Firefox Quantum and Rust in production

I’ve been using Firefox 57 as my main browser for a week now, on Windows at work and on the Mac at home, which is the first time Firefox has been my default since roughly 2011. It’s fast, faster than the Chrome I’d been using, which I didn’t expect. Tab switching is snappy, big pages with a lot of CSS render noticeably quicker than they used to, and it doesn’t make the fan on my laptop spin up with twenty tabs open. I lost two extensions that hadn’t been ported to the new WebExtensions API, which is annoying, and Mozilla took a lot of heat for cutting off the old extension system, but I’m not going back.

The part I find more interesting than the speed is how they got there.

In 2000 Joel Spolsky wrote Things You Should Never Do, the essay every engineering manager has quoted at some point to talk someone out of a rewrite. His main example was Netscape, which threw out its browser code and started over, and lost years doing it. That rewrite became Mozilla, which became Firefox. Seventeen years later, the same codebase has just pulled off a very large rewrite, and it did it the way Joel would have wanted: one component at a time, inside the shipping product.

The big piece in 57 is Stylo, the new CSS engine, which came from Servo, Mozilla’s experimental browser engine written in Rust. The Rust blog post on release day says it replaces about 160,000 lines of C++ with 85,000 lines of Rust, and that it styles a page in parallel across all your CPU cores. It also says Mozilla had tried to parallelize the old C++ style system twice before and failed both times. That’s the bit that sold me. Styling is the kind of problem that looks easy to parallelize on a whiteboard and turns into a nightmare of shared mutable state in practice, and the claim is that Rust’s ownership rules are what made it tractable, because the compiler refuses to build the data races you’d otherwise spend a year chasing.

I’ve been poking at Rust on and off since 1.0 came out in 2015. My honest reaction so far has been that it’s a very nice language that I fight with constantly, and that I wasn’t sure it would ever get past being the language people on Hacker News like to talk about. Rust has actually been in Firefox since version 48 last year, for an MP4 metadata parser, but that’s a small, self-contained piece of code where memory safety obviously matters. A CSS engine at the center of a browser, running on hundreds of millions of machines, is a different level of bet. If it holds up, it’s the strongest argument for Rust that exists.

What I’d take from it, for those of us who aren’t writing browsers, is the incremental part. You can replace the core of a twenty-year-old C++ application without stopping the world, if you can find a seam with a clear interface, build the new thing alongside it, and ship it behind a switch until you trust it. Servo was the place to experiment, and Firefox is where the experiments that worked get pulled in. I’ve watched two big rewrites fail up close, and both of them were the all-at-once kind. I’ll be interested to see which piece they bring over next.*

* The obvious candidate is WebRender, Servo’s GPU-based renderer, which is apparently already in Firefox Nightly behind a pref. I tried it for an afternoon. It’s not ready, but it’s very fun to watch.