[tor-bugs] #21011 [Applications/Tor Browser Sandbox]: Disable JavaScript JIT

[Tor Bug Tracker & Wiki]

#21011: Disable JavaScript JIT
----------------------------------------------+-------------------------
 Reporter:  cypherpunks                       |          Owner:  yawning
     Type:  enhancement                       |         Status:  new
 Priority:  Medium                            |      Milestone:
Component:  Applications/Tor Browser Sandbox  |        Version:
 Severity:  Normal                            |     Resolution:
 Keywords:                                    |  Actual Points:
Parent ID:                                    |         Points:
 Reviewer:                                    |        Sponsor:
----------------------------------------------+-------------------------

Comment (by yawning):

 FF46 does fix the issue with W^X, but we won't get the benefit of that
 till ESR52.

 In principle I don't mind this, but it feels somewhat redundant to me
 since Tor Browser already will set
 `javascript.options.baselinejit.content` and
 `javascript.options.ion.content` to `false`, as long as you don't have the
 security slider set to "YOLO".

 IMO, if you think that more options should be set to *really* kill the
 JIT, then the patches should go into torbutton.  If the JIT is just always
 evil, then the Tor Browser code should never JIT JS regardless of what the
 slider says.

 (Also you're patching the wrong file, you want `mozilla.cfg`.)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21011#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online