WebAssembly

Implementations

While WebAssembly was initially designed to permit near-native code execution speed in the web browser, it has been considered valuable outside of such, in more generalized contexts. A WebAssembly runtime environment is a low-level virtual stack machine, akin to JVM or Flash VM; it can be embedded into any host application, and thus there have been created standalone WebAssembly runtime environments, including Wasmtime , WebAssembly Micro Runtime , Wasmer , WasmEdge and wazero . WebAssembly runtime environments are embedded in application servers to host "server-side" WebAssembly applications and in other applications to support plug-in-based software extension architectures, e.g., WebAssembly for Proxies (Proxy-Wasm) which specifies a WebAssembly-based application binary interface (ABI) to extend proxy servers.

Web browsers

In November 2017, Mozilla declared support "in all major browsers", after WebAssembly was enabled by default in Edge [Legacy] 16. This support also includes mobile web browsers for iOS and Android. As of March 2024, 99% of tracked web browsers support WebAssembly (version 1.0), more than for its predecessor asm.js. For some extensions, from the 2.0 draft standard, support may be lower, but still more than 90% of web browsers may already support, e.g. the reference types extension.

Non-browser runtimes

Non-browser WebAssembly runtimes include Wasmer, Wasmtime, WAMR, WAVM, wasm3, and others. These systems execute precompiled Wasm modules and often provide additional APIs for embedding WebAssembly in different environments. Use cases for wasm outside the browser include plug-in interfaces and lightweight virtualization.

Compilers

WebAssembly implementations generally use either ahead-of-time (AOT) or just-in-time (JIT) compiling, though some may also use an interpreter. While the first implementations appeared in web browsers, there are now many non-browser implementations for general-purpose use.

Compiler toolchains

Because WebAssembly executables are precompiled, a variety of programming languages can target Wasm. Compiling is done either through direct output to Wasm or via intermediate virtual machines implemented in Wasm.

Notable toolchains include:

• Emscripten, which compiles C and C++ to Wasm using Clang as a frontend, Binaryen as an optimizer, and can also target any LLVM-supported language.
• Standalone Clang (version 8 and later), which supports direct compiling to Wasm.
• LLVM-based workflows for languages such as Rust and AssemblyScript.

Language support

As of 2021, around 40 programming languages support WebAssembly as a compiling target. Examples include:

• C and C++: via Emscripten or Clang standalone.
• Rust: via rustc with Wasm target.
• AssemblyScript: a TypeScript-like language compiling directly to Wasm.
• Go: native WebAssembly support introduced in Go 1.11.
• .NET languages: C# (via Blazor), F# (via Bolero and Blazor).
• Python: implementations such as Pyodide.
• Java and Java virtual machine (JVM) languages: via CheerpJ, JWebAssembly, and TeaVM.
• Kotlin: direct Wasm compiling support.
• Haskell: supported via Glasgow Haskell Compiler (GHC) backend.
• Julia: community implementations.
• Ruby: supported through MRuby.
• Ring: supported with Wasm backend.
• Dart: supported WebAssembly as a compiling target when building Dart and Flutter applications for the web.
• Scheme: GNU Guile via Hoot.

Limits

Web browsers prevent WebAssembly code from directly manipulating the Document Object Model. Wasm code must defer to JavaScript for this.

In an October 2023 survey of developers, less than half of the 303 participants were satisfied with the state of WebAssembly. A large majority cited the need for improvement in four areas: § WASI, debugging support, integration with JavaScript and browser APIs, and build tooling.

For memory-intensive allocations in WebAssembly, there are "grave limitations that make many applications infeasible to be reliably deployed on mobile browsers [..] Currently allocating more than ~300MB of memory is not reliable on Chrome on Android without resorting to Chrome-specific workarounds, nor in Safari on iOS."

All major browsers allow WebAssembly if Content-Security-Policy is not specified, or if the value unsafe-eval is used, but behave differently otherwise; Chrome requires unsafe-eval, though a worker thread can be a workaround.

Security considerations

In June 2018, a security researcher presented the possibility of using WebAssembly to circumvent browser mitigations for Spectre and Meltdown security vulnerabilities once support for threads with shared memory is added. Due to this concern, WebAssembly developers put the feature on hold. However, in order to explore these future language extensions, Google Chrome added experimental support for the WebAssembly thread proposal in October 2018.

WebAssembly has been criticized for allowing greater ease of hiding the evidence for malware writers, scammers and phishing attackers; WebAssembly is present on the user's machine only in its compiled form, which "[makes malware] detection difficult". Speed and the easy ability to conceal in WebAssembly have led to its use in hidden crypto mining within the website visitor's device. Coinhive, a now defunct service facilitating cryptocurrency mining in website visitors' browsers, claims their "miner uses WebAssembly and runs with about 65% of the performance of a native Miner." A June 2019 study from the Technische Universität Braunschweig analyzed the usage of WebAssembly in the Alexa top 1 million websites and found the prevalent use was for malicious crypto mining, and that malware accounted for more than half of the WebAssembly-using websites studied. An April 2021 study from Universität Stuttgart found that since then crypto mining has been marginalized, falling to below 1% of all WebAssembly modules gathered from a wide range of sources, also including the Alexa top 1 million websites.

As WebAssembly supports only structured control flow, it is amenable toward security verification techniques including symbolic execution.

Performance

Early on, the execution speed of a Wasm program was benchmarked to be around 91% of (or about 10% slower than) a comparable native program, not including load/instantiation time; however, various later benchmarks indicate a wide range of performance characteristics, from 33% to 200% of the execution speed of native code, depending on the task.

In 2019, a group of researchers from the University of Massachusetts Amherst presented a comprehensive analysis of WebAssembly's performance compared to native code. This study used the SPEC CPU suite of benchmarks and a system called "Browsix-Wasm" to run unmodified Unix applications in the browser, thereby allowing for a test of real-world applications, finding a significant performance gap between Wasm execution and native execution; in particular, Wasm programs showed an average slowdown of 45% in Firefox and 55% in Chrome across the real-world benchmarks; peak slowdowns resulted in a Wasm program taking 2.08 times as long to run in Firefox and 2.5 times as long to run in Chrome. The paper identified several reasons for this performance difference, including missing optimizations, code generation issues in WebAssembly compilers, and inherent limits of the WebAssembly platform.

A 2021 study suggested that WebAssembly is much faster than JavaScript in certain cases, such as running a complex function on a small file (e.g., processing a graphics file); however, at the time, the JavaScript interpreter had some optimizations available that the WebAssembly implementations did not have (e.g., Just-in-time compilation).

In 2022, it was determined by researchers that a Wasm program runs at about 120% of (or 20% faster than) the speed of a comparable JavaScript program. Those findings align with the experience of a startup company named "Zaplib", whose founders summarized in a blog that it was shutting down due to lack of performance in WebAssembly. Their goal had been to significantly increase the performance of existing web apps by incrementally porting them to Rust/Wasm; however, porting a customer's simulator from JavaScript yielded only a 5% improvement in performance. Similarly, regarding Figma, they stated the following:

[Upon] closer inspection it seems that [Figma's] use of Wasm is more due to historical accidents—wanting to build in C++ to hedge for their native app—than for critical performance needs. Figma files are processed in C++/Wasm, and this is likely a huge speedup, but most of Figma's performance magic is due to their WebGL renderer.

In 2023, a study of Wasm's performance for cryptographic tasks indicated that "when using the fastest runtime, WebAssembly was only about 2.32 times slower (median) than native code with architecture-specific optimizations." This result excluded 2 tests where the native code benefited from special instructions implemented directly in the CPU of the target platform; for those particular tests, the Wasm programs were "80 times slower than native code".

Benchmarking has revealed several other pain-points for WebAssembly, such as poor performance because of no direct access to the DOM, a problem which is being addressed.

WASI

WebAssembly System Interface (WASI) is a simple interface (application binary interface (ABI) and application programming interface (API)) designed by Mozilla, which is intended to be portable to any platform. It provides features similar to the Portable Operating System Interface (POSIX), such as file input/output (I/O) constrained by capability-based security. There are additional proposed ABI/APIs.

WASI is influenced by CloudABI and Capsicum.

Solomon Hykes, a co-founder of Docker, wrote in 2019, "If WASM+WASI existed in 2008, we wouldn't have needed to create Docker. That's how important it is. WebAssembly on the server is the future of computing."

WASI 0.1 provides a few POSIX-like APIs such as file I/O, reading environment variables, and random-number generation, but has very little support for networking. WASI 0.2 is redesigned based on the WebAssembly Component Model. WASI 0.3 will add support for async functions; the host translates between blocking and async function calls, so an exported function that blocks may be called as an asynchronous function, and vice-versa.

Starting in 0.2, WASI is defined in terms of the component model. Interfaces in the component model are specified in an IDL called WIT (WebAssembly Interface Types). While core wasm only supports integer and floating-point numbers, interfaces in WIT can express types such as strings, lists, and user-defined record and variant types, and are language-agnostic. Components cannot access each other's memory, and so interact only via imported and exported functions. The component model is designed around composition: two components can be composed into a single component when the exports of one component match another's imports, allowing any interface to be virtualized. Interfaces in WIT are grouped together into a "world". WASI 0.2 defines a CLI world similar to the POSIX-like API of WASI 0.1, and an HTTP proxy world for web servers. WASI 0.2 (also known as Preview 2) was released on January 25, 2024, introducing the Component Model and WIT (WebAssembly Interface Types), which enable cross-language module composition and networking support via TCP/UDP sockets.

The component model is not currently supported by browsers.

Specification

Host environment

The general standard provides core specifications for the JavaScript API and details on embedding.

Virtual machine

Wasm code (binary code, i.e. bytecode) is intended to be run on a portable virtual stack machine (VM). The VM is designed to be faster to parse and execute than JavaScript and to have compact code representation. Any external functionality (like syscalls) that may be expected by Wasm binary code is not stipulated by the standard; instead, the standard specifies how the host environment can provide such an interface via a "module".

Wasm program

A Wasm program is designed as a separate module containing collections of various Wasm-defined values and program type definitions. These are provided in either binary or textual format (see below) that have a common structure. Such a module may provide a start function that is executed upon instantiation of a wasm binary.

Instruction set

The core standard for the binary format of a Wasm program defines an instruction set architecture (ISA); each operation that can be executed by the VM is assigned a specific binary encoding (an "opcode"), but the exact way in which the operation is implemented is not specified, allowing for flexibility in the construction of a VM. The list of instruction types includes those for standard memory load/store, numeric, parametric, control flow, and Wasm-specific variables.

The number of opcodes used in the original standard (§ MVP) was a bit fewer than 200 of the 256 possible opcodes. Subsequent versions of WebAssembly pushed the number of opcodes a bit over 200. The WebAssembly SIMD proposal (for parallel processing) introduces an alternate opcode prefix (0xfd) for 128-bit wide SIMD instructions; the concatenation of the SIMD prefix, plus an opcode that is valid after the SIMD prefix, forms each SIMD opcode. The SIMD opcodes bring an additional 236 instructions to the MVP's SIMD ability (for a total of around 436 instructions). This set of instructions is enabled by default across a number of important implementations:

1. Google's V8 (in Google Chrome)
2. The SpiderMonkey engine in Mozilla Firefox
3. The JavaScriptCore engine in Apple's Safari

These SIMD opcodes are both portable and intended to map directly to native instruction sets like x86-64 and ARM. In contrast, SIMD instructions are not directly supported by Java's JVM or .NET's CIL; however, both do have some APIs for parallel processing, which provide SIMD speedups. A newer set of "relaxed SIMD" instructions allow for a limited amount of implementation-defined behavior to improve performance.

Code representation

In March 2017, the WebAssembly Community Group reached consensus on the initial ("MVP") binary format, JavaScript API, and reference interpreter. It defines a WebAssembly binary format (.wasm), which is designed to be used by computers, not humans, and a text format that is human-readable (.wat), resembling a cross between S-expressions and traditional assembly languages. The binary format is straightforward and designed to allow streaming compiling, so compiling can begin before the module is finished downloading, and to allow functions to be compiled in parallel.

The table below shows an example of a factorial function written in C and its corresponding WebAssembly code after compiling, shown both in .wat text format (a human-readable textual representation of WebAssembly) and in .wasm binary format (the raw bytecode, expressed below in hexadecimal), that is executed by a Web browser or run-time environment that supports WebAssembly.

All integer constants are encoded using a space-efficient, variable-length LEB128 encoding.

The WebAssembly text format is more canonically written in a folded format using S-expressions. For instructions and expressions, this format is purely syntactic sugar and has no behavioral differences with the linear format. Through wasm2wat, the code above decompiles to:

<span id="mwA50"></span><span class="p" id="mwA54">(</span><span class="k" id="mwA58">module</span> <span class="p" id="mwA6A">(</span><span class="k" id="mwA6E">type</span> <span class="nv" id="mwA6I">$t0</span> <span class="p" id="mwA6M">(</span><span class="k" id="mwA6Q">func</span> <span class="p" id="mwA6U">(</span><span class="k" id="mwA6Y">param</span> <span class="kt" id="mwA6c">i64</span><span class="p" id="mwA6g">)</span> <span class="p" id="mwA6k">(</span><span class="k" id="mwA6o">result</span> <span class="kt" id="mwA6s">i64</span><span class="p" id="mwA6w">)))</span> <span class="p" id="mwA60">(</span><span class="k" id="mwA64">func</span> <span class="nv" id="mwA68">$f0</span> <span class="p" id="mwA7A">(</span><span class="k" id="mwA7E">type</span> <span class="nv" id="mwA7I">$t0</span><span class="p" id="mwA7M">)</span> <span class="p" id="mwA7Q">(</span><span class="k" id="mwA7U">param</span> <span class="nv" id="mwA7Y">$p0</span> <span class="kt" id="mwA7c">i64</span><span class="p" id="mwA7g">)</span> <span class="p" id="mwA7k">(</span><span class="k" id="mwA7o">result</span> <span class="kt" id="mwA7s">i64</span><span class="p" id="mwA7w">)</span> <span class="p" id="mwA70">(</span><span class="k" id="mwA74">if</span> <span class="nv" id="mwA78">$I0</span> <span class="p" id="mwA8A">(</span><span class="k" id="mwA8E">result</span> <span class="kt" id="mwA8I">i64</span><span class="p" id="mwA8M">)</span> <span class="c1" id="mwA8Q">;; $I0 is an unused label name</span> <span class="p" id="mwA8U">(</span><span class="nb" id="mwA8Y">i64.eqz</span> <span class="p" id="mwA8c">(</span><span class="nb" id="mwA8g">local.get</span> <span class="nv" id="mwA8k">$p0</span><span class="p" id="mwA8o">))</span> <span class="c1" id="mwA8s">;; the name $p0 is the same as 0 here</span> <span class="p" id="mwA8w">(</span><span class="k" id="mwA80">then</span> <span class="p" id="mwA84">(</span><span class="nb" id="mwA88">i64.const</span> <span class="mi" id="mwA9A">1</span><span class="p" id="mwA9E">))</span> <span class="p" id="mwA9I">(</span><span class="k" id="mwA9M">else</span> <span class="p" id="mwA9Q">(</span><span class="nb" id="mwA9U">i64.mul</span> <span class="p" id="mwA9Y">(</span><span class="nb" id="mwA9c">local.get</span> <span class="nv" id="mwA9g">$p0</span><span class="p" id="mwA9k">)</span> <span class="p" id="mwA9o">(</span><span class="nb" id="mwA9s">call</span> <span class="nv" id="mwA9w">$f0</span> <span class="c1" id="mwA90">;; the name $f0 is the same as 0 here</span> <span class="p" id="mwA94">(</span><span class="nb" id="mwA98">i64.sub</span> <span class="p" id="mwA-A">(</span><span class="nb" id="mwA-E">local.get</span> <span class="nv" id="mwA-I">$p0</span><span class="p" id="mwA-M">)</span> <span class="p" id="mwA-Q">(</span><span class="nb" id="mwA-U">i64.const</span> <span class="mi" id="mwA-Y">1</span><span class="p" id="mwA-c">))))))))</span>

A module is implicitly generated by the compiler. The function is referenced by an entry of the type table in the binary, hence a type section and the type emitted by the decompiler. The compiler and decompiler can be accessed online.

Memory and variables

Data in memory is stored in a large, growable array of bytes termed a linear memory. Linear memory is separate from the wasm module's call stack and code and the engine's memory. This allows running wasm code in the same process as the JavaScript virtual machine it's embedded in without violating memory safety.

A module contains a list of global variables separate from linear memory, which may be mutable or immutable. Functions declare a list of local variables. A function's parameters are also local variables.

Instructions operate on a stack of values. The stack layout is fixed (branches must push and pop the same number of operands), so wasm engines can compile the stack away, producing efficient machine code operations on registers, rather than managing a stack at runtime. A stack machine architecture was chosen as it can have higher code density than a register machine.

Control flow

Unlike typical assembly languages, wasm only uses structured control flow similar to high-level programming languages. The intentional lack of support for jump instructions makes it simple to validate and compile wasm code in a single pass, and makes it easier to read code disassembled into the text format.

Blocks are delimited with the block, loop, and if/else constructs. Branch instructions contain a label that identifies the depth of a block it is nested in: br 0 will branch to the block the instruction is contained in, br 1 will branch to the block that block is contained in, and so on. Branches to a block or if jump to the end of the block like a break statement, while branches to a loop jump back to the beginning of the loop, similar to a continue statement. The br_table instruction takes an input index and jumps to a target from a list of labels. A C-style switch statement can be expressed with a br_table inside a series of nested blocks.

Compilers targeting wasm convert unstructured control flow into high-level loops using Emscripten's Relooper algorithm, originally designed to target JavaScript.

Functions

Function declarations are listed in a separate section before the section containing the function bodies. Function pointers are emulated using an index into the global functions table, since code is not inside the linear memory. Functions can also be imported and exported, providing the foreign function interface to communicate with JavaScript or other embedders.