LGTM On Wed, Jan 29, 2025 at 3:29 PM 'Deepti Gandluri' via blink-dev < blink-dev@chromium.org> wrote:
> Adding to Francis's reply, JSPI has been inherently hard to specify, and > validate security requirements for given that it is somewhat sandwiched > between JS & Wasm. Concretely, since the last OT extension, the late > breaking changes have been merged into the specification and we've gotten > more signals about the exploitable security surface of JSPI (OT features > are treated as shipped features for V8), and we'd like to focus on > hardening security ahead of an intent to ship. > > At each extension milestone, we've had high quality feedback for > performance, API usage and the security surface exposed. I'd also like to > add that trials for Wasm features do inherently take longer than regular > Web APIs because it is at the lowest levels of Web APIs. Once a feature is > available, it does take some time for the feature usage to be implemented > by the libraries or frameworks, and enabled in the end applications which > need updated versions of libraries frameworks. Ideally, we would like all > of these to happen in lock step, but realistically that doesn't always > happen. > > -Deepti > > On Wed, Jan 29, 2025 at 10:22 AM 'Francis McCabe' via blink-dev < > blink-dev@chromium.org> wrote: > >> I also did not wish to have to extend the OT :) >> We encountered a couple of issues: >> 1. We had some late breaking requests to modify the API; this is a >> standards-track effort. I think that this sometimes happens when we are >> about to finalize a spec! >> 2. We have had a few reports of exploitable bugs. Due to the holidays >> etc, it has taken us some time to fix them. And we would really like to do >> our best to let the dust settle a bit more before shipping. >> >> We plan to go for phase 4 in early February. Assuming that that succeeds, >> we will be in a position to ship soon after. >> >> Francis >> >> On Wednesday, January 29, 2025 at 8:29:59 AM UTC-8 sligh...@chromium.org >> wrote: >> >>> Hey Francis, >>> >>> This feature is exciting, and I'm glad to see it moving forward. That >>> said, this extension would push the OT past a year, which is a bit of a >>> concern. Have you considered, perhaps, pushing forward with a gapless >>> intent-to-ship? If you're happy with the developer feedback to date, and >>> intend to ship this API shape, I'd be more willing to approve the OT >>> extension if it was in the shadow of getting this into the hands of >>> developers. The counterpoint might be that we expect to learn something >>> important and new in this extension that we haven't learned in the previous >>> OT windows, which would be somewhat surprising, but can happen. Is that >>> likely? >>> >>> Best, >>> >>> Alex >>> >>> On Monday, January 27, 2025 at 1:05:26 PM UTC-8 Francis McCabe wrote: >>> >>>> Contact emailsf...@chromium.org >>>> >>>> Explainer >>>> https://github.com/WebAssembly/js-promise-integration/blob/main/proposals/js-promise-integration/Overview.md >>>> >>>> Specification >>>> https://github.com/WebAssembly/js-promise-integration/blob/main/proposals/js-promise-integration/Overview.md >>>> >>>> Design docs >>>> >>>> https://docs.google.com/document/d/16Us-pyte2-9DECJDfGm5tnUpfngJJOc8jbj54HMqE9Y/edit#heading=h.n1atlriavj6v >>>> >>>> Summary >>>> >>>> Stack Switching denotes a technology that allows programs to suspend >>>> and resume computation. This is an active area that is part of the >>>> WebAssembly standards track. See >>>> https://github.com/WebAssembly/stack-switching and >>>> https://github.com/WebAssembly/meetings/tree/main/stack. This >>>> particular feature refers to the integration between JavaScript Promises >>>> and stack switching. This is described in more detail in >>>> https://docs.google.com/document/d/16Us-pyte2-9DECJDfGm5tnUpfngJJOc8jbj54HMqE9Y/edit# >>>> >>>> >>>> Blink componentBlink>JavaScript>WebAssembly >>>> <https://issues.chromium.org/issues?q=customfield1222907:%22Blink%3EJavaScript%3EWebAssembly%22> >>>> >>>> Search tagsstack switching >>>> <https://chromestatus.com/features#tags:stack%20switching>, Promise >>>> <https://chromestatus.com/features#tags:Promise>, JSPI >>>> <https://chromestatus.com/features#tags:JSPI> >>>> >>>> TAG reviewhttps://github.com/w3ctag/design-reviews/issues/809 Review >>>> was declined, deferring to W3C WebAssembly CG >>>> >>>> TAG review statusPending >>>> >>>> Origin Trial NameWebAssembly JavaScript Promise Integration >>>> >>>> Chromium Trial NameWebAssemblyJSPromiseIntegration >>>> >>>> Origin Trial documentation link >>>> https://github.com/WebAssembly/js-promise-integration >>>> >>>> WebFeature UseCounter namekV8WasmJavaScriptPromiseIntegration >>>> >>>> Risks >>>> >>>> >>>> Interoperability and Compatibility >>>> >>>> This spec is backed by a standardization effort. We do not plan to ship >>>> the JSPI until it has been standardized by the W3C Wasm WG. However, post >>>> standardization, we will depend on all browsers implementing the standard. >>>> >>>> >>>> *Gecko*: Positive (https://bugzilla.mozilla.org/show_bug.cgi?id=1850627) >>>> Mozilla have an experimental imlementation available in the nightly build >>>> >>>> *WebKit*: No signal >>>> >>>> *Web developers*: No signals >>>> >>>> *Other signals*: >>>> >>>> Activation >>>> >>>> Making use of JSPI requires some changes by WebAssembly-based >>>> developers (no impact on JavaScript developers). Depending on their >>>> toolchain usage a developer will need to modify their code. For Emscripten >>>> users, this is likely to be minimal as support for JSPI exists in >>>> Emscripten. >>>> >>>> >>>> Security >>>> >>>> 1. Control flow integrity. 2. Ensuring that JavaScript programs cannot >>>> suspend via JSPI. >>>> >>>> >>>> WebView application risks >>>> >>>> Does this intent deprecate or change behavior of existing APIs, such >>>> that it has potentially high risk for Android WebView-based applications? >>>> >>>> >>>> >>>> Goals for experimentation >>>> >>>> >>>> >>>> Reason this experiment is being extended >>>> >>>> JSPI is part of a standards track effort. We are currently in 'stage 3' >>>> of a five stage process. The next stage (4) is when a specification is >>>> deemed final. >>>> >>>> >>>> There have been one or two small changes to the API which have >>>> prevented moving to phase 4. The text of the specification is much closer >>>> to being final than in previous rounds of the origin trial. However, we >>>> would like some time to further bake the revised API. >>>> >>>> We anticipate being able to fully ship JSPI before the end of 2025Q2. >>>> >>>> Ongoing technical constraints >>>> >>>> None. >>>> >>>> >>>> Debuggability >>>> >>>> Developers can piggyback on existing DevTools support for Promises to >>>> help with debugging JSPI applications. In particular the existing >>>> mechanisms for constructing extended stack traces from so-called Promise >>>> chains will also include stack traces from JSPI applications. >>>> >>>> >>>> Will this feature be supported on all six Blink platforms (Windows, >>>> Mac, Linux, ChromeOS, Android, and Android WebView)?Yes >>>> >>>> Is this feature fully tested by web-platform-tests >>>> <https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md> >>>> ? >>>> Yes >>>> >>>> Flag name on about://flagsenable-experimental-webassembly-jspi >>>> >>>> Finch feature nameNone >>>> >>>> Non-finch justificationNone >>>> >>>> Requires code in //chrome?False >>>> >>>> Tracking bug >>>> https://bugs.chromium.org/p/v8/issues/detail?id=12191&q=owner%3Ame&can=2 >>>> >>>> Estimated milestones >>>> Origin trial desktop first 123 >>>> Origin trial desktop last 131 >>>> Origin trial extension 1 end milestone 131 >>>> Origin trial extension 2 end milestone 133 >>>> Origin trial extension 3 end milestone 136 >>>> DevTrial on desktop 109 >>>> Origin trial Android first 123 >>>> Origin trial Android last 131 >>>> Origin trial WebView first 123 >>>> Origin trial WebView last 131 >>>> >>>> Link to entry on the Chrome Platform Status >>>> https://chromestatus.com/feature/5674874568704000?gate=5136083140214784 >>>> >>>> Links to previous Intent discussionsIntent to Prototype: >>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAAdKk6BGFseZ6pBO2qEW_xeovVw1_guVq26rcNM1nWY442Y5Ng%40mail.gmail.com >>>> Intent to Experiment: >>>> https://groups.google.com/a/chromium.org/g/blink-dev/c/Fu79zrp7MoE >>>> Intent to Extend Experiment 1: >>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CALi9WK-JJNTYSeNdSuai827Qg5%3D2vZo-emYP2z-5vJOfE%2B8Nng%40mail.gmail.com >>>> Intent to Extend Experiment 2: >>>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/67103777.2b0a0220.137ef7.0e4c.GAE%40google.com >>>> >>>> >>>> This intent message was generated by Chrome Platform Status >>>> <https://chromestatus.com/>. >>>> >>> -- >> You received this message because you are subscribed to the Google Groups >> "blink-dev" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to blink-dev+unsubscr...@chromium.org. >> To view this discussion visit >> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/29cdb43b-2512-4595-806d-c90cbc9d0ce6n%40chromium.org >> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/29cdb43b-2512-4595-806d-c90cbc9d0ce6n%40chromium.org?utm_medium=email&utm_source=footer> >> . >> > -- > You received this message because you are subscribed to the Google Groups > "blink-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to blink-dev+unsubscr...@chromium.org. > To view this discussion visit > https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CANT_J8ewyDV5E%2Bkfnwa5ZrJLGLAVD8FWA68%2BBxMttOh_%2BYg6jA%40mail.gmail.com > <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CANT_J8ewyDV5E%2Bkfnwa5ZrJLGLAVD8FWA68%2BBxMttOh_%2BYg6jA%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscr...@chromium.org. To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAOMQ%2Bw89XL3K4ddocA14-n65gUOQ-Pp-knPfEVQp%3DxA%2BB8Rj6g%40mail.gmail.com.
