737202 - Typed arrays become normal arrays when sent to/from workers

Status: RESOLVED DUPLICATE of bug 861925

(Core :: JavaScript Engine, defect)

Description

[Alon Zakai (:azakai)]

Sending a typed array to or from a worker currently leads to the result on the other side being a normal array. This is confusing I think, for me I was puzzled how my Uint8Array could possibly have signed values (then I saw it was no longer a typed array after being sent over).

Comment 1

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Yes, this isn't intended behavior at all. Sounds like a bug in the structured-clone implementation so cc'ing Jason.

I *think* that spec-wise the intent is that things should be even more complex. My understanding (based on various mailing list threads) is that if you postMessage an object-graph which contains two ArrayBufferViews which both refer to the same ArrayBuffer, when they are created on the receiving side, we should create two ArrayBufferViews which also refer to the same ArrayBuffer.

Likewise, if you postMessage an object-graph which contains an ArrayBuffer and an ArrayBufferView which refers to the ArrayBuffer, the same setup should exist on the receiving end.

Now, I don't know where this is specified. The Structured Clone algorithm in HTML5 doesn't mention ArrayBuffer/ArrayBufferViews at all (which means that they would fall into the "other" category which throws), but I think the exact behavior is defined elsewhere.

Another tricky situation is what to do if you postMessage a 10-element ArrayBufferView which refers to a 10MB ArrayBuffer. Surely the intent isn't to copy the whole 10MB. But where do you draw the line?

Comment 2

[Ben Turner (not reading bugmail, use the needinfo flag!)]

This will become more of a problem soon when MessageChannel/MessagePort allow passing cloned data between windows and other processes as well.

Comment 3

[Steve Fink [:sfink] [:s:]]

The part about cloned arrays sharing the underlying ArrayBuffer is bug 861925, which I really need to get back to.

The part about structured clone converting typed arrays to regular arrays is highly surprising to me. I believe that is fixed (though I thought it had been fixed since well before the original report.) Can you still reproduce? If not, this bug can just be duped to bug 861925. If so, please give me a test case. Here's mine:

window.addEventListener("message", function (event) { r = event.data })
window.postMessage(new Uint8Array(10), "*")
r
# [object Uint8Array]
r.byteLength
# 10
r[1] = -2
r[1]
# 254

Definitely still a typed array now.

bent: what will become more of a problem, exactly?

Comment 4

[Ben Turner (not reading bugmail, use the needinfo flag!)]

(In reply to Steve Fink [:sfink] from comment #3)
> Definitely still a typed array now.

Great, maybe this got fixed already. I haven't tested, I was just reading some old code with a FIXME comment pointing here.

> bent: what will become more of a problem, exactly?

Just that we're going to soon have even more ways to generate structured clones.