This document discusses the future of web browsers and Mozilla's Project Servo. It notes that current browsers need to be made safer and able to take advantage of parallel hardware. Project Servo seeks to build a new, parallel browser engine using the Rust programming language instead of C++ for improved safety. Early benchmarks show Rust code competing well with C++, suggesting Rust is a good choice for building high-performance and secure software for the future.

1. Future Tense
mozilla
1
Friday, April 29, 2011

2. Future Tense
• “No fate but what we make.” - Sarah Connor, T2
mozilla
1
Friday, April 29, 2011

3. Future Tense
• “No fate but what we make.” - Sarah Connor, T2
• “Leaders can imagine a world that others don’t. Like Thomas Jefferson or that
kid in the Terminator movies.” - Finn, Glee
mozilla
1
Friday, April 29, 2011

4. Future Tense
• “No fate but what we make.” - Sarah Connor, T2
• “Leaders can imagine a world that others don’t. Like Thomas Jefferson or that
kid in the Terminator movies.” - Finn, Glee
• This talk is about the future, both what it will bring and what we want from it.
mozilla
1
Friday, April 29, 2011

5. Future Tense
• “No fate but what we make.” - Sarah Connor, T2
• “Leaders can imagine a world that others don’t. Like Thomas Jefferson or that
kid in the Terminator movies.” - Finn, Glee
• This talk is about the future, both what it will bring and what we want from it.
• At Mozilla Summit 2010, we launched Rust, a new programming language
motivated by safety and concurrency for parallel hardware, the “manycore”
future which is upon us.
mozilla
1
Friday, April 29, 2011

6. Future Tense
• “No fate but what we make.” - Sarah Connor, T2
• “Leaders can imagine a world that others don’t. Like Thomas Jefferson or that
kid in the Terminator movies.” - Finn, Glee
• This talk is about the future, both what it will bring and what we want from it.
• At Mozilla Summit 2010, we launched Rust, a new programming language
motivated by safety and concurrency for parallel hardware, the “manycore”
future which is upon us.
• This talk is a recap of motivation and a status report...
mozilla
1
Friday, April 29, 2011

7. Mobile vs. desktop slowdown
• From “Fast and Parallel Webpage Layout”, Meyerovich & Bodik, WWW2010, this
chart shows how “the power wall” hurts mobile single-core performance, driving
mobile to manycore and requiring a parallel browser engine “real soon now”:
mozilla
2
Friday, April 29, 2011

8. Data flow in a browser engine
• Traditionally mostly single-threaded, using C++ as implementation language,
with threads for image decoding, speculative script prefetching, rendering.
mozilla
3
Friday, April 29, 2011

9. Must parallelize every stage to win
• Even use data-parallel (SIMD) instructions as well... Amdahl’s Law bites.
mozilla
4
Friday, April 29, 2011

10. The “pwn2own” problem
mozilla
5
Friday, April 29, 2011

11. The “pwn2own” problem
• Every browser has endless security vulnerabilities due to lack of safety in the
main implementation language (C++, formerly C -- used for speed not safety).
mozilla
5
Friday, April 29, 2011

12. The “pwn2own” problem
• Every browser has endless security vulnerabilities due to lack of safety in the
main implementation language (C++, formerly C -- used for speed not safety).
• Chrome and Firefox survived this year’s pwn2own contest, but no boasting from
Mozilla on this count. And Chrome has been hacked elsewhere, too.
mozilla
5
Friday, April 29, 2011

13. The “pwn2own” problem
• Every browser has endless security vulnerabilities due to lack of safety in the
main implementation language (C++, formerly C -- used for speed not safety).
• Chrome and Firefox survived this year’s pwn2own contest, but no boasting from
Mozilla on this count. And Chrome has been hacked elsewhere, too.
• We have millions of lines of C++ in Gecko, both too-often unsafe due to memory
management bugs, and mostly single-threaded -- so slow on manycore mobile
devices.
mozilla
5
Friday, April 29, 2011

14. The “pwn2own” problem
• Every browser has endless security vulnerabilities due to lack of safety in the
main implementation language (C++, formerly C -- used for speed not safety).
• Chrome and Firefox survived this year’s pwn2own contest, but no boasting from
Mozilla on this count. And Chrome has been hacked elsewhere, too.
• We have millions of lines of C++ in Gecko, both too-often unsafe due to memory
management bugs, and mostly single-threaded -- so slow on manycore mobile
devices.
• Adding more threads to utilize multiple cores while fighting security bugs is like
team-juggling chainsaws to music where the record player has been sped up!
mozilla
5
Friday, April 29, 2011

15. Project Servo
mozilla
6
Friday, April 29, 2011

16. Project Servo
• A new, safer systems programming language, Rust, instead of C++
mozilla
6
Friday, April 29, 2011

17. Project Servo
• A new, safer systems programming language, Rust, instead of C++
• Research building parallel browser engine stages in Rust
mozilla
6
Friday, April 29, 2011

18. Project Servo
• A new, safer systems programming language, Rust, instead of C++
• Research building parallel browser engine stages in Rust
• Experiment with Andreas Gal’s DOM implemented in JavaScript
mozilla
6
Friday, April 29, 2011

19. Project Servo
• A new, safer systems programming language, Rust, instead of C++
• Research building parallel browser engine stages in Rust
• Experiment with Andreas Gal’s DOM implemented in JavaScript
• For a scalably-faster-on-manycore, much safer Browser from the Future
mozilla
6
Friday, April 29, 2011

20. Project Servo
• A new, safer systems programming language, Rust, instead of C++
• Research building parallel browser engine stages in Rust
• Experiment with Andreas Gal’s DOM implemented in JavaScript
• For a scalably-faster-on-manycore, much safer Browser from the Future
• Rust is good for Servers and other Software from the Future, too
mozilla
6
Friday, April 29, 2011

21. nbody.rs
mozilla
7
Friday, April 29, 2011

22. Rust performance results (nbody)
mozilla
8
Friday, April 29, 2011

23. fannkuchredux.rs
mozilla
9
Friday, April 29, 2011

24. Rust performance results (fannkuch)
mozilla
10
Friday, April 29, 2011

25. What it all means
mozilla
11
Friday, April 29, 2011

26. What it all means
• First, these are just two of many benchmarks to conquer; Rust is still young.
mozilla
11
Friday, April 29, 2011

27. What it all means
• First, these are just two of many benchmarks to conquer; Rust is still young.
• The -rust-unsafe versions are competitive with their -gcc and -clang
counterparts (fannkuch-rust-unsafe actually wins!).
mozilla
11
Friday, April 29, 2011

28. What it all means
• First, these are just two of many benchmarks to conquer; Rust is still young.
• The -rust-unsafe versions are competitive with their -gcc and -clang
counterparts (fannkuch-rust-unsafe actually wins!).
• The -rust (safe) versions are currently about twice as slow as the C versions.
mozilla
11
Friday, April 29, 2011

29. What it all means
• First, these are just two of many benchmarks to conquer; Rust is still young.
• The -rust-unsafe versions are competitive with their -gcc and -clang
counterparts (fannkuch-rust-unsafe actually wins!).
• The -rust (safe) versions are currently about twice as slow as the C versions.
• We will reduce the cost of safety with ongoing, serious optimization effort.
mozilla
11
Friday, April 29, 2011

30. What it all means
• First, these are just two of many benchmarks to conquer; Rust is still young.
• The -rust-unsafe versions are competitive with their -gcc and -clang
counterparts (fannkuch-rust-unsafe actually wins!).
• The -rust (safe) versions are currently about twice as slow as the C versions.
• We will reduce the cost of safety with ongoing, serious optimization effort.
• Rust allows unsafe modules and functions, so we can dial in the remaining cost
that is not forgiven due to speedups on parallel hardware.
mozilla
11
Friday, April 29, 2011

31. What it all means
• First, these are just two of many benchmarks to conquer; Rust is still young.
• The -rust-unsafe versions are competitive with their -gcc and -clang
counterparts (fannkuch-rust-unsafe actually wins!).
• The -rust (safe) versions are currently about twice as slow as the C versions.
• We will reduce the cost of safety with ongoing, serious optimization effort.
• Rust allows unsafe modules and functions, so we can dial in the remaining cost
that is not forgiven due to speedups on parallel hardware.
• The Servo parallel browser engine project is starting, here and now.
mozilla
11
Friday, April 29, 2011

32. mozilla
12
Friday, April 29, 2011