Is eval evil? Just-in-time compiling

https://wanago.io/2018/11/19/how-does-eval-work-and-how-is-it-evil-javascript-eval/

by mwanago • 8 years ago

50 40 8 years ago

pizlonator5• 8 years ago

Eval doesn't have to be bad for JITing. Someone oughta write a JS JIT that interoperates with the parser to look for patterns like:

    eval("some code { " + stuff + "} more code")

and runs the parser enough to observe that `stuff` fills in a scope about which it is possible to reason even without knowing about what `stuff` is. In some cases, this will get really lucky:

    eval("some code blah blah object." + field + " more things")

and you can imagine this being turned into object[field] anytime `field` in this expression is an identifier.

Basically, in this world, you'd be able to distill out the long-lived parts of an eval string, and the JIT(s) can focus on optimizing that.

goto112• 8 years ago

But stuff could contain " }; { " or similar weirdness which means you cannot even make assumptions about the semantics of the code in the constants parts of the string. In the second example there is no reason to use eval in the first place when you can just write object[field], so why optimize for eval support?

chrisseaton2• 8 years ago

But stuff could contain...

So assume it doesn’t and fixit up if it ever does. That’s the basics of JIT compilation!

kccqzy2• 8 years ago

What if stuff is `} //`?

Basically you are trying to say we want to discover some kind of semantic structure from just a prefix of the textual form of the code. We can do a partial parse and see what's possible right after the string literal; and if there's only one possibility, we JIT it. But without full code, we can't really do much JIT at all.

pizlonator5• 8 years ago

You just speculate that this doesn’t happen, and bail if it does.

cremp• 8 years ago

The thing is, it isn't just javascript eval; any eval is bad.

In another life I did PHP shells. PHP (which has a weird relationship with JIT) had so many ways to use eval, without actually typing eval. One of the weird ways that was only removed in PHP 7 was the preg_replace function, with the e flag; which evals any php expression, outside the scope of the function.

My point is that if there is eval used in code; it either is meant for temporary use (because devs are lazy,) or the code needs to be done differently to support the desired outcome.

ArchTypical• 8 years ago

any eval is bad

Saying eval is just confusing the concept with the implementation. There's no evidence that metaprogramming is "bad" unless you are ready to define "bad". Might as well say pointers are "bad" in the same vein.

umvi• 8 years ago

The thing is, it isn't just javascript eval; any eval is bad.

I can think of a few good use cases (though outside the context of JIT). Consider something like Jinja where you can put python code in your template - we've used this to generate C++ source files from JSON metadata in our embedded systems products. In this case it's pretty safe because both the producer and consumer of the eval is the same person.

billsix• 8 years ago

The thing is, it isn't just javascript eval; any eval is bad.

Eval'ing during macroexpansion in Gambit Scheme is the basis for my book, http://billsix.github.io/bug.html#_computation_at_compile_ti...

It allows me to make a compile-time unit test framework in 7 lines of code

tobr• 8 years ago

Can eval ever increase performance? I’m thinking that for some types of abstractions you can end up with highly nested, indirect calls, and if you can instead generate new code as needed, maybe it could speed things up? Are there any mainstream examples of this?

__s• 8 years ago

2 examples for optimizing for LuaJIT:

https://github.com/pygy/LuLPeg https://github.com/pygy/strung.lua

Veedrac• 8 years ago

Python uses/used eval for namedtuple at least in part for performance.

xapata• 8 years ago

Used. Raymond revised the implementation.

hyperpape• 8 years ago

I think the Python falcon web server uses eval to produce direct python that executes routing code at run time. I don't have any reason to think it can't be beat, but it is relatively fast for something done in Python.

More generally, generating code is used for a lot of regex engines, though it may happen before runtime.

nine_k2• 8 years ago

This looks like a compilation step. If you cannot have your language implementation generate some kind of optimized code statically, you can do it yourself dynamically.

chrisseaton2• 8 years ago

Contrary to what the article says, there is no reason whatsoever that code in an eval, even if it uses the calling environment, cannot be optimised.

I work on a Ruby implementation that optimises through eval just fine.

zamalek2• 8 years ago

Exactly. It's just like SQL: different queries end up as different entries in the query cache; although SQL is beneficially fuzzy in this case, if only the constants differ you should get a cache hit.

The "safe" and fast way to use eval for JIT is to get it to return a function, with all user inputs as parameters (like like the safe and fast way to do SQL is with parameters):

    var f = eval("(function (a, b) { return a + b })");
    f("a", "b");

wefarrell• 8 years ago

Why not just do:

var f = new Function('a', 'b', 'return a + b')

matthewaveryusa• 8 years ago

Here's a really good use of eval:

https://jsfiddle.net/matthewaveryusa/e6EKV/6/

I could have done this without an eval if I decided to write an interpreter. Instead I whitelisted a subset of javascript and evaled it -- I believe the code is simpler with the eval than if I were to write a parser + interpreter.

I challenge anyone to escape my whitelisting :)

kccqzy2• 8 years ago

That's a really nice example! Your whitelist is pretty restrictive. I was reminded of JSFuck where simply allowing six characters ( ) + [ ] ! would basically allow everything. Although I have to mention, your whitelist still permits undefined (such as x.x) as well as certain strings (0 + /./)

I'm also pretty sure the Google Closure library originally used whitelist checking + eval to parse JSON before JSON.stringify was a thing.

jaybosamiya• 8 years ago

Your whitelisting is quite good!

I still haven't been able to do complete code execution yet, but have reasons to believe it might be possible.

Simply using `x1` as input causes it to print "deadbeef11 is not defined". Additionally, parens are allowed, and there is the `=>` arrow syntax for defining functions. Thus, we have a way to define variables, a way to define lambda abstractions, as well as a way to perform applications. Therefore, we have the untyped lambda calculus. This is Turing complete, so I have reason to believe that it should be possible to execute arbitrary code. I just need to find some time to do so :)

Update: `(x1=>x1(x1))(x1=>x1(x1))` gives "Too much recursion" :D

robocat• 8 years ago

Generally I always use Function() instead of eval, because Function doesn't capture the current scope (and also it won't interfere with JIT optimisation, and avoids possible memory bloat of variables in closure if you keep references to the functions).

sbr464• 8 years ago

I saw a trick where you just do:

  const eval2 = eval

  eval2(...)

That put’s it back in global scope, even when assigned within a closure with access to a local variable. The local variable will be undefined, rather than it’s actual value, even when called next to the regular eval(). Odd, I know.

Here’s a quote:

"any invocation of eval that is not a direct call uses the global environment as its variable environment rather than the caller’s variable environment." ECMAScript 5 standard,

TekMol• 8 years ago

Looking throught the list of http://www.jsfuck.com a lot of the 'basics' can be created in your environment too.

For example a string can be created like this:

(x=>0)+0

If arbitrary code can be constructed in your environment ... hard to say. But as jaybosamiya has shown, it is at least possible to escape your error handling.

nine_k2• 8 years ago

I suppose the biggest problem with `eval` is not getting uncontrolled user data into it.

A kind of filter shown in the matthewaveryusa's reply may be secure, but it's pretty limiting, and may happen to be too limiting for a particular purpose.

It would be great if the AST of the expression to be evaluated could be checked. That is, `eval` could be two pieces: "compile" and "execute" phases; this is how it works in Python.

Another tool could be a type system that marks user input as "tainted" and helps you track where you're using user input in any capacity. But languages featuring `eval` usually lack such a type system.

rogual• 8 years ago

A while back I used eval in a matrix multiplication routine, to make it accept matrices of arbitrary size and generate code to multiply them:

https://github.com/rogual/mxd/blob/master/Matrix.js#L50

It benchmarked pretty well back when I wrote it, though I haven't checked against current JS engines to see if it's still a performance win.

calibas• 8 years ago

Just my personal experience, but I used eval way more often when I didn't really know what I was doing. As I've learned Javascript, I've realized that in the vast majority of cases it's simply not needed.

If you're an experienced programmer who understands the risks of eval and there's no other good options, then by all means use it, but for other cases "eval is evil".

Twisol• 8 years ago

Eval is a lot like goto in that way. In the vast majority of cases, there's a better way to do things -- but in a very, very small number of scenarios, it's the right tool for the job.

ronilan• 8 years ago

Last winter I wrote BlockLike.js, an educational library that allows one to use Block programming concepts in JavaScript. This required supporting pacing and waiting while still allowing the user to write simple (and valid) JavaScript.

When I started I had this voice in my head whispering again and again "eval is evil, eval is evil". Then I just got over it...

I ended up with one-pass, event triggered, construct-and-run (essentially "eval") solution. The user writes simple code that is event triggered. The code is converted into a string, rewritten in realtime and "enhanced". An Asynchronous Function Constructor then converts it back to a function and it gets invoked by the triggering event.

It works great and though there is, obviously, a performance penalty for the realtime rewriting, it is never the limiting performance factor for implementations (multiple DOM element animation is).

Examples:

https://www.blocklike.org/example/12-advanced/recursion_tree...

https://www.blocklike.org/example/12-advanced/color_bubbles_...

https://www.blocklike.org/example/14-games/avoid.html

Repo:

https://github.com/ronilan/BlockLike

sifoobar• 8 years ago

I'm still holding off adding eval() to Snigl [0]. Not because of JIT clashes, since it is a straight interpreter; but because of the can of worms it opens. The thing is that I have to compile code in some kind of context, and depending on what the code says, it may or may not be safe to throw the compiled code away once done. Which means that I'd have to deal with a growing mountain of compiled code or complicate the design to support a feature that's mostly the wrong answer.

https://gitlab.com/sifoo/snigl

w0mbat• 8 years ago

Eval has been evil since medireview times.

https://revealingerrors.com/medireview

tombert• 8 years ago

This is tangential, but I think that the way that the way Lisp does eval with its macros is incredibly elegant. There was a post on HN a few weeks ago [1] about doing symbolic derivatives in Lisp via quotations and eval, and while that was probably old news to most of the HN audience, it was downright magic to me, and the use of eval seemed appropriate.

[1] https://news.ycombinator.com/item?id=18343652

jancsika• 8 years ago

The answer to the question (consistent with all headline questions) is "no."

The article even mentions JSON.parse which itself relied on eval.

Does JSON.parse still rely on eval under the hood?

Regardless... a wildly popular method used to propagate the most popular data format relied on eval. At least for a time. Nothing evil happened as a result.

Is eval evil? Just-in-time compiling

Related Stories