WebAssembly

WebAssembly (often shortened to Wasm) is an open standard that defines a portable binary-code format for executable programs, and a corresponding textual assembly language, as well as interfaces for facilitating interactions between such programs and their host environment.[1][2][3][4] The main goal of WebAssembly is to enable high-performance applications on web pages, but the format is designed to be executed and integrated in other environments as well, including standalone ones.[5][6][7]

WebAssembly

Paradigm	Imperative, structured, expression-oriented
Designed by	W3C
Developer	W3C Mozilla Microsoft Google Apple
First appeared	March 2017 (2017-03)
Typing discipline	Static
License	Apache License 2.0
Filename extensions	.wat .wasm
Website	webassembly.org
Influenced by
asm.js PNaCl

WebAssembly (i.e. WebAssembly Core Specification and WebAssembly JavaScript Interface[8]) became a World Wide Web Consortium recommendation on 5 December 2019[9] and, alongside HTML, CSS, and JavaScript, is the fourth language to run natively in browsers.[10] In order to use Wasm in browsers, users may use Emscripten SDK to compile C++ (or any other LLVM-supported language such as D or Rust) source code into a binary file which runs in the same sandbox as regular JavaScript code.[note 1] Emscripten provides bindings for several commonly used environment interfaces like WebGL. There is no direct Document Object Model (DOM) access; however, it is possible to create proxy functions for this, for example through stdweb,[15] web_sys,[16] and js_sys[17] when using Rust language.

WebAssembly is usually either ahead-of-time (AOT) or just-in-time (JIT) compiled, while there's also available "WebAssembly Micro Runtime (WAMR), an interpreter-based WebAssembly runtime for embedded devices".[18]

The World Wide Web Consortium (W3C) maintains the standard with contributions from Mozilla, Microsoft, Google, Apple, Fastly, Intel, and Red Hat.[19][18]

History

WebAssembly was first announced in 2015,[20] and the first demonstration was executing Unity's Angry Bots in Firefox,[21] Google Chrome,[22] and Microsoft Edge.[23] The precursor technologies were asm.js from Mozilla and Google Native Client,[24][25] and the initial implementation was based on the feature set of asm.js.[26] The asm.js technology already provides near-native code execution speeds[27] and can be considered a viable alternative for browsers that don't support WebAssembly or have it disabled for security reasons.

In March 2017, the design of the minimum viable product (MVP) was declared to be finished and the preview phase ended.[28] In late September 2017, Safari 11 was released with support. In February 2018, the WebAssembly Working Group published three public working drafts for the Core Specification, JavaScript Interface, and Web API.[29][30][31][32]

Implementations

While WebAssembly was initially designed to enable near-native code execution speed in the web browser, it has been considered valuable outside of such, in more generalized contexts.[33][34] Since WebAssembly's runtime environment (RE) are low level virtual stack machines (akin to JVM or Flash VM) that can be embedded into host applications some of them have found a way to standalone RE like Wasmtime and Wasmer.[35]

Web Browsers

In November 2017, Mozilla declared support "in all major browsers"[36] (by now all major on mobile and desktop), after WebAssembly was enabled by default in Edge 16.[37] The support includes mobile web browsers for iOS and Android. As of August 2020, 92.28% of installed browsers (92.5% of desktop browsers and 93.22% of mobile browsers) support WebAssembly.[38] But for older browsers, Wasm can be compiled into asm.js by a JavaScript polyfill.[39]

Compilers

Because WebAssembly executables are precompiled, it is possible to use a variety of programming languages to make them.[40] This is achieved either through direct compilation to Wasm, or through implementation of the corresponding virtual machines in Wasm. There have been around 40 programming languages reported to support Wasm as a compilation target.[41]

Emscripten compiles C and C++ to Wasm[28] using the Binaryen and LLVM as backend.[42]

As of version 8 a standalone Clang can compile C and C++ to Wasm.[43]

Its initial aim is to support compilation from C and C++,[44] though support for other source languages such as Rust and .NET languages is also emerging.[45][46][41] After the MVP release, there are plans to support multithreading and garbage collection[47][48] which would make WebAssembly a compilation target for garbage-collected programming languages like C# (supported via Blazor), F# (supported via Bolero[49] with help of Blazor), Python, and even JavaScript where the browser's just-in-time compilation speed is considered too slow. A number of other languages have some support including Java, Julia,[50][51][52] Ruby,[53] as well as Go.

Security considerations

In June 2018, a security researcher presented the possibility of using WebAssembly to circumvent browser mitigations for Spectre and Meltdown security vulnerabilities once support for threads with shared memory is added. Due to this concern, WebAssembly developers put the feature on hold.[54][55][56] However, in order to explore these future language extensions, Google Chrome added experimental support for the WebAssembly thread proposal in October 2018.[57]

WebAssembly has been criticized for allowing greater ease of hiding the evidence for malware writers, scammers and phishing attackers; WebAssembly is only present on the user's machine in its compiled form, which "[makes malware] detection difficult".[58] The speed and concealability of WebAssembly have led to its use in hidden crypto mining on the website visitor's device.[58][59][54] Coinhive, a now defunct service facilitating cryptocurrency mining in website visitors' browsers, claims their "miner uses WebAssembly and runs with about 65% of the performance of a native Miner."[54] A June 2019 study from the Technische Universität Braunschweig, analyzed the usage of WebAssembly in the Alexa top 1 million websites and found the prevalent use was for malicious crypto mining, and that malware accounted for more than half of the WebAssembly-using websites studied.[60][61]

The ability to effectively obfuscate large amounts of code can also be used to disable ad blocking and privacy tools that prevent web tracking like Privacy Badger.

As WebAssembly only supports structured control flow, it is amenable toward security verification techniques including symbolic execution. Current efforts in this direction include the Manticore symbolic execution engine.[62]

WASI

WebAssembly System Interface (WASI) is a simple interface (ABI and API) designed by Mozilla intended to be portable to any platform.[63] It provides POSIX-like features like file I/O constrained by capability-based security.[64][65] There are also a few other proposed ABI/APIs.[66][67]

WASI was influenced by CloudABI and Capsicum.

Specification

Host Environment

The general standard provides core specifications for JavaScript API and details on embedding.[3]

Virtual machine

Wasm code (binary or bytecode) is intended to be run on a portable virtual stack machine (VM).[68] The VM is designed to be faster to parse and execute than JavaScript and to have a compact code representation.[44] An external functionality (like syscalls) that may be expected by a wasm binary code is not stipulated by standard, it rather provides a way to deliver interfacing via modules by the host environment that the VM implementation runs in.[69][35]

Wasm program

A Wasm program is designed to be a separate module containing collections of various wasm-defined values and program type definitions. These are expressed in either binary or textual format (see below) that both have common structure.[70]

Instruction set

The core standard for the binary format of a wasm program defines an instruction set architecture consisting of specific binary encodings of types of operations which are executed by the VM. It doesn't specify how exactly they must be executed by the VM however.[71] The list of instructions includes standard memory load/store instructions, numeric, parametric, control of flow instruction types and wasm-specific variable instructions.[72]

Code representation

In March 2017, the WebAssembly Community Group reached consensus on the initial (MVP) binary format, JavaScript API, and reference interpreter.[73] It defines a WebAssembly binary format (.wasm), which is not designed to be used by humans, as well as a human-readable WebAssembly text format (.wat) that resembles a cross between S-expressions and traditional assembly languages.

The table below represents three different views of the same source code input from the left, as it is converted to a Wasm intermediate representation, then to Wasm binary instructions:[74]

The same source code in C, assembly, and Wasm

C input source	Linear assembly bytecode (intermediate representation)	Wasm binary encoding (hexadecimal bytes)
int factorial(int n) { if (n == 0) return 1; else return n * factorial(n-1); }	; magic number ; type for (func (param i64) (result i64)) ; function section ; code section start (func (param i64) (result i64) local.get 0 i64.eqz if (result i64) i64.const 1 else local.get 0 local.get 0 i64.const 1 i64.sub call 0 i64.mul end) ; module end, size fixups	00 61 73 6D 01 00 00 00 01 00 01 60 01 73 01 73 06 03 00 01 00 02 0A 00 01 00 00 20 00 50 04 7E 42 01 05 20 00 20 00 42 01 7D 10 00 7E 0B 0B 15 17

All integer constants are encoded using a space-efficient, variable-length LEB128 encoding.[75]

The WebAssembly text format is more canonically written in a folded format using s-expressions. For instructions and expressions, this format is purely syntactic sugar and has no behavioral differences with the linear format.[76] Through wasm2wat, the code above decompiles to:

(module
  (type $t0 (func (param i64) (result i64)))
  (func $f0 (type $t0) (param $p0 i64) (result i64)
    (if $I0 (result i64) ; $I0 is an unused label name
      (i64.eqz
        (local.get $p0)) ; the name $p0 is the same as 0 here
      (then
        (i64.const 1))
      (else
        (i64.mul
          (local.get $p0)
          (call $f0      ; the name $f0 is the same as 0 here
            (i64.sub
              (local.get $p0)
              (i64.const 1))))))))

Note that a module is implicitly generated by the compiler. The function is actually referenced by an entry of the type table in the binary, hence a type section and the type emitted by the decompiler.[77] The compiler and decompiler can be accessed online.[78]

Literature

• Haas, Andreas; Rossberg, Andreas; Schuff, Derek L.; Titzer, Ben L.; Gohman, Dan; Wagner, Luke; Zakai, Alon; Bastien, JF; Holman, Michael (June 2017). "Bringing the web up to speed with WebAssembly". Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation. Association for Computing Machinery: 185–200. doi:10.1145/3062341.3062363. ISBN 9781450349888.
• Watt, Conrad (2018). "Mechanising and Verifying the WebAssembly Specification" (PDF). ACM SIGPLAN International Conference on Certified Programs and Proofs. ACM. 7: 53–65. doi:10.1145/3167082. ISBN 9781450355865.

Notes

1. According to official documentation, the Emscripten SDK may be used to create .wasm files which then may be executed in a web browser.[11][12][13] Even though Emscripten can consume various languages when using Clang, some problems may arise.[14]

References

1. "Introduction — WebAssembly 1.0". webassembly.github.io. Retrieved 18 June 2019. WebAssembly is an open standard...
2. "Introduction — WebAssembly 1.0". webassembly.github.io. Retrieved 18 June 2019. WebAssembly is a ... code format
3. "Conventions — WebAssembly 1.0". webassembly.github.io. Retrieved 17 May 2019. WebAssembly is a programming language that has multiple concrete representations (its binary format and the text format). Both map to a common structure.
4. "Introduction — WebAssembly 1.0". webassembly.github.io. Retrieved 18 June 2019. ... this specification is complemented by additional documents defining interfaces to specific embedding environments such as the Web. These will each define a WebAssembly application programming interface (API) suitable for a given environment.
5. "WebAssembly Specification Release 1.0 (Draft, last updated Apr 16, 2019): Introduction". webassembly.org. Retrieved 6 May 2019. Its main goal is to enable high performance applications on the Web, but it does not make any Web-specific assumptions or provide Web-specific features, so it can be employed in other environments as well.
6. Haas, Andreas; Rossberg, Andreas; Schuff, Derek L.; Titzer, Ben L.; Holman, Michael; Gohman, Dan; Wagner, Luke; Zakai, Alon; Bastien, JF (14 June 2017). "Bringing the Web Up to Speed with WebAssembly". SIGPLAN Notices. 52 (6): 185–200. doi:10.1145/3140587.3062363. ISSN 0362-1340. While the Web is the primary motivation for WebAssembly, nothing in its design depends on the Web or a JavaScript environment. It is an open standard specifically designed for embedding in multiple contexts, and we expect that stand-alone implementations will become available in the future.
7. "Outside the web: standalone WebAssembly binaries using Emscripten · V8". v8.dev. Retrieved 28 July 2020.
8. "WebAssembly JavaScript Interface". www.w3.org. Retrieved 24 June 2020.
9. World Wide Web Consortium. "WebAssembly Core Specification". World Wide Web Consortium (W3). Retrieved 9 December 2019.
10. Couriol, Bruno. "WebAssembly 1.0 Becomes a W3C Recommendation and the Fourth Language to Run Natively in Browsers". infoq.com. Retrieved 9 December 2019.
11. "Developer's Guide - WebAssembly". webassembly.org. Retrieved 10 June 2019.
12. "Compiling a New C/C++ Module to WebAssembly". MDN Web Docs. Retrieved 10 June 2019.
13. "Building to WebAssembly — Emscripten 1.38.33 documentation". emscripten.org. Retrieved 10 June 2019.
14. "Emscripting a C library to Wasm | Web". Google Developers. Retrieved 10 June 2019.
15. "stdweb - Rust". docs.rs. Retrieved 5 June 2019. The goal of this crate is to provide Rust bindings to the Web APIs and to allow a high degree of interoperability between Rust and JavaScript.
16. "web_sys - Rust". docs.rs. Retrieved 5 June 2019. Raw API bindings for Web APIs. This is a procedurally generated crate from browser WebIDL which provides a binding to all APIs that browser provide on the web.
17. "js_sys - Rust". docs.rs. Retrieved 5 June 2019. Bindings to JavaScript's standard, built-in objects, including their methods and properties.
18. "New Bytecode Alliance Brings the Security, Ubiquity, and Interoperability of the Web to the World of Pervasive Computing". Mozilla. 12 November 2019. Retrieved 27 May 2019.
19. Bright, Peter (18 June 2015). "The Web is getting its bytecode: WebAssembly". Ars Technica. Condé Nast.
20. "Launch bug". GitHub / WebAssembly / design. 11 June 2015.
21. Wagner, Luke (14 March 2016). "A WebAssembly Milestone: Experimental Support in Multiple Browsers". Mozilla Hacks.
22. Thompson, Seth (15 March 2016). "Experimental support for WebAssembly in V8". V8 Blog.
23. Zhu, Limin (15 March 2016). "Previewing WebAssembly experiments in Microsoft Edge". Microsoft Edge dev blog.
24. Lardinois, Frederic (17 June 2015). "Google, Microsoft, Mozilla And Others Team Up To Launch WebAssembly, A New Binary Format For The Web". TechCrunch. Retrieved 24 December 2017.
25. Avram, Abel (31 May 2017). "Google Is to Remove Support for PNaCl". InfoQ. Retrieved 22 December 2017.
26. "WebAssembly: a binary format for the web". ②ality – JavaScript and more. 18 June 2015.
27. "Staring at the Sun: Dalvik vs. ASM.js vs. Native". blog.mozilla.org. Retrieved 7 December 2019. Even discarding the one score where asm.js did better, it executes at around 70% of the speed of native C++ code.
28. Krill, Paul (6 March 2017). "WebAssembly is now ready for browsers to use". InfoWorld. Retrieved 23 December 2017.
29. "WebAssembly First Public Working Drafts". W3C. 15 February 2018. Retrieved 20 April 2018.
30. "WebAssembly Core Specification". W3C. 15 February 2018. Retrieved 20 April 2018.
31. "WebAssembly JavaScript Interface". W3C. 15 February 2018. Retrieved 20 April 2018.
32. "WebAssembly Web API". W3C. 15 February 2018. Retrieved 20 April 2018.
33. "Non-Web Embeddings". WebAssembly. Retrieved 15 May 2019.
34. "Non-Web Embeddings". GitHub / WebAssembly. Retrieved 15 May 2019.
35. "Outside the web: standalone WebAssembly binaries using Emscripten · V8". v8.dev. Retrieved 28 July 2020.
36. "WebAssembly support now shipping in all major browsers". The Mozilla Blog. Retrieved 21 November 2017.
37. "Introducing new JavaScript optimizations, WebAssembly, SharedArrayBuffer, and Atomics in EdgeHTML 16". Microsoft Edge Dev Blog. 31 October 2017. Retrieved 21 November 2017.
38. "WebAssembly". Can I use. Retrieved 13 July 2020.
39. Bright, Peter (18 June 2015). "The Web is getting its bytecode: WebAssembly". Ars Technica. Retrieved 23 December 2017.
40. Ball, Kevin (26 June 2018). "How WebAssembly is Accelerating the Future of Web Development". Archived from the original on 12 February 2019. Retrieved 22 October 2018.
41. "Awesome WebAssembly Languages". 26 June 2018. Archived from the original on 12 February 2019. Retrieved 12 February 2019.
42. Zakai, Alon [@kripken] (21 October 2019). "Emscripten has switched to the upstream LLVM wasm backend by default! / Details:https://groups.google.com/forum/#!topic/emscripten-discuss/NpxVAOirSl4 …" (Tweet). Retrieved 22 October 2019 – via Twitter.
43. "LLVM 8.0.0 Release Notes — LLVM 8 documentation". releases.llvm.org. Retrieved 22 October 2019.
44. "WebAssembly High-Level Goals". GitHub / WebAssembly / design. 11 December 2015.
45. Krill, Paul (29 November 2017). "Direct WebAssembly compilation comes to Rust language". InfoWorld. Retrieved 24 December 2017.
46. "Frequently asked questions (FAQ) about Blazor". blazor.net. Retrieved 18 June 2018.
47. Krill, Paul (26 October 2017). "What's next for WebAssembly: GC, threads, debugging". TechWorld. Retrieved 24 December 2017.
48. "🛤 Garbage collection · Issue #16 · WebAssembly/proposals". GitHub. Retrieved 25 July 2019.
49. "Bolero: F# in WebAssembly". fsbolero.io. Retrieved 25 July 2019.
50. "Julia in the Browser". nextjournal.com. Retrieved 9 April 2019.
51. "WebAssembly platform by tshort · Pull Request #2 · JuliaPackaging/Yggdrasil". GitHub. Retrieved 9 April 2019.
52. Fischer, Keno (22 July 2019), GitHub - Keno/julia-wasm: Running julia on wasm., retrieved 25 July 2019
53. "MRuby in Your Browser". ruby.dj. Retrieved 25 July 2019.
54. Neumann, Robert; Toro, Abel (19 April 2018). "In-browser mining: Coinhive and WebAssembly". Forcepoint. Retrieved 8 June 2019.
55. Cimpanu, Catalin (24 June 2018). "Changes in WebAssembly Could Render Meltdown and Spectre Browser Patches Useless". Bleeping Computer. Retrieved 8 June 2019.
56. Sanders, James (25 June 2018). "How opaque WebAssembly code could increase the risk of Spectre attacks online". Tech Republic. Retrieved 9 June 2019.
57. R, Bhagyashree (30 October 2018). "Google Chrome 70 now supports WebAssembly threads to build multi-threaded web applications". Packt Pub. Retrieved 9 June 2019.
58. Lonkar, Aishwarya; Chandrayan, Siddhesh (October 2018). "The dark side of WebAssembly". Virus Bulletin. Retrieved 8 June 2019.
59. Segura, Jérôme (29 November 2017). "Persistent drive-by cryptomining coming to a browser near you". Malwarebytes. Retrieved 8 June 2019.
60. "Recent Study Estimates That 50% of Websites Using WebAssembly Apply It for Malicious Purposes". InfoQ. Retrieved 3 November 2019.
61. Musch, Marius; Wressnegger, Christian; Johns, Martin; Rieck, Konrad (June 2019). "New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild" (PDF). Detection of Intrusions and Malware, and Vulnerability Assessment. Lecture Notes in Computer Science. 11543. Detection of Intrusions and Malware, and Vulnerability Assessment. pp. 23–42. doi:10.1007/978-3-030-22038-9_2. ISBN 978-3-030-22037-2. Retrieved 4 November 2019. Slides (PDF)
62. "Symbolically Executing WebAssembly in Manticore". 31 January 2020. Retrieved 10 February 2020.
63. "WebAssembly System Interface Repo". GitHub / WebAssembly. 10 February 2020.
64. "Additional background on Capabilities". GitHub. bytecodealliance.
65. "Standardizing WASI: A system interface to run WebAssembly outside the web – Mozilla Hacks - the Web developer blog". Mozilla Hacks – the Web developer blog.
66. "reference-sysroot Repo". GitHub / WebAssembly. 12 January 2020.
67. "wasm-c-api Repo". GitHub / WebAssembly. 3 February 2020.
68. "Design Rationale". GitHub / WebAssembly / design. 1 October 2016.
69. "Portability - WebAssembly". webassembly.org. Retrieved 28 July 2020.
70. "Conventions — WebAssembly 1.0". webassembly.github.io. Retrieved 12 November 2019.
71. "Introduction — WebAssembly 1.0". webassembly.github.io. Retrieved 17 May 2019.
72. "Instructions — WebAssembly 1.0". webassembly.github.io. Retrieved 12 November 2019.
73. "Roadmap". WebAssembly. March 2017.
74. jfbastien; rossberg-chromium; kripken; titzer; s3ththompson; sunfishcode; lukewagner; flagxor; enricobacis; c3d; binji; andrewosh (9 March 2017). "Text Format". WebAssembly/design. GitHub.
75. WebAssembly Community Group (January 2020). "WebAssembly Specification Release 1.0". Retrieved 13 January 2020.
76. "Folded instructions". GitHub. / WebAssembly / spec
77. "Modules (Binary)". WebAssembly 1.0.
78. "WebAssembly Binary Toolkit (wabt) demos". webassembly.github.io.

 This article incorporates text from a free content work. Licensed under Apache License 2.0 License statement: Text Format, jfbastien; rossberg-chromium; kripken; titzer; s3ththompson; sunfishcode; lukewagner; flagxor; enricobacis; c3d; binji; andrewosh, GitHub. WebAssembly/design. To learn how to add open license text to Wikipedia articles, please see this how-to page. For information on reusing text from Wikipedia, please see the terms of use.

Demo

• Widgets demo: with NWSTK
• 3D mountain geometry synthesis demo: with NWSTK
• Demo for loading and drawing a jpg file: with NWSTK

External links

• Official website
• W3C Community Group
• WebAssembly Design
• "WebAssembly", MDN Web Docs – with info on browser compatibility and specifications (WebAssembly JavaScript API)