Backdooring JavaScript using minifier bugs

Re:Backdooring JavaScript using minifier bugs by phpnode on Monday August 24, 2015 @05:21AM (#10108672)

> Is there any benefit to it?

Well, in theory yes. When determining whether a specific function can be inlined into its call site, V8 looks at the length of the function source code to try and guess whether it's worth it. Functions longer than 600 characters (including comments) cannot be inlined and therefore they will typically be slower.

Whether that makes any meaningful difference to your application performance really depends on the application. In most cases it won't.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by joepie91_ on Tuesday August 25, 2015 @06:51AM (#10115542)

You can also just set a flag that changes that maximum length - there's more about that here: https://www.youtube.com/watch?v=FXyM1yrtloc

You certainly don't need server-side minification.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by Kenji on Monday August 24, 2015 @07:02AM (#10108952)

That's really odd. In my eyes, source code length is not a good way to measure the semantic size of a function. But what you're saying is very interesting; I learned something new.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by bluesign on Monday August 24, 2015 @07:24AM (#10109001)

it is not a good way for sure, but I think it is good enough for most of the cases.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by eru on Monday August 24, 2015 @09:42AM (#10109600)

Especially if people are mostly minifying their code already.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by rezacks on Monday August 24, 2015 @11:54PM (#10114519)

I never know this before! Thanks for sharing.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by StavrosK on Monday August 24, 2015 @12:38PM (#10111065)

Wait, what if you have really really long comments? Or do they get stripped out beforehand?

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by phpnode on Monday August 24, 2015 @01:22PM (#10111456)

Comments affect this heuristic, so yeah, commented code can be slower.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by wolf550e on Monday August 31, 2015 @09:58AM (#10146806)

This slide deck has a nice example of using a comment to fix a performance bug in a js implementation of the chacha20 cipher: http://mrale.ph/talks/goto2015/#/14

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by hiou on Monday August 24, 2015 @02:09PM (#10111835)

Some libraries use annotations in comments. Therefore they cannot be stripped. Off the top of my head I know of some JavaScript testing libraries that do this.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by nitrogen on Monday August 24, 2015 @06:54AM (#10108925)

Interesting. Is there a reason why the parsed AST size isn't used instead of raw source code size?

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by phpnode on Monday August 24, 2015 @07:04AM (#10108956)

V8 doesn't use an AST, it uses a CFG, but I believe it comes down to efficiency - it's far cheaper to look at the length of a string than to traverse a graph, and by its nature JS needs very fast compilation times.

This is probably one of those heuristics that works well enough on enough real world code, even though everyone knows it's suboptimal. I've heard that the turbofan compiler will remove this limitation but that's still very much work in progress.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by teacup50 on Monday August 24, 2015 @01:01PM (#10111283)

... and people wonder why we want a web bytecode so, so badly.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by barrkel on Tuesday August 25, 2015 @02:14PM (#10118478)

V8 AST: https://code.google.com/p/v8/source/browse/branches/bleeding...

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by phpnode on Tuesday August 25, 2015 @05:27PM (#10119563)

thanks

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by barrkel on Thursday August 27, 2015 @08:40AM (#10129017)

Only reason I brought it up was the assertion that V8 didn't have an AST. Only the most trivial of compilers avoid building an AST; V8 may not use an AST for interpretation, but interpretation / compilation will be downstream of the AST and could use info from the AST for optimization heuristics. A non-IDE AST would not normally include comments.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by phpnode on Thursday August 27, 2015 @10:52AM (#10129746)

I remember thinking that it was odd when I first read about it, I think it must have been in relation to one of the other compilers and I got my wires crossed, but I can't find the source now. Thanks for the correction anyway.

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by bcrypt on Monday August 24, 2015 @12:59PM (#10111250)

That's really surprising. Thanks!

[ Parent | on HN ]

Re:Backdooring JavaScript using minifier bugs by nallerooth on Monday August 24, 2015 @10:15AM (#10109867)

I did not know that, thanks!

[ Parent | on HN ]