Skip to content

"Native Speed on the Web: JavaScript and asm.js" by Alon Zakai (2013)

Alon Zakai

AI SecurityStrange Loop Conference30 minBeginnerOpen on YouTube ↗

Analysts investigate attack surfaces and defenses concerning "Native Speed on the Web: JavaScript and asm.js" by Alon Zakai (2013).

Summary

Alon Zakai presents evidence that native applications can run on the web at near-native speeds through JavaScript and asm.js. He demonstrates the Epic Citadel demo—the Unreal Engine 3 compiled from approximately one million lines of C++ to JavaScript—running in browsers at 58–60 frames per second without plugins. Over six months, the same demo improved from 20-second startup and 40 fps to 10-second startup and 60 fps, driven by browser optimization.

The talk introduces asm.js, a formally defined subset of JavaScript designed for optimization. Key features include typed arrays for data representation, bitwise operations (e.g., x|0) to enforce 32-bit integer types, and closure captures to provide static guarantees that variables never change. These patterns emerged naturally across multiple C++ to JavaScript compilers (Emscripten, Mandreel) before being standardized.

Benchmark results show asm.js code running 0.5–2× slower than native C++ equivalents. Box2D physics engine comparisons reveal asm.js outperforming standard JavaScript across Firefox, Chrome, and Internet Explorer 10. Firefox and Chrome achieve speeds comparable to Java, while Safari shows weaker typed array optimization and Internet Explorer is improving.

Three principal challenges remain to achieve full native speed: (1) 32-bit floating point support—JavaScript uses 64-bit doubles, with potential 10–20% speedup from 32-bit floats; ES6's proposed Math.fround enables fragile optimizations. (2) SIMD (Single Instruction Multiple Data)—a specification proposal (by John McCutchen, Google) for float32x4 and vector types could deliver 300% speedups for parallel operations; collaboration involves Google, Mozilla, Intel, and TC39. (3) Threads—Web Workers exist but prohibit shared memory to prevent data races; enabling multi-threaded access requires careful standardization.

Demonstrations include the JavaScript MESS project (emulating retro CPUs), a Bullet physics simulation with 500 cubes at 50–60 fps, and Banana Bread (Sauerbraten engine port) running alongside an embedded Doom game in a web worker—both at 60 fps on average hardware. The Doom integration required less than 100 lines of code, highlighting web platform benefits beyond performance.

Related talks