1619655 - Enable COOP+COEP (aka "resab") on Android

Status: RESOLVED FIXED

(GeckoView :: Sandboxing, enhancement, P1)

Description

[Anne (:annevk)]

I file this mainly so we do not lose track of it. It's not part of shipping COOP+COEP initially. Dependencies will need to be fixed and then we can fiddle with these preferences and see what breaks and how many new intermittents we get:

browser.tabs.remote.useCORP
browser.tabs.remote.useCrossOriginOpenerPolicy
browser.tabs.remote.useCrossOriginEmbedderPolicy
dom.postMessage.sharedArrayBuffer.withCOOP_COEP

Note that javascript.options.shared_memory is enabled on Android already and will eventually ship there following bug 1606624. (Ironically it won't give you access to shared memory however, as postMessage() will throw until this is fixed.)

Comment 1

[Philip Lamb]

In Fenix Nightly with Geckoview 78.0a1 it appears to no longer be possible to instantiate SharedArrayBuffer, even with correct COEP/COOP headers, whereas this was possible in Fenix Nightly with Geckoview 77.0a1. See https://github.com/mozilla-mobile/fenix/issues/10722 for details of exact versions and a test case.

Comment 2

[Anne (:annevk)]

Philip, we started hiding the SharedArrayBuffer constructor (bug 1624266) and since COEP/COOP never worked on Android you cannot get it back, so that's expected. If you need an instance of SharedArrayBuffer that you cannot use with postMessage(), you can still use new WebAssembly.Memory({ shared:true, initial:0, maximum:0 }).buffer.constructor to get hold of the constructor.

Comment 3

[Philip Lamb]

OK. Since Emscripten-generated WebAssembly depends on SharedArrayBuffer for multi-threading support, it looks like this will break multi-threaded WebAssembly in Fenix Nightly and Firefox Reality until COEP/COOP is supported, which is unfortunate. I haven't investigated whether using the new WebAssembly.Memory({ shared:true, initial:0, maximum:0 }).buffer.constructor is an option for Emscripten.

Comment 4

[Anne (:annevk)]

Emscripten won't work, it requires postMessage(). Not sure break is the right word for an unsupported configuration, but yes. Setting dom.postMessage.sharedArrayBuffer.bypassCOOP_COEP.insecure.enabled might be an option for you, but it's not recommended.

Comment 5

[guest271314]

(In reply to Anne (:annevk) from comment #0)

I file this mainly so we do not lose track of it. It's not part of shipping COOP+COEP initially. Dependencies will need to be fixed and then we can fiddle with these preferences and see what breaks and how many new intermittents we get:

browser.tabs.remote.useCORP
browser.tabs.remote.useCrossOriginOpenerPolicy
browser.tabs.remote.useCrossOriginEmbedderPolicy
dom.postMessage.sharedArrayBuffer.withCOOP_COEP

Note that javascript.options.shared_memory is enabled on Android already and will eventually ship there following bug 1606624. (Ironically it won't give you access to shared memory however, as postMessage() will throw until this is fixed.)

The preferences do not have an effect at Nightly 80.0a1 (2020-07-19) (32-bit) Linux desktop when using

const memory = new WebAssembly.Memory({
            initial: Math.floor(length / 65536) + 1,
            maximum: Math.floor(length / 65536) + 1,
            shared: true,
          });

getting

DOMException: MessagePort.postMessage: The SharedArrayBuffer object cannot be serialized. The Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy HTTP headers will enable this in the future.

when running the code at plnkr and console.

If this bug is specific to Android can you kindly direct to the correct existing bug to post the above?

Comment 6

[Anne (:annevk)]

That is working as designed. See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer/Planned_changes.

Comment 7

[Chris Peterson [:cpeterson]]

COOP and COEP are a prerequisite for Fission on Android.

Comment 8

[(No longer employed by Mozilla) Aaron Klotz]

Nominating for 85 sprint for the purposes of ascertaining what (if anything) needs work here.

Comment 9

[Chris Peterson [:cpeterson]]

Tracking this bug for Android Fission milestone M2 (pass tests with Fission enabled).

Comment 11

[Chris Peterson [:cpeterson]]

Some COOP/COEP tests are skipped or force-passed on Android:

https://searchfox.org/mozilla-central/source/testing/web-platform/meta/html/cross-origin-opener-policy
https://searchfox.org/mozilla-central/source/testing/web-platform/meta/html/cross-origin-embedder-policy

needinfo'ing Neha because she is investigating why these COOP/COEP tests were skipped/force-passed on Android.

Comment 12

[Neha Kochar [:neha]]

Tom, you might know why some COOP/COEP tests were either disabled for Android or marked passing only-for-Android.

Comment 13

[Anne (:annevk)]

That's because Android was out of scope of the resab project, no? And until bug 1530770 is fixed I don't think we're able to do much, unless something else has changed?

Comment 14

[Neha Kochar [:neha]]

Thanks Anne. Yes, Android was out of scope at the time of shipping resab. But seeing some of the tests only enabled for Android made me very curious...

aklotz and agi, after bug 1530770 is fixed, the Android team will have to try to enable the COOP and COEP WPTs for Android and fix any failures seen.

Comment 15

[[ex-Mozilla] Agi Sferro | :agi]

Bug 1530770 is fixed (it's just not riding the trains yet) so I guess we could try to do this in Nightly now.

Comment 16

[daegon.dhsk]

Please add this, this blocks usage of wasm threads when compiling with emscripten.

Comment 17

[daegon.dhsk]

ex.
https://github.com/mozilla-mobile/fenix/issues/16773
https://github.com/mozilla-mobile/fenix/issues/10722

Comment 18

[(No longer employed by Mozilla) Aaron Klotz]

Note to self that browser.tabs.remote.useCORP is gone as of bug 1609078.

Comment 19

[(No longer employed by Mozilla) Aaron Klotz]

We're ready to enable this, pending the enabling of more e10s processes.

Comment 21

[(No longer employed by Mozilla) Aaron Klotz]

Bumping this to 90 in favour of landing the Nightly-only variant in bug 1703968.

Comment 22

[Lars T Hansen [:lth]]

What news here? This is an unfortunate bit of feature non-parity, and the Bergamot (in-browser translation) team ran into this issue during some testing yesterday, because they are using wasm with shared memory. This is a P2 bug but the only blocking (DOM) bug is unprioritized.

Comment 23

[Abhishek]

Adding on top of what Lars wrote, I faced this issue on Firefox for Android 91.1.0 for Bergamot project but not on Firefox for Android (Nightly) 93.0a1

Comment 24

[Chris Peterson [:cpeterson]]

Agi, Nika says she doesn't know of issues that should block the GV team from enabling COOP+COEP on Android to match desktop. It can be enabled on Android before Fission.

Comment 25

[[ex-Mozilla] Agi Sferro | :agi]

I need to dig through the backout logs/emails, from what I'm told there's something only enabled in late beta that breaks on android with COOP+COEP (keeping the NI so I remember to look into that)

Comment 26

[[:owlish] 🦉 PST]

So as far as I can tell, we have enabled COOP+COEP in Nightly builds (since v89), and it has been doing well. It looks like at this stage we can proceed to enabling this in Beta and Release builds.

I'll start with some try pushes, and if the tests are doing well there, will make a patch.

Comment 27

[[:owlish] 🦉 PST]

Note to myself: found in Fission meeting notes mention of some disabled wpt COOP/COEP tests. Check to see if they are still disabled

Comment 28

[[:owlish] 🦉 PST]

Attachment: Bug 1619655 - Part 1. Enable COOP+COEP prefs on GeckoView Beta and Release

Comment 29

[[:owlish] 🦉 PST]

Attachment: Bug 1619655 - Part 2. Fix COOP and COEP wpt test expectations for Android Beta and Release

Depends on D132960

Comment 30

[[:owlish] 🦉 PST]

Attachment: Bug 1619655 - Part 3. Fix worker and hr-time wpt test expectations for Android Beta and Release

Depends on D132961

Comment 31

[[:owlish] 🦉 PST]

Attachment: Bug 1619655 - Part 4. Set GV's COOP+COEP processCount for Release and Beta

Depends on D132962

Comment 32

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c3111723c611
Part 1. Enable COOP+COEP prefs on GeckoView Beta and Release r=calu

Comment 33

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/90e053a1953b
Part 2. Fix COOP and COEP wpt test expectations for Android Beta and Release r=calu
https://hg.mozilla.org/integration/autoland/rev/32bc709ae6d7
Part 3. Fix worker and hr-time wpt test expectations for Android Beta and Release r=calu
https://hg.mozilla.org/integration/autoland/rev/35533e37472a
Part 4. Set GV's COOP+COEP processCount for Release and Beta r=geckoview-reviewers,calu

Comment 34

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/c3111723c611
https://hg.mozilla.org/mozilla-central/rev/90e053a1953b
https://hg.mozilla.org/mozilla-central/rev/32bc709ae6d7
https://hg.mozilla.org/mozilla-central/rev/35533e37472a

Comment 35

[Chris Peterson [:cpeterson]]

owlish, do we want to uplift these COOP+COEP patches to Beta 96 or ride the trains with 97?

COOP+COEP is already enabled #ifdef NIGHTLY_BUILD, so IIUC these patches have no effect in Nightly. OTOH, I see we have at least one regression (bug 1744775) that needs to be resolved first before enabling COOP+COEP in Beta.

Comment 36

[[:owlish] 🦉 PST]

The feature has been in Nightly for a while, but I would still let it ride the trains to give us more opportunity to fix any possible intermittents rising from removing the #ifdef NIGHTLY_BUILD (including the one you mentioned).

Comment 37

[Chris Peterson [:cpeterson]]

SGTM. Setting status-firefox96=wontfix flag because we don't need to uplift to Beta 96.

Comment 38

[Chris Peterson [:cpeterson]]

Moving Android Fission bugs to the new GeckoView::Sandboxing component.