Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdooring JavaScript using minifier bugs

zyan.scripts.mit.edu

Post reply on HN
Print view View original

31–37 of 37 posts

Re: Backdooring JavaScript using minifier bugs

#31

Post by joepie91_ »

phpnode wrote: post #11
yoz-y wrote: post #3

I wonder. Should one ever use minified javascript code on a server? Assuming that you are using it on your own server and not distributing the code to clients. Is there any benefit to it?

> Is there any benefit to it? Well, in theory yes. When determining whether a specific function can be inlined into its call site, V8 looks at the length of the function source code to try and guess whether it's worth it. Functions longer than 600 characters (including comments) cannot be inlined and therefore they will typically be slower. Whether that makes any meaningful difference to your application performance…

You can also just set a flag that changes that maximum length - there's more about that here: https://www.youtube.com/watch?v=FXyM1yrtloc

You certainly don't need server-side minification.

Re: Backdooring JavaScript using minifier bugs

#32

Post by barrkel »

phpnode wrote: post #14
nitrogen wrote: post #12

Earlier quoted context omitted.

Interesting. Is there a reason why the parsed AST size isn't used instead of raw source code size?

V8 doesn't use an AST, it uses a CFG, but I believe it comes down to efficiency - it's far cheaper to look at the length of a string than to traverse a graph, and by its nature JS needs very fast compilation times. This is probably one of those heuristics that works well enough on enough real world code, even though everyone knows it's suboptimal. I've heard that the turbofan compiler will remove this limitation but…

V8 AST: https://code.google.com/p/v8/source/browse/branches/bleeding...

Re: Backdooring JavaScript using minifier bugs

#33

Post by phpnode »

barrkel wrote: post #32
phpnode wrote: post #14

Earlier quoted context omitted.

V8 doesn't use an AST, it uses a CFG, but I believe it comes down to efficiency - it's far cheaper to look at the length of a string than to traverse a graph, and by its nature JS needs very fast compilation times. This is probably one of those heuristics that works well enough on enough real world code, even though everyone knows it's suboptimal. I've heard that the turbofan compiler will remove this limitation but…

V8 AST: https://code.google.com/p/v8/source/browse/branches/bleeding...

thanks

Re: Backdooring JavaScript using minifier bugs

#34

Post by barrkel »

phpnode wrote: post #33
barrkel wrote: post #32

Earlier quoted context omitted.

V8 AST: https://code.google.com/p/v8/source/browse/branches/bleeding...

thanks

Only reason I brought it up was the assertion that V8 didn't have an AST. Only the most trivial of compilers avoid building an AST; V8 may not use an AST for interpretation, but interpretation / compilation will be downstream of the AST and could use info from the AST for optimization heuristics. A non-IDE AST would not normally include comments.

Re: Backdooring JavaScript using minifier bugs

#35

Post by phpnode »

barrkel wrote: post #34
phpnode wrote: post #33

Earlier quoted context omitted.

thanks

Only reason I brought it up was the assertion that V8 didn't have an AST. Only the most trivial of compilers avoid building an AST; V8 may not use an AST for interpretation, but interpretation / compilation will be downstream of the AST and could use info from the AST for optimization heuristics. A non-IDE AST would not normally include comments.

I remember thinking that it was odd when I first read about it, I think it must have been in relation to one of the other compilers and I got my wires crossed, but I can't find the source now. Thanks for the correction anyway.

Re: Backdooring JavaScript using minifier bugs

#36

Post by wolf550e »

StavrosK wrote: post #22
phpnode wrote: post #11

Earlier quoted context omitted.

> Is there any benefit to it? Well, in theory yes. When determining whether a specific function can be inlined into its call site, V8 looks at the length of the function source code to try and guess whether it's worth it. Functions longer than 600 characters (including comments) cannot be inlined and therefore they will typically be slower. Whether that makes any meaningful difference to your application performance…

Wait, what if you have really really long comments? Or do they get stripped out beforehand?

This slide deck has a nice example of using a comment to fix a performance bug in a js implementation of the chacha20 cipher: http://mrale.ph/talks/goto2015/#/14

Re: Backdooring JavaScript using minifier bugs

#37

Post by gliptic »

nathankleyn wrote: post #10
gliptic wrote: post #7

Earlier quoted context omitted.

Why would HTTP2 eradicate the minifier? It seems completely orthogonal to minification.

Edited, that's a mistake - I meant to write "HTTP2 + Web Assembly" (which will take the place of file concatenation and minification).

WebAssembly will only be applicable to asm.js-style code, not JavaScript in general.
Post reply on HN