I wonder. Should one ever use minified javascript code on a server? Assuming that you are using it on your own server and not distributing the code to clients. Is there any benefit to it?
Backdooring JavaScript using minifier bugs
21–30 of 37 posts
Re: Backdooring JavaScript using minifier bugs
#22I wonder. Should one ever use minified javascript code on a server? Assuming that you are using it on your own server and not distributing the code to clients. Is there any benefit to it?
> Is there any benefit to it? Well, in theory yes. When determining whether a specific function can be inlined into its call site, V8 looks at the length of the function source code to try and guess whether it's worth it. Functions longer than 600 characters (including comments) cannot be inlined and therefore they will typically be slower. Whether that makes any meaningful difference to your application performance…
Re: Backdooring JavaScript using minifier bugs
#23Reading this makes it seem hardly worth saving a few bytes over.
Re: Backdooring JavaScript using minifier bugs
#24I wonder. Should one ever use minified javascript code on a server? Assuming that you are using it on your own server and not distributing the code to clients. Is there any benefit to it?
> Is there any benefit to it? Well, in theory yes. When determining whether a specific function can be inlined into its call site, V8 looks at the length of the function source code to try and guess whether it's worth it. Functions longer than 600 characters (including comments) cannot be inlined and therefore they will typically be slower. Whether that makes any meaningful difference to your application performance…
Re: Backdooring JavaScript using minifier bugs
#25Earlier quoted context omitted.
Interesting. Is there a reason why the parsed AST size isn't used instead of raw source code size?
V8 doesn't use an AST, it uses a CFG, but I believe it comes down to efficiency - it's far cheaper to look at the length of a string than to traverse a graph, and by its nature JS needs very fast compilation times. This is probably one of those heuristics that works well enough on enough real world code, even though everyone knows it's suboptimal. I've heard that the turbofan compiler will remove this limitation but…
Re: Backdooring JavaScript using minifier bugs
#26This makes me think that there could be similar bugs in the browser, when it JIT-compiles or optimizes Javascript code. That could be used to take control of the whole browser/OS if used in an add-on/extension (given that it has sufficient privileges).
Re: Backdooring JavaScript using minifier bugs
#27Earlier quoted context omitted.
> Is there any benefit to it? Well, in theory yes. When determining whether a specific function can be inlined into its call site, V8 looks at the length of the function source code to try and guess whether it's worth it. Functions longer than 600 characters (including comments) cannot be inlined and therefore they will typically be slower. Whether that makes any meaningful difference to your application performance…
Wait, what if you have really really long comments? Or do they get stripped out beforehand?
Re: Backdooring JavaScript using minifier bugs
#28I wonder. Should one ever use minified javascript code on a server? Assuming that you are using it on your own server and not distributing the code to clients. Is there any benefit to it?
The reason is that V8 uses heuristics to decide which functions get inlined, and the raw source code length is one of the heuristics. Making the source for a function shorter may cause V8 to inline it more aggressively.
Re: Backdooring JavaScript using minifier bugs
#29Earlier quoted context omitted.
> Is there any benefit to it? Well, in theory yes. When determining whether a specific function can be inlined into its call site, V8 looks at the length of the function source code to try and guess whether it's worth it. Functions longer than 600 characters (including comments) cannot be inlined and therefore they will typically be slower. Whether that makes any meaningful difference to your application performance…
Wait, what if you have really really long comments? Or do they get stripped out beforehand?
Re: Backdooring JavaScript using minifier bugs
#30I wonder. Should one ever use minified javascript code on a server? Assuming that you are using it on your own server and not distributing the code to clients. Is there any benefit to it?
> Is there any benefit to it? Well, in theory yes. When determining whether a specific function can be inlined into its call site, V8 looks at the length of the function source code to try and guess whether it's worth it. Functions longer than 600 characters (including comments) cannot be inlined and therefore they will typically be slower. Whether that makes any meaningful difference to your application performance…