The main goal of WebAssembly is to facilitate high-performance applications onweb pages, but it is also designed to be usable in non-web environments.[7] It is anopen standard[8][9] intended to support any language on any operating system,[10] and in practice many of the most popular languages already have at least some level of support.
The name "WebAssembly" is intended to suggest bringingassembly language programming to theWorld Wide Web, where it will be executedclient-side, by the website-user's computer via the user'sweb browser. To accomplish this, WebAssembly must be much more hardware-independent than a true assembly language.
In March 2017, the design of theminimum viable product (MVP) was declared to be finished and the preview phase ended.[25] In late September 2017,Safari 11 was released with support. In February 2018, the WebAssembly Working Group published three public working drafts for the Core Specification, JavaScript Interface, and Web API.[26][27][28][29]
In June 2019, Chrome 75 was released with WebAssembly threads enabled by default.[30]
Since April 2022,[update] WebAssembly 2.0 has been in draft status.[31][32] It adds manySIMD-related instructions and a new v128 datatype, with the ability for functions to return multiple values, and mass memory initialize/copy.
While WebAssembly was initially designed to permit near-native code execution speed in the web browser, it has been considered valuable outside of such, in more generalized contexts.[33][34] A WebAssembly runtime environment is a low-levelvirtual stack machine, akin toJVM orFlash VM; it can be embedded into any host application, and thus there have been created standalone WebAssembly runtime environments, includingWasmtime[Wikidata] andWasmer[Wikidata].[9][10] WebAssembly runtime environments are embedded inapplication servers to host "server-side" WebAssembly applications and in other applications to supportplug-in-based software extension architectures, e.g., "WebAssembly for Proxies" (Proxy-Wasm) which specifies a WebAssembly-basedABI for extendingproxy servers.[35][36]
In November 2017, Mozilla declared support "in all major browsers",[37] after WebAssembly was enabled by default in Edge [Legacy] 16.[38] This support also includes mobile web browsers for iOS and Android. As of March 2024,[update] 99% of tracked web browsers support WebAssembly (version 1.0),[39] more than for its predecessorasm.js.[40] For some extensions, from the 2.0 draft standard, support may be lower, but still more than 90% of web browsers may already support, e.g. the reference types extension.[41]
WebAssembly implementations generally use eitherahead-of-time (AOT) orjust-in-time (JIT) compilation, though some may also use aninterpreter. While the first implementations appeared in web browsers, there are now many non-browser implementations for general-purpose use.
Non-browser WebAssembly runtimes include Wasmer,[10] Wasmtime,[42] WAMR, WAVM, wasm3, and others.[43] These systems execute precompiled Wasm modules and often provide additional APIs for embedding WebAssembly in different environments.
Because WebAssembly executables are precompiled, a variety of programming languages can target Wasm.[44] Compilation is achieved either through direct output to Wasm or via intermediate virtual machines implemented in Wasm.
Notable toolchains include:
Emscripten, which compiles C and C++ to Wasm using Clang as a frontend, Binaryen as an optimizer, and can also target any LLVM-supported language.[25]
StandaloneClang (version 8 and later), which supports direct compilation to Wasm.[45]
LLVM-based workflows for languages such as Rust and AssemblyScript.[46]
Post-MVP developments in WebAssembly, such as support for multithreading and garbage collection (WasmGC), have enabled more efficient compilation for garbage-collected languages like C#, F#, and Python.[63][64]
In an October 2023 survey of developers, less than half of the 303 participants were satisfied with the state of WebAssembly. A large majority cited the need for improvement in four areas: WASI, debugging support, integration with JavaScript and browser APIs, and build tooling.[67]
For memory-intensive allocations in WebAssembly, there are "grave limitations that make many applications infeasible to bereliably deployed on mobile browsers [..] Currently allocating more than ~300MB of memory is not reliable on Chrome on Android without resorting to Chrome-specific workarounds, nor in Safari on iOS."[68]
All major browsers allow WebAssembly ifContent-Security-Policy is not specified, or if the valueunsafe-eval is used, but behave differently otherwise;[69] Chromerequiresunsafe-eval,[70][71] though a worker thread can be a workaround.[71]
In June 2018, a security researcher presented the possibility of using WebAssembly to circumvent browser mitigations forSpectre andMeltdown security vulnerabilities once support forthreads with shared memory is added. Due to this concern, WebAssembly developers put the feature on hold.[72][73][74] However, in order to explore these future language extensions, Google Chrome added experimental support for the WebAssembly thread proposal in October 2018.[75]
WebAssembly has been criticized for allowing greater ease of hiding the evidence formalware writers, scammers andphishing attackers; WebAssembly is present on the user's machine only in its compiled form, which "[makes malware] detection difficult".[76] Speed and the easy ability to conceal in WebAssembly have led to its use in hiddencrypto mining within the website visitor's device.[76][77][72]Coinhive, a now defunct service facilitating cryptocurrency mining in website visitors' browsers, claims their "miner uses WebAssembly and runs with about 65% of the performance of a native Miner."[72] A June 2019 study from theTechnische Universität Braunschweig analyzed the usage of WebAssembly in the Alexa top 1 million websites and found the prevalent use was for malicious crypto mining, and that malware accounted for more than half of the WebAssembly-using websites studied.[78][79] An April 2021 study fromUniversität Stuttgart found that since then crypto mining has been marginalized, falling to below 1% of all WebAssembly modules gathered from a wide range of sources, also including the Alexa top 1 million websites.[80]
As WebAssembly supports only structuredcontrol flow, it is amenable toward security verification techniques includingsymbolic execution.[81]
Early on, the execution speed of a Wasm program was benchmarked to be around 91% of (or about 10% slower than) a comparable native program, not including load/instantiation time; however, various later benchmarks indicate a wide range of performance characteristics, from 33% to 200%[citation needed] of the execution speed of native code, depending on the task.
In 2019, a group of researchers from theUniversity of Massachusetts Amherst presented a comprehensive analysis of WebAssembly's performance compared to native code.[82] This study used theSPEC CPU suite of benchmarks and a system called "Browsix-Wasm" to rununmodified Unix applications in the browser, thereby allowing for a test of real-world applications, finding a significant performance gap between Wasm execution and native execution; in particular, Wasm programs showed an average slowdown of 45% in Firefox and 55% in Chrome across the real-world benchmarks; peak slowdowns resulted in a Wasm program taking 2.08 times as long to run in Firefox and 2.5 times as long to run in Chrome. The paper identified several reasons for this performance difference, including missing optimizations, code generation issues in WebAssembly compilers, and inherent limitations of the WebAssembly platform itself.
A 2021 study suggested that WebAssembly is much faster than JavaScript in certain cases, such as running a complex function on a small file (e.g., processing a graphics file); however, at the time, the JavaScript interpreter had some optimizations available that the WebAssembly implemenations did not have (e.g.,Just-in-time compilation).[83]
In 2022, it was determined by researchers that a Wasm program runs at about 120% of (or 20% faster than) the speed of a comparable JavaScript program.[84] Those findings align with the experience of astartup company named "Zaplib", whose founders summarized in a blog that it was shutting down due to lack of performance in WebAssembly.[85] Their goal had been to significantly increase the performance of existingweb apps by incrementally porting them toRust/Wasm; however, porting a customer's simulator from JavaScript yielded only a 5% improvement in performance. Similarly, regardingFigma, they stated the following:
[Upon] closer inspection it seems that [Figma's] use of Wasm is more due to historical accidents—wanting to build inC++ to hedge for their native app—than for critical performance needs. Figma files are processed in C++/Wasm, and this is likely a huge speedup, but most of Figma's performance magic is due to theirWebGL renderer.
In 2023, a study of Wasm's performance for cryptographic tasks indicated that "when using the fastest runtime, WebAssembly was only about 2.32 times slower (median) than native code with architecture-specific optimizations." This result excluded 2 tests where the native code benefited from special instructions implemented directly in the CPU of the target platform; for those particular tests, the Wasm programs were "80 times slower than native code".[86]
Benchmarking has revealed several other pain-points for WebAssembly, such as poor performance because of no direct access to the DOM,[note 3] a problem which is being addressed.[88]
WebAssembly System Interface (WASI) is a simple interface (ABI andAPI) designed byMozilla, which is intended to be portable to any platform.[89] It providesPOSIX-like features like file I/O constrained bycapability-based security.[90][91] There are additional proposed ABI/APIs.[92][93]
Solomon Hykes [fr], a co-founder ofDocker, wrote in 2019, "If WASM+WASI existed in 2008, we wouldn't have needed to create Docker. That's how important it is. WebAssembly on the server is the future of computing."[95]
Wasm code (binary code, i.e. bytecode) is intended to be run on aportable virtualstack machine (VM).[96] The VM is designed to be faster to parse and execute than JavaScript and to have compact code representation.[97] Any external functionality (likesyscalls) that may be expected by Wasm binary code is not stipulated by the standard; instead, the standard specifies how the host environment can provide such an interface via a "module".[98][9]
A Wasm program is designed as a separate module containing collections of various Wasm-defined values and program type definitions. These are provided in either binary or textual format (see below) that have a common structure.[99] Such a module may provide a start function that is executed upon instantiation of a wasm binary.
The core standard for the binary format of a Wasm program defines aninstruction set architecture (ISA); each operation that can be executed by the VM is assigned a specificbinary encoding (an "opcode"), but the exact way in which the operation is implemented is not specified, allowing for flexibility in the construction of a VM.[100] The list of instructions includes standard memory load/store instructions, numeric, parametric,control of flowinstruction types and Wasm-specific variable instructions.[101]
The number of opcodes used in the original standard (MVP) was a bit fewer than 200 of the 256 possible opcodes. Subsequent versions of WebAssembly pushed the number of opcodes a bit over 200. TheWebAssembly SIMD proposal (for parallel processing) introduces an alternateopcode prefix (0xfd) for128-bit wideSIMD instructions; the concatenation of the SIMD prefix, plus an opcode that is valid after the SIMD prefix, forms each SIMD opcode. The SIMD opcodes bring an additional 236 instructions to theMVP's SIMD capability (for a total of around 436 instructions, and there ),[102][103] This set of instructions[104] are enabled by default across a number of important implementations:[105]
Google's V8 (in Google Chrome)
The SpiderMonkey engine in Mozilla Firefox
The JavaScriptCore engine in Apple's Safari
These SIMD opcodes are both portable and intended to map directly to native instruction sets likex86-64 andARM. In contrast, SIMD instructions are not directly supported by Java'sJVM[note 4] or.NET'sCIL; however, both do have some APIs for parallel processing, which provide SIMD speedups.
There are proposals for additional instructions, including a "relaxed-simd".[107]
In March 2017, the WebAssembly Community Group reached consensus on the initial ("MVP") binary format, JavaScript API, and reference interpreter.[108] It defines a WebAssembly binary format (.wasm), which is not designed to be used by humans, as well as a human-readable WebAssembly text format (.wat) that resembles a cross between S-expressions and traditional assembly languages.
The table below shows an example of afactorial function written inC and its corresponding WebAssembly code after compilation, shown both in.wat text format (a human-readable textual representation of WebAssembly) and in.wasm binary format (the rawbytecode, expressed below inhexadecimal), that is executed by a Web browser or run-time environment that supports WebAssembly.
All integer constants are encoded using a space-efficient, variable-lengthLEB128 encoding.[109]
The WebAssembly text format is more canonically written in a folded format usingS-expressions. For instructions and expressions, this format is purelysyntactic sugar and has no behavioral differences with the linear format.[110] Throughwasm2wat, the code above decompiles to:
(module(type$t0(func(parami64)(resulti64)))(func$f0(type$t0)(param$p0i64)(resulti64)(if$I0(resulti64);; $I0 is an unused label name(i64.eqz(local.get$p0));; the name $p0 is the same as 0 here(then(i64.const1))(else(i64.mul(local.get$p0)(call$f0;; the name $f0 is the same as 0 here(i64.sub(local.get$p0)(i64.const1))))))))
A module is implicitly generated by the compiler. The function is referenced by an entry of the type table in the binary, hence a type section and thetype emitted by the decompiler.[111] The compiler and decompiler can be accessed online.[112]
^The asm.js file already provides near-native code execution speeds: "Even discarding the one score where asm.js did better, it executes at around 70% of the speed (i.e., slower) of native C++ code.[24] and can be considered a viable alternative for browsers that do not support WebAssembly or have it disabled for security reasons.
^ForRust/Wasm development, third-party libraries can provide some of the necessary JavaScript I/O.[65][66]
^"WebAssembly provides no access to the surrounding environment other than via the JavaScript API described in the JS API specification."[87]
^There is an extension for Java addingintrinsics for x86-64 SIMD instructions,[106] that isn't portable, i.e. not usable on ARM or smartphones.
^"WebAssembly/design/Semantics.md".GitHub.Archived from the original on 15 June 2021. Retrieved23 February 2021.WebAssembly code can be considered astructured stack machine; a machine where most computations use a stack of values, but control flow is expressed in structured constructs such as blocks, ifs, and loops. In practice, implementations need not maintain an actual value stack, nor actual data structures for control; they need only behave as if they did so.
^ab"Conventions — WebAssembly 1.0".webassembly.github.io.Archived from the original on 6 May 2019. Retrieved17 May 2019.WebAssembly is a programming language that has multiple concrete representations (its binary format and the text format). Both map to a common structure.
^"Introduction — WebAssembly 1.0".webassembly.github.io.Archived from the original on 22 November 2021. Retrieved18 June 2019.... this specification is complemented by additional documents defining interfaces to specific embedding environments such as the Web. These will each define a WebAssembly application programming interface (API) suitable for a given environment.
^"Introduction — WebAssembly 1.1".webassembly.github.io.Archived from the original on 22 November 2021. Retrieved19 February 2021.Its main goal is to enable high performance applications on the Web, but it does not make any Web-specific assumptions or provide Web-specific features, so it can be employed in other environments as well.
^Haas, Andreas; Rossberg, Andreas; Schuff, Derek L.; Titzer, Ben L.; Holman, Michael; Gohman, Dan; Wagner, Luke; Zakai, Alon; Bastien, JF (14 June 2017)."Bringing the Web Up to Speed with WebAssembly".SIGPLAN Notices.52 (6):185–200.doi:10.1145/3140587.3062363.ISSN0362-1340.While the Web is the primary motivation for WebAssembly, nothing in its design depends on the Web or a JavaScript environment. It is an open standard specifically designed for embedding in multiple contexts, and we expect that stand-alone implementations will become available in the future.
^"stdweb - Rust".docs.rs.Archived from the original on 21 February 2019. Retrieved5 June 2019.The goal of this crate is to provide Rust bindings to the Web APIs and to allow a high degree of interoperability between Rust and JavaScript.
^"web_sys - Rust".docs.rs.Archived from the original on 15 May 2020. Retrieved5 June 2019.Raw API bindings for Web APIs. This is a procedurally generated crate from browser WebIDL which provides a binding to all APIs that browser provide on the web.
^Aaron Hilbig, Daniel Lehmann, and Michael Pradel (April 2021). "An Empirical Study of Real-World WebAssembly Binaries: Security, Languages, Use Cases." (Archived April 2021)https://software-lab.org/publications/www2021.pdf
"WebAssembly".MDN Web Docs. 16 April 2024.Archived from the original on 13 May 2022. Retrieved14 February 2018. Has info on browser compatibility and specifications (WebAssembly JavaScript API)
This article incorporates text from afree content work. Licensed under Apache License 2.0 (license statement/permission). Text taken fromText Format, jfbastien; rossberg-chromium; kripken; titzer; s3ththompson; sunfishcode; lukewagner; flagxor; enricobacis; c3d; binji; andrewosh, GitHub. WebAssembly/design.
