2021136 - toResizableBuffer is not working with WasmWorkers in Firefox 148.0 (64-bit)

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P2)

Description

[Andrii Repko]

Attachment: error.html - small html to reproduce the issue

Steps to reproduce:

1. new WebAssembly.Memory({ initial: 1, maximum: 10, shared: true })
2. Call .toResizableBuffer() — succeeds, returns buffer with resizable = undefined
3. postMessage({ memory }) to a Worker — succeeds on the sender side
4. Worker never receives the message — no error, no message error, complete silence
   Without step 2, everything works perfectly

Logs for example:
[10:17:33 PM] \n=== Test: WITHOUT toResizableBuffer ===
[10:17:33 PM] Created WebAssembly.Memory (shared): buffer.byteLength = 65536
[10:17:33 PM] typeof memory.toResizableBuffer = function
[10:17:33 PM] Posting memory to worker...
[10:17:33 PM] postMessage succeeded (main thread side)
[10:17:33 PM] Worker result (WITHOUT toResizableBuffer):
[10:17:33 PM] received keys = memory, label
[10:17:33 PM] typeof memory = object
[10:17:33 PM] isUndefined = false
[10:17:33 PM] isNull = false
[10:17:33 PM] constructor = Memory
[10:17:33 PM] buffer.byteLength = 65536
[10:17:33 PM] buffer.constructor = SharedArrayBuffer
[10:17:33 PM] buffer.resizable = false
[10:17:33 PM] >>> PASS: memory is defined in worker <<<
[10:17:34 PM] \n=== Test: WITH toResizableBuffer ===
[10:17:34 PM] Created WebAssembly.Memory (shared): buffer.byteLength = 65536
[10:17:34 PM] typeof memory.toResizableBuffer = function
[10:17:34 PM] Called toResizableBuffer() — returned buffer byteLength = 65536, resizable = undefined, maxByteLength = 655360
[10:17:34 PM] memory.buffer after conversion: byteLength = 65536
[10:17:34 PM] Posting memory to worker...
[10:17:34 PM] postMessage succeeded (main thread side)
[10:17:37 PM] >>> TIMEOUT: Worker never responded after 3s (WITH toResizableBuffer) <<<

In a real project, the WASM is built with emscripten, and it crashes if a ResizableBuffer is present in the code/scope (not even called!), with the " wasmMemory is not defined error.

Actual results:

The worker never receives the message — no error, no message error, complete silence

Expected results:

Worker receives the message or toResizableBuffer is not available.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript: WebAssembly' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Yury Delendik (:yury)]

It is a StructureClone+shared resizable buffer defect. In this case it fails to de-serialize a growable memory. It is probably just a simple fix to remove the payload.toObject().as<SharedArrayBufferObject>().isGrowable() check at https://searchfox.org/firefox-main/source/js/src/vm/StructuredClone.cpp#3027

Comment 3

[Yury Delendik (:yury)]

Attachment: WIP: Bug 2021136 - Allow growable SharedArrayBuffer in WebAssembly.Memory structured clone.

Comment 4

[Sam Clegg]

We just came across the exact same bug in emscripten: https://github.com/emscripten-core/emscripten/issues/27118

Would be great to get this fixed, although it sounds like we will likely need to have a userAgent probe in there for the foreseeable to avoid using this feature on certain shipping firefox versions?

Comment 5

[Julien Pages [:jpages]]

Attachment: Bug 2021136 - Allow growable SharedArrayBuffer in WebAssembly.Memory structured clone.

Comment 6

[Julien Pages [:jpages]]

Attachment: Bug 2021136 - Allow growable SharedArrayBuffer in WebAssembly.Memory structured clone.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8cb213dec41c
https://hg.mozilla.org/integration/autoland/rev/4c66d7c0fb41
Allow growable SharedArrayBuffer in WebAssembly.Memory structured clone. r=yury

Comment 8

[amarc]

https://hg.mozilla.org/mozilla-central/rev/4c66d7c0fb41

Comment 9

[Julien Pages [:jpages]]

This is now in Firefox 154 (nightly), but after discussions with the team, it would be good to uplift this into 153 (ESR).

This bug was blocking an external project, emscripten.

Comment 10

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: toResizableBuffer() was not working with wasm workers. This was an issue for an external project (emscripten).

To avoid them having to use some userAgent probe in the future, it would be good to have this patch in an ESR release.

• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small and contained patch which is updating an old assert to allow the usage of growable wasm SharedArrayBuffers with workers.
• String changes made/needed?: None
• Is Android affected?: yes

Comment 11

[Julien Pages [:jpages]]

Attachment: Bug 2021136 - Allow growable SharedArrayBuffer in WebAssembly.Memory structured clone.

Original Revision: https://phabricator.services.mozilla.com/D307849

Comment 12

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/e8ac7cf81e6b
https://hg.mozilla.org/releases/mozilla-beta/rev/f6940b900262