TL;DR: Starting with Firefox 48, Mozilla is shipping its first production Rust code, with more to come!

Mozilla ❤ Rust

It’s hard to believe it’s been almost seven years since Mozilla Research first began sponsoring the development of Rust, at the time little more than an ambitious research experiment with a small but devoted community. Remarkably, despite a long history of inventions and discoveries, Rust’s key principles have remained constant. The Rust core team’s original vision—a safe alternative to C++ to make systems programmers more productive, mission-critical software less prone to memory exploits, and parallel algorithms more tractable—has been central to Mozilla’s interest in backing the Rust project and, ultimately, using Rust in production.

An equally promising development has been the fact that Rust’s safety and modern features are attracting new people to systems programming. For Mozilla, where community-based development is quite literally our mission, widening our circle is vital.

So I’m pleased to mark an important milestone: with Firefox 48, Mozilla will ship our first Rust component to all desktop platforms, and with Android support coming soon.

Building Rust into Mozilla’s media stack

One of the first groups at Mozilla to make use of Rust was the Media Playback team. Now, it’s certainly easy to see that media is at the heart of the modern Web experience. What may be less obvious to the non-paranoid is that every time a browser plays a seemingly innocuous video (say, a chameleon popping bubbles), it’s reading data delivered in a complex format and created by someone you don’t know and don’t trust. And as it turns out, media formats are known to have been used to trick decoders into exposing nasty security vulnerabilities that exploit memory management bugs in Web browsers’ implementation code.

This makes a memory-safe programming language like Rust a compelling addition to Mozilla’s tool-chest for protecting against potentially malicious media content on the Web. For this reason, Ralph Giles and Matthew Gregan built Mozilla’s first Rust media parser. And I’m happy to report that their code will be the first Rust component shipping in Firefox. For the Rust community as well, this is a real achievement: Rust code shipping to hundreds of millions of Firefox users. Our preliminary measurements show the Rust component performing beautifully and delivering identical results to the original C++ component it’s replacing—but now implemented in a memory-safe programming language.

More to come!

Many people deserve huge thanks for getting us to this point. Ralph Giles and Matthew Gregan implemented the component, and Nathan Froyd, Nick Nethercote, Ted Mielczarek, Gregory Szorc, and Alex Crichton have been instrumental in integrating Rust into the Firefox build and tooling system and ensuring it can ship on all of our platforms.

Rust itself is the product of a tremendous, vibrant community. None of this work would have been possible without the incredible contributions of issues, design, code, and so much more of Rustaceans worldwide. As a Rustacean myself, I’d encourage you to come play with Rust. It’s a great time to get started, and increasingly, to get involved with a Mozilla project using Rust.

Seeing Rust code ship in production at Mozilla feels like the culmination of a long journey. But this is only the first step for Mozilla. Watch this space!