Shipping Rust in Firefox

TL;DR: Starting with Firefox 48, Mozilla is shipping its first production Rust code, with more to come!

Mozilla ❤ Rust

It’s hard to believe it’s been almost seven years since Mozilla Research first began sponsoring the development of Rust, at the time little more than an ambitious research experiment with a small but devoted community. Remarkably, despite a long history of inventions and discoveries, Rust’s key principles have remained constant. The Rust core team’s original vision—a safe alternative to C++ to make systems programmers more productive, mission-critical software less prone to memory exploits, and parallel algorithms more tractable—has been central to Mozilla’s interest in backing the Rust project and, ultimately, using Rust in production.

An equally promising development has been the fact that Rust’s safety and modern features are attracting new people to systems programming. For Mozilla, where community-based development is quite literally our mission, widening our circle is vital.

So I’m pleased to mark an important milestone: with Firefox 48, Mozilla will ship our first Rust component to all desktop platforms, and with Android support coming soon.

Building Rust into Mozilla’s media stack

One of the first groups at Mozilla to make use of Rust was the Media Playback team. Now, it’s certainly easy to see that media is at the heart of the modern Web experience. What may be less obvious to the non-paranoid is that every time a browser plays a seemingly innocuous video (say, a chameleon popping bubbles), it’s reading data delivered in a complex format and created by someone you don’t know and don’t trust. And as it turns out, media formats are known to have been used to trick decoders into exposing nasty security vulnerabilities that exploit memory management bugs in Web browsers’ implementation code.

This makes a memory-safe programming language like Rust a compelling addition to Mozilla’s tool-chest for protecting against potentially malicious media content on the Web. For this reason, Ralph Giles and Matthew Gregan built Mozilla’s first Rust media parser. And I’m happy to report that their code will be the first Rust component shipping in Firefox. For the Rust community as well, this is a real achievement: Rust code shipping to hundreds of millions of Firefox users. Our preliminary measurements show the Rust component performing beautifully and delivering identical results to the original C++ component it’s replacing—but now implemented in a memory-safe programming language.

Telemetry data for Firefox's first Rust component
Firefox telemetry data showing zero issues in over a billion uses of the new Rust code.

More to come!

Many people deserve huge thanks for getting us to this point. Ralph Giles and Matthew Gregan implemented the component, and Nathan Froyd, Nick Nethercote, Ted Mielczarek, Gregory Szorc, and Alex Crichton have been instrumental in integrating Rust into the Firefox build and tooling system and ensuring it can ship on all of our platforms.

Rust itself is the product of a tremendous, vibrant community. None of this work would have been possible without the incredible contributions of issues, design, code, and so much more of Rustaceans worldwide. As a Rustacean myself, I’d encourage you to come play with Rust. It’s a great time to get started, and increasingly, to get involved with a Mozilla project using Rust.

Seeing Rust code ship in production at Mozilla feels like the culmination of a long journey. But this is only the first step for Mozilla. Watch this space!

About Dave Herman

Dave Herman is a Principal Researcher and Director of Strategy at Mozilla Research.

More articles by Dave Herman…


24 comments

  1. Felix Schwarz

    Does that mean that rust is now a mandatory requirement for building Firefox? Just asking because some distros (i.e. Fedora) don’t have a rust compiler in their repos yet so they might need another nudge.

    July 12th, 2016 at 07:43

    1. Nick Anstee

      The rust distribution binaries from rust-lang (at least installed through the script mentioned on the downloads page) supports installing into your home directory (and adding it to path), so it shouldn’t be much of an issue

      July 12th, 2016 at 12:07

      1. Felix Schwarz

        My point was less building Firefox myself but more about the distro provided Firefox. Fedora (and at least Debian) will not use any pre-built binaries (e.g. precompiled rustc) to build Firefox. The only exception might be the initial compilation of a rustc package.

        However I think it is good for Linux distros that the rust code is not mandatory yet so they don’t have to rush getting rust in (although I certainly welcome the addition of rust distro packages and I *really* appreciate Mozilla’s work/funding for rust).

        July 13th, 2016 at 00:26

    2. Lars Bergstrom

      Not yet! See https://bugzilla.mozilla.org/show_bug.cgi?id=1284816 for when that will officially happen.

      We have active discussions from the Rust side on getting the rust compiler into all of the major Linux distributions. There’s definitely some complexity there, but the Rust community is working hard on doing it before Firefox would require Rust to build by default.

      July 12th, 2016 at 12:31

    3. mark

      Really, gcc should just natively support Rust as it does with C++. Then we don’t have any real issues really.

      July 12th, 2016 at 14:45

      1. Stephanie

        That’s not so easy at present. Rust’s inherent security properties are from compile-time checks, which require a very specialized compiler.

        July 13th, 2016 at 11:22

    4. Gregory Szorc

      Requiring Rust to build Firefox is tracked at https://bugzilla.mozilla.org/show_bug.cgi?id=1284816.

      July 12th, 2016 at 16:54

    5. Daniel

      I think rustup lets you set up a Rust compiler almost as quickly as a distro package.

      July 12th, 2016 at 16:58

      1. Emil

        The problem is that distributions haven’t got it in their toolchain. You can’t reasonably have a build dependency which isn’t automatically installable from the package manager.

        So if Firefox required Rust before the repos supported Rust, that would mean they would lag behind in Fx versions until they’ve packaged Rust.

        July 13th, 2016 at 00:18

  2. Russell Irvin Johnston

    Congrats – a great advance, in fact – quite possibly one for the history books.

    Code that doesn’t have to be debugged ad nauseum is absolutely worth more effort – in fact a lot of more effort – but I’m sure we’re all still curious:

    How difficult was it to match the speed (of the previous code?) (As opposed to get a competent, working module.) How difficult was it to get that last 10% of speed?

    How fast or slow was development, in general, compared to C++ and will experience (and possibly better tools) be able to slash those times? (No doubt extra care and checks were necessary this first time.)

    July 12th, 2016 at 10:41

    1. Lars Bergstrom

      Thanks for the kind words!

      The speed of this particular component is not on the critical path, and Rust was able to immediately match the performance of the C code, so far as we could tell from the automated tests. That said, we’ve certainly seen that there are cases in Servo where our Rust code has required additional work (e.g., inlining hints to the compiler) in order to get the performance of similarly-hinted C++ code.

      The development time has been similar, but there is definitely some additional ramp-up time for new Rust developers. Nearly everybody struggles initially with “the borrow checker” (https://doc.rust-lang.org/book/references-and-borrowing.html), a key piece of the Rust type system and its static guarantees, but that certainly seems to pay out in a lack of debugging use-after-free or out-of-bounds memory accesses later!

      One bit of extra unanticipated work here was debugging thread creation. In Rust, it’s very easy to safely spawn threads and do the work in them. However, Firefox sometimes runs on older machines with very little memory and we had to write additional code to handle the case where there is not even enough memory left to spawn a thread! This was an interesting challenge in writing Rust code for a production system that we hadn’t encountered (yet) in other projects.

      July 12th, 2016 at 12:36

      1. Rohit

        Could you expand just a tiny bit more on how you solved this problem of not having enough memory to spawn a thread? Or better still, write a blog post and post the link here :)

        July 13th, 2016 at 03:29

        1. Jack Moffitt

          This crash was solved here: https://bugzilla.mozilla.org/show_bug.cgi?id=1266309#c17

          The solution was to use the fallible thread builder API which returns an error instead of crashing.

          July 15th, 2016 at 08:09

  3. Gabriela

    Awesome news!!! Is this going to be for all platforms though?

    July 12th, 2016 at 15:49

    1. Lars Bergstrom

      You can see the per-platform release dates (and other Rust features!) here:
      https://wiki.mozilla.org/Oxidation

      July 12th, 2016 at 17:12

      1. Gabriela

        Right, thanks!

        July 14th, 2016 at 20:18

  4. RustyKrab

    Oh, nice! Firefox… you may

    Rust
    In
    Pieces!
    (in a good way)
    _I’ll see myself out._

    July 12th, 2016 at 19:10

    1. Walid Damouny

      Me giggles :D

      July 13th, 2016 at 13:49

  5. Igor Tupi

    Please consider integrating Firefox into the KDE Plasma environment too in this phase. We just want proper save dialogs.

    July 12th, 2016 at 19:33

  6. Foxy Rustacean

    Goodbye Safari! Just imported my bookmarks into Firefox …

    July 13th, 2016 at 09:17

  7. Xidorn Quan

    But that data now shows ~5% failure :/

    July 14th, 2016 at 07:35

    1. Jack Moffitt

      The graph shown is Firefox 47 which had some Rust code enabled on Mac and Linux. There was a low-memory crash (https://bugzilla.mozilla.org/show_bug.cgi?id=1266309#c17) that got fixed for 48, and may be why current telemetry is not perfect.

      Or is there another failure you mean?

      July 15th, 2016 at 08:12

  8. Gabriela

    Could I help testing these builds in Windows considering I’m no techie? I use all Firefox channels. If so, please let me know! Thanks!

    July 30th, 2016 at 10:47

  9. Lonami

    Ohh that’s cool good job to everyone who collaborated! :D

    August 5th, 2016 at 10:47

Comments are closed for this article.