In JavaScript, is it possible to use a SharedArrayBuffer in a SharedWorker?
When serving an index.html
<html>
<body>
<script type="text/javascript">
console.log(
'outer:', 'typeof SharedArrayBuffer:', typeof SharedArrayBuffer,
'crossOriginIsolated:', crossOriginIsolated);
new SharedWorker('worker.js');
</script>
</body>
</html>
and a worker.js
console.log(
'inner:', 'typeof SharedArrayBuffer:', typeof SharedArrayBuffer,
'crossOriginIsolated:', crossOriginIsolated);
with e.g. Emscripten's emrun (which sends
Access-Control-Allow-Origin: *
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: credentialless
Cross-Origin-Resource-Policy: cross-origin
headers among others; whichever of these may or may not be relevant here), browsing that index.html with e.g. Chrome 138.0.7204.168 on Linux, the index.html tab's console says
outer: typeof SharedArrayBuffer: function crossOriginIsolated: true
as expected, but the shared worker's console (see chrome://inspect/#workers) says
inner: typeof SharedArrayBuffer: undefined crossOriginIsolated: false
A very wild guess for a reason might be https://html.spec.whatwg.org/multipage/workers.html#run-a-worker in step 12.3.4 saying
If worker global scope's embedder policy's value is compatible with cross-origin isolation and is shared is true, then set agent's agent cluster's cross-origin isolation mode to "
logical" or "concrete". The one chosen is implementation-defined.
and in step 12.3.6 saying
Set worker global scope's cross-origin isolated capability to true if agent's agent cluster's cross-origin isolation mode is "concrete".
so it might be Chrome decides to set that to "logical"---as per the note at https://html.spec.whatwg.org/multipage/document-sequences.html#cross-origin-isolation-mode:
On some platforms, it is difficult to provide the security properties required to grant safe access to the APIs gated by the [https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-cross-origin-isolated-capability](cross-origin isolated capability]. As a result, only "
concrete" can grant access that capability. "logical" is used on platform not supporting this capability, where various restrictions imposed by cross-origin isolation will still apply, but the capability is not granted.
(And thus the security requirements for using SharedArrayBuffer would not be met.)
(SharedArrayBuffer and SharedWorker looks related, but it is from 2017 and I don't know how relevant that question and its answer are still today.)