I gave a talk today about some compiler things to some compiler people, and just posted a recording (https://vimeo.com/1234257957) and slides (https://cfallin.org/pubs/vmil2026_nightmonkey_slides.pdf).

In brief: I made JavaScript-running-in-a-Wasm-module go way way faster by building a static type inference and AOT compiler, now dubbed "NightMonkey". It's been tons of fun!

(the "why?!" is covered in the first part of the talk -- certainly a unique set of requirements but IMHO it's well-motivated for our niche)

Signing into a bank, get this 2FA challenge:

"STOP we will never ask for this code. Never ever give it to us. You're being SCAMMED. Code: 74439"

"Please give us the code we sent you: "

And we wonder why people are confused by computers.

What do you want us to work on in 2027?

Here's a web app where you can rank the Interop proposals you care about, giving us data we can use to prioritise feature development.

https://interop-rank.fxdx.dev/

Wasm stack switching in SpiderMonkey is the most complex feature I've ever built. One of those projects you get lost and start rethinking the basics like "what is the stack even really?"

Was fun to give a talk on it:
https://www.youtube.com/watch?v=OvYFHH9AxOw

How should libc stdin work when compiled to the web? (Wrong answers only)

*system design interview* The eagles are bottlenecked on Prometheus’ single liver. We need to scale the eagles

WebAssembly Dark Corners: Control Flow...

(including: 1 weird trick that Wasm VMs don't want you to know!)

https://eqrion.net/wasm-dark-corners-part-1-control-flow/

Goodbye summer; time to remember how to stay awake after sunset

Reading through Lean reference docs:

LB: felixcloutier.com/x86 had a good run! I’m not in the country currently, but when I’m back I’ll add a banner to say it’s no longer updated and link to https://intel.github.io/SDM/sdm.html. (At this time, there are no plans to remove the existing content.)

Writing on memory safety and formal semantics. Just an explanation of operational, denotational and axiomatic semantics, with a discussion on UB and unsafe at the end.

These blog posts will continue until security improves! https://burakemir.ch/post/formal-semantics/ #memorysafety

JS promise integration for WebAssembly landed in Firefox 153, making it easier to work with asynchronous calls from Wasm. Here's how it works:

I attended USENIX OSDI 2026 last week to share our paper “Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine” (available at https://www.usenix.org/system/files/osdi26-sharma.pdf)

The TLDR: Browsers have very complex JavaScript engines, and many recent attacks have targeted bugs in this complex JavaScript engine as the entry point to compromise users’ machines. In this paper, we built “Mohabi” — a fork of Firefox that uses in-process sandboxing to fully isolate the JavaScript engine at moderate cost. This means that in Mohabi, bugs in the JavaScript engine are no longer security bugs.

I could talk a lot about this research process we used in this paper — e.g., we weren’t just trying to get something that "kinda worked", we really wanted something that would be a scalable/maintainable as well as secure. It ended up taking us 2 years and many, many design iterations to find the design we were happy with that would meet these goals.

This has probably been one of the most technically challenging papers I have been involved in. This is the first time software in-process sandboxing (SFI) has been used to protect something this complex (a browser JavaScript engine contains an interpreter, 2 to 3 JITs, a dynamic type profiler, a dedicated Wasm engine, GCs and more) in such a large domain (the modern web browser easily rivals OSes in their complexity) --- to my knowledge this makes it the largest scale use of SFI yet.

The students driving this work Abhishek Sharma, Anand Balaji, Zachary Yedidia, Anthony Du, and Taehyun Noh have done amazing work!

Team: Abhishek Sharma (@abhishekcs), Anand Balaji (@anand), Zachary Yedidia (https://zyedidia.github.io/), Anthony Du, Taehyun Noh (@taehyun), Iain Ireland, Jan de Mooij (@jandem), Matthew Gaudet (@mgaudet), Tal Garfinkel (https://www.linkedin.com/in/tal-garfinkel-937528/), Deian Stefan (https://cseweb.ucsd.edu/~dstefan/), Hovav Shacham (@hovav), Shravan Narayan (@shravanrn)

Posted to Mastodon on Mohabi**

** Mohabi is a research prototype, and not meant for day to day use, but it is a fully functioning fork of Firefox ESR115 (the latest ESR when we started this work 2 years ago).

A story in three parts (from my local thrift store)

Firefox 153 just landed, and comes with web platform features like:

🎉 popover="hint"
🎉 Picture-in-picture
🎉 IDB getAllRecords()
🎉 JS Promise Integration for wasm
🎉 JS import-as-text

…And more! https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/153

Wasmtime now has GC and exception handling support!

https://bytecodealliance.org/articles/wasmtime-gc

The GC support is useful for having **much** smaller Wasm files when you compile straight to Wasm (i.e. my WASI builds won't use it).

The exception handling support should help with long jumps in C code. For Python that would be useful for porting MicroPython to WASI.

(from last year) Emma: “are you sure the patio needs to be that big?” Me before buying pavers: “yeah it’ll be no sweat” Me after pavers are delivered: 😲

The worst part of projects like this (building a playhouse for my girls) is looking at all the materials you bought and realizing you need to carry, cut, and fasten each one of those things…

Whoah! https://github.com/nasa/spacewasm

Well, ten years goes by quick! I'm feeling sentimental, so I thought I'd write about my time at Mozilla, what I've learned, and what I'm still excited for.

https://eqrion.net/ten-years-at-mozilla/