Jan de Mooij is a Mozilla engineer who writes about SpiderMonkey, JIT compilation, and JavaScript engine internals.
Commenters cite his posts on Math.random() precision and W^X JIT code in Firefox. They treat him as a reliable source on browser engine changes.
After the linked article as well as https://jandemooij.nl/blog/math-random-and-32-bit-precision/ which follows from it, the main three browsers (Chrome[0], Firefox[1], Safari[2]) actually switched to Xorshift128+. So these days Math.random is nowhere near as horrifying as it was back then, however it's still not a system or a userland CSPRNG, for that you need `crypto.getRandomValues()` (https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues).
[0] https://v8.dev/blog/math-random
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=322529#c99
[2] https://bugs.webkit.org/show_bug.cgi?id=151641
Interesting to revisit.
Have there been more changes to Math.random() since 2015 when this bug was fixed?
https://jandemooij.nl/blog/math-random-and-32-bit-precision/
https://trac.webkit.org/changeset/192855/webkit
This StackExchange answer provides a good writeup, especially about some added requirements for Math.random() from ES6:
https://security.stackexchange.com/questions/84906/predicting-math-random-numbers/110241#110241
Are the 3 major browsers still all using xorshift128?
I don't have the capacity to quickly figure this out from public source code.
> [mapping memory WX] hasn't been forbidden on any of the prior platforms that Dolphin supports
Well, rarely completely forbidden, but e.g. I think OpenBSD has been W^X by default for quite some time (though IIRC with a WX allowed flag per… FS mount?). Now on FreeBSD it's not default but it's there, and if you turn it on, you have to mark WX-mapping binaries by running `elfctl -e +wxneeded`.
Firefox actually became W^X compliant all the way back in 2015: https://jandemooij.nl/blog/wx-jit-code-enabled-in-firefox/
Firefox works fine with it: http://jandemooij.nl/blog/2015/12/29/wx-jit-code-enabled-in-firefox/
After that, the performance overhead was pretty small on all benchmarks and websites I tested: Kraken and Octane are less than 1% slower with W^X enabled. On (ancient) SunSpider the overhead is bigger, because most tests finish in a few milliseconds, so any compile-time overhead is measurable. Still, it's less than 3% on Windows and Linux. On OS X it's less than 4% because mprotect is slower there.
I highly doubt js engines would compile a string down to a linked list. But you're right they might compile it to a circular buffer or deque which can have O(1) prepends.
Quick googling shows that this optimization might exist but only for firefox and only if you use "unshift":
https://lannonbr.com/blog/2020-01-27-shift-optimizations
https://jandemooij.nl/blog/2017/12/06/some-spidermonkey-optimizations-in-firefox-quantum/
But it's very unlikely that the jit can optimize `str = ch + str;`
Mozilla people have been working on SpiderMonkey performance already: https://jandemooij.nl/blog/2017/12/06/some-spidermonkey-optimizations-in-firefox-quantum/, it's just not some wholesale replacement, so it probably never makes the top of the list for what they shout about. It also sounds like it has been a steady progression rather than a big jump, so maybe not quite as noticeable.