[gruez]

>Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.?

You can disable JIT in firefox[1], which makes it fall back to an interpreter. That should theoretically make it safer as there are less optimizations going on and less generated code being directly executed by the CPU.

[1] https://github.com/arkenfox/user.js/blob/b4225baaf2f8d15f856...

[zamadatix]

You can disable jit in Chromium browsers via flag as well. Chromium Edge has this exposed in the UI as "Super Duper Secure Mode".

I'm not sure if there is a way to do this on Safari.

[______-_-______]

I found this comparison of JIT vs non-JIT. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...

If you take those charts at face value, they're pretty incredible. The JIT ends up worse than the interpreter for most (real-world non-synthetic) use cases for power usage, memory usage, and startup time. Page load time is a wash. And this is after Google has poured $billions into optimizing V8.

[zamadatix]

For clarification the graphs aren't comparing JIT vs interpreted they are comparing the JIT tier being allowed vs not allowed.

Even with JIT enabled most functions are still just interpreted, hence why the vast majority of tests are equal as the vast majority of tests are interpreted either way. It's only when the JS engine thinks it can start to realize performance gains on hot code that it will start to JIT it. You can see this behavior in the "Average improvement and regression" graph where JIT starts trading other stats for performance gains.

Knowing this and looking at top "daily browsing" sites you get results about exactly where you'd expect, the JIT engine is tuned to let the vast majority of the code on these sites be interpreted since much is only called a handful of times or less leading to little difference. You see a bit of the JIT engine tiering where it starts to pick up a few of the hot pieces of code at a trade off on the other stats.

If you look beyond "daily browsing" sites into web apps and such that's where JIT is actually focused and where you'll see the most gains. It's intentionally not trying to get involved on lightweight pages because it makes no sense to do there, regardless how much time and money is invested into the JIT it will always know the best performing strategy for some 1 pass JS to set the page layout is to interpret it.

[gnu8]

I don't get why Microsoft is even working on this. They don't have a web browser.

[Osiris]

Microsoft has Edge, which is a browser. If your argument is that it's Chromium based and this not their own browser, there are several other companies like Opera, Vivaldi, and Brave who's sole product is a Chromium based browser. I don't think it would be appropriate to say that those companies "don't have a browser".

[rurban]

you can also install Fennec on Android, which has much more privacy extensions, and a better JavaScript engine (a Firefox fork).

on the PC Firefox is good enough.

[28304283409234]

And ublock.