exception-handling VS webcontainer-core

Interesting article, thanks!

Notes on the issues mentioned there:

* The need for a manual shadow stack: This is fixed in WasmGC (in the same way it works in JS, as the link mentions).

* Lack of try-catch: This is fixed by the Wasm exception handling proposal, which has already shipped in browsers, https://github.com/WebAssembly/exception-handling/blob/main/...

* Null checks: Mostly fixed by WasmGC. The spec defines non-nullable local types, and VMs can use the techniques the article mentions to optimize them using signals (Wizard does, for example).

* Class initialization: This is a difficult problem, as the article says. J2Wasm and Binaryen are working to optimize it through static analysis at the toolchain level. Here is a recent PR I wrote that makes progress there: https://github.com/WebAssembly/binaryen/pull/6061

* The vtable overhead issue the article mentions may be a problem. I'm not aware of good measurements on it, through. There are some ideas on post-MVP solutions for method dispatch that might help, but nothing concrete yet.

* Checks for null and trapping: There has been discussion of variants on the GC instructions that throw instead of trap. Measurements, however, have not shown it to be a big problem atm, so it is low priority.

The author is right that stack walking, signals, and memory control are important areas that could help here.

Overall with WasmGC and exceptions we are in a pretty good place for Java as emitted by J2Wasm today: it is usually faster than J2CL which compiles Java to JavaScript. But there is definitely room for improvement.

It uses https://github.com/WebAssembly/exception-handling/blob/master/proposals/exception-handling/Exceptions.md which is actually supported by all major browsers already.

Yep, you're right. It's also more than just the DOM, it's web APIs in general, such as fetch, audio, webgl/webgpu, etc. WASM still needs GC, exceptions, and WASI to be able to fully interop with any host without any of the current limitations. This'll take a few years. I'm looking forward to the future in which I will be shipping WASM-only web apps to my users.

Its a part of the wasm plan to support gc https://github.com/WebAssembly/gc exceptions https://github.com/WebAssembly/exception-handling

As of Node.js 17, the v8 JavaScript engine has been updated to v9.5. The changes in this release are primarily aimed at expanding internationalization for dates and calendars as well as for the output of time zones. It also implements the WebAssembly Exception Handling proposal, designed to reduce overhead compared to current JavaScript-based workarounds.

Agreed, although at some point in a not very far feature most of those missing features will resolved. So in my mind is just a matter of time. The Wasm Community group is doing an awesome work on that :)

Here are a few examples of what needs move forward in Wasm:

* [1] Wasm Exceptions Handling: Right now Wasm is missing a way to handle exceptions natively (C++ programs can only compile to Wasm using the asyncify or longjmp/setjmp tricks via Js try/catch)

* [2] Wasm GC: Wasm Binary files are quite big (specially in interpreted languages). This is partially caused by the GC being included in the Binary itself. The GC proposal will solve this while also providing faster execution.

* [3] Wasm 64-bit Memory: currently Wasm can only operate with 32-bit data. In some contexts you may want you operate with more than 4GB of memory (for example, when operating over terabytes of data). The 64-bit memory proposal will solve that.

[1]: https://github.com/WebAssembly/exception-handling

How does it work? There is no backend whatsoever. The API Security Academy leverages WebContainers, a new technology that allows running full-blown node instances directly in the browser. Each WebContainer contains a live GraphQL application, so you'll not only understand why a vulnerability is risky, but also how to exploit it and, most importantly, how to fix it.

StackBlitz made the claim "... run Node.js, entirely inside your browser" #658, then had to revise it's claim to "We currently do not expose a way to use WebContainer outside of StackBlitz.com,".

> Wasm though seems like the likely general heir, and will have many different offerings for how to do that (Deno being one!).

I was recently blown away by some ideas that StackBlitz [0] apply based on WebContainers. The idea of a "server in the browser", they allow you to run Node-based environment like that via Wasm.

[0] https://stackblitz.com/

[1] https://webcontainers.io/

See https://webcontainers.io.

This very simple fact is well known flaw, which was already often criticized and asked for solutions by users. It doesn't only affect this kind of very exotic bootstrap applications but also significantly limits rusts usefulness in many other areas. Pure browser based scientific code documentation and example notebooks (e.g. jupyterLite) and sandboxed CI and IDE solutions (e.g. web containers) as available for many other languages are simply not available for rust because of this very fundamental issue.

Looks like they plan to open it. From the FAQ section of README (https://github.com/stackblitz/webcontainer-core#faqs):

> Is there a developer API?

I'm skeptical about stackblitz claims. The last time I checked that is closed source code https://github.com/stackblitz/webcontainer-core/issues/658.

StackBlitz claimed https://blog.stackblitz.com/posts/introducing-webcontainers/ to have implemented Node.js in the browser, though I have not observed any evidence of that being true and correct https://github.com/stackblitz/webcontainer-core/issues/658.

The other honorable mention is StackBlitz, a web-based web editor for making containers that run Javascript applications. Interestingly, StackBlitz is championing WebContainers, a technology that allows developers to start NodeJS servers within the browser. The downside is, this technology only works with Javascript-based projects (NodeJS, NextJS, etc). I include it here because WebContainers could easily be extended to support other languages via WASM, like Ruby. I’ll also add in Buildah, a tool for building OCI images. I won’t say much about this tool because it’s designed for building images; you still need another service, like Podman, to actually create the containers.