"Native Speed on the Web: JavaScript and asm.js" by Alon Zakai (2013)
Analysts investigate attack surfaces and defenses concerning "Native Speed on the Web: JavaScript and asm.js" by Alon Zakai (2013).
Summary
Alon Zakai presents evidence that native applications can run on the web at near-native speeds through JavaScript and asm.js. He demonstrates the Epic Citadel demo—the Unreal Engine 3 compiled from approximately one million lines of C++ to JavaScript—running in browsers at 58–60 frames per second without plugins. Over six months, the same demo improved from 20-second startup and 40 fps to 10-second startup and 60 fps, driven by browser optimization.
The talk introduces asm.js, a formally defined subset of JavaScript designed for optimization. Key features include typed arrays for data representation, bitwise operations (e.g., x|0) to enforce 32-bit integer types, and closure captures to provide static guarantees that variables never change. These patterns emerged naturally across multiple C++ to JavaScript compilers (Emscripten, Mandreel) before being standardized.
Benchmark results show asm.js code running 0.5–2× slower than native C++ equivalents. Box2D physics engine comparisons reveal asm.js outperforming standard JavaScript across Firefox, Chrome, and Internet Explorer 10. Firefox and Chrome achieve speeds comparable to Java, while Safari shows weaker typed array optimization and Internet Explorer is improving.
Three principal challenges remain to achieve full native speed: (1) 32-bit floating point support—JavaScript uses 64-bit doubles, with potential 10–20% speedup from 32-bit floats; ES6's proposed Math.fround enables fragile optimizations. (2) SIMD (Single Instruction Multiple Data)—a specification proposal (by John McCutchen, Google) for float32x4 and vector types could deliver 300% speedups for parallel operations; collaboration involves Google, Mozilla, Intel, and TC39. (3) Threads—Web Workers exist but prohibit shared memory to prevent data races; enabling multi-threaded access requires careful standardization.
Demonstrations include the JavaScript MESS project (emulating retro CPUs), a Bullet physics simulation with 500 cubes at 50–60 fps, and Banana Bread (Sauerbraten engine port) running alongside an embedded Doom game in a web worker—both at 60 fps on average hardware. The Doom integration required less than 100 lines of code, highlighting web platform benefits beyond performance.
Related talks
PROIDEA Events·50 min
Engineers explore architecture and security mechanisms for 4Developers 2016: ScalaJS - web without pain of JavaScript (Jarosław Ratajski).
OWASP Global AppSec Dublin·35 min
Gal Weizman
Investigates global AppSec Dublin: JavaScript Realms: The Blank Spot In Web App Runtime Security and evaluates key implications for security practitioners.
Strange Loop Conference·37 min
Industry experts analyze emerging threats surrounding "DOMStep: Audio Synthesis, AI and a JavaScript Dance Party" by Jamison Dance.


