssembly that runs in the parent process, but WebAssembly isn't supported without a JIT backend. We could move this code to a different process or rewrite it somehow to not use Wasm.

Would it be valueable on its own to move the source map to another process (i.e. without moving DevTools UI out of parent)
Note that If we move the UI to a content process, the source map parsing will move alongside without any particular additional work.

Comment 7

[Jan de Mooij [:jandem]]

(In reply to Alexandre Poirot [:ochameau] from comment #6)

Would it be valueable on its own to move the source map to another process (i.e. without moving DevTools UI out of parent)
Note that If we move the UI to a content process, the source map parsing will move alongside without any particular additional work.

It would make it easier to test disabling the JIT backend in the parent process, because we then don't have to worry about the performance numbers being affected by source map parsing not working. So not super valuable but if it's easy to do it might be worth it.

Comment 8

[Nicolas B. Pierron [:nbp]]

Is the problem only the fact that when we have a JIT we cannot encode the jump into JIT-ed pages with CET? I know Safari has CFI implemented for their JIT, could we implement CFI as part of the JIT in both the parent and client process?

Comment 9

[Mike Hommey [:glandium]]

I think on iOS the system sandbox doesn't allow us to use the JIT at all in the parent process, but I could be wrong. Nika, can you confirm?

Comment 10

[Gian-Carlo Pascutto [:gcp]]

We know that ACG also breaks with a JIT (see the discussion about the MPEG2 decoder JIT in this bug https://bugzilla.mozilla.org/show_bug.cgi?id=1381050).

Edge specifically lists ACG, CFG and CET as being enabled in their JIT-less mode (https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/).

I wonder if we can have the JIT emit CET control information, whether we'd be able to enable CET for content processes. That'd potentially be a big security win (even though it's probably a separate discussion from this one due to the above). Edit: Filed this as https://bugzilla.mozilla.org/show_bug.cgi?id=1902244

Comment 11

[Gian-Carlo Pascutto [:gcp]]

Nika, can you confirm?

I can confirm this, that's why this is a blocker for gecko-ios. The docs stop just short of saying it explicitly: https://developer.apple.com/documentation/browserenginekit/protecting-code-compiled-just-in-time but it's so heavily implied we're pretty sure it's indeed not allowed.

Comment 12

[Gian-Carlo Pascutto [:gcp]]

could we implement CFI as part of the JIT in both the parent and client process?

When we talked about this feature with Intel and Microsoft, I think Intel was specifically saying they think it's possible. Jan de Mooij was in those meetings, so maybe he remembers.

Comment 13

[Gian-Carlo Pascutto [:gcp]]

Yannis pointed out Windows doesn't do the IBT part of CET, so for Windows it would be support for CET Shadow Stacks only, but I'm not sure how that interacts with JIT-ing.