Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why does minified or obfuscated JavaScript perform worse than uncompressed code?

I came across this performance report of JavaScript code compressed using various minifiers and obfuscators. What is surprising is that apart from Closure advanced mode, in most cases all other minifiers output code that performs worse than uncompressed code. How do we explain that?

Scroll down to the end of the page to see the report. Here are screenshots:

enter image description hereenter image description hereenter image description hereenter image description here

Legend:

  • Blue - YUI Compressor
  • Red - Closure (advanced mode)
  • Orange - Closure (basic mode)
  • Green - JS Min
  • Purple - JS Packer
  • Light Blue - UglifyJS
  • Pink - Uncompressed code
like image 822
Dheeraj Vepakomma Avatar asked Mar 17 '13 08:03

Dheeraj Vepakomma


People also ask

Does obfuscation affect performance JavaScript?

No. Obfuscation simply replaces your sensibly named code with an unreadable one.

Is obfuscated JavaScript slower?

It certainly does slow down the browser more significantly on older browsers (specifically when initializing), but it definitely slows it down even afterwards.

Does obfuscation affect performance?

Name obfuscation does not affect the performance and should always be used. You can virtualize methods that are not computationally intensive. Otherwise, control flow obfuscation should be used.

Why is JavaScript code obfuscation a poor security feature?

Because the source code of this agent is exposed, attackers can tamper with its logic to bypass it and make it much harder for providers to block their accounts.


1 Answers

First let me play devil's advocate: The code does not actually "perform" anything (nothing serious I mean, except for JS Packer). It's essentially a definition of functions, objects and properties.

JS Packer does not produce JavaScript code but rather compressed text that has to be unpacked at runtime. That's why it's much slower. Google Closure using Advanced Optimization replaces identifiers whenever possible. So there already has to be a performance advantage when parsing the script.

That said it is possible to sacrifice performance for code size. One example is replacing true and false with !0 and !1. It depends on the JavaScript engine though. It could be optimized by the engine before the first call, after it, after some calls, never ... who knows ;)

New Findings

I did some profiling in the meantime and realized that I forgot one thing: garbage collection. The influence can be enough to explain some of the differences between the scripts and the browsers (different engines!).

Combine that with the fact that the code doesn't do much and you have something. In one test I had a CPU Time for garbage collection of about 3% for uncompressed and 9%(!) for JSMin. Which means completely different results for almost equal code.

Even newer findings

When you run JSMin first it's faster than uncompressed. I tried this several times and always got the same result. This confirms the previous findings. I am pretty confident now, that we found the solution.

like image 100
a better oliver Avatar answered Oct 07 '22 03:10

a better oliver