Bug 243342 – Atomics are unavailable without the COOP/COEP headers

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Ryan Reno]

window.Atomics is undefined without the COOP/COEP headers. Those headers are meant to help secure usage of SharedArrayBuffer. However, Atomics should work with regular ArrayBuffer which is available without those headers.

[Radar WebKit Bug Importer]

<rdar://problem/97786341>

[Ryan Reno]

(In reply to Ryan Reno from comment #0)
> window.Atomics is undefined without the COOP/COEP headers. Those headers are
> meant to help secure usage of SharedArrayBuffer. However, Atomics should
> work with regular ArrayBuffer which is available without those headers.

To be clear: I believe those headers are for more general security but in the context of the availability of Atomics, SharedArrayBuffer is disabled without the headers. It seems that Atomics is likewise disabled without the headers which means they cannot be used with normal ArrayBuffer.

[Ryan Reno]

Chrome 103 and FF 103 both give access to the Atomics object when crossOriginIsolated == false.

While Atomics on non-shared memory is probably not the most useful thing in the world, enabling Atomics even when SharedArrayBuffer is disabled will improve interop with other major browsers.

[Chris Dumez]

+ a few JSC people: Did we intentionally disable Atomics due to Spectre? I assume we did.

[Geoffrey Garen]

(In reply to Chris Dumez from comment #4)
> + a few JSC people: Did we intentionally disable Atomics due to Spectre? I
> assume we did.

My understanding is that the Spectre risk comes from shared memory, not from atomics. So, enabling just Atomics without shared memory should be fine. Of course, it's also useless. Which is why it's fine.

But if enabling Atomics improves interop, it seems worth doing, even if it's useless as a programming model.

[Chris Dumez]

(In reply to Geoffrey Garen from comment #5)
> (In reply to Chris Dumez from comment #4)
> > + a few JSC people: Did we intentionally disable Atomics due to Spectre? I
> > assume we did.
> 
> My understanding is that the Spectre risk comes from shared memory, not from
> atomics. So, enabling just Atomics without shared memory should be fine. Of
> course, it's also useless. Which is why it's fine.
> 
> But if enabling Atomics improves interop, it seems worth doing, even if it's
> useless as a programming model.

👍

[Ryan Reno]

Pull request: https://github.com/WebKit/WebKit/pull/2860

[EWS]

Committed 253137@main (09e0997b7d2e): <https://commits.webkit.org/253137@main>

Reviewed commits have been landed. Closing PR #2860 and removing active labels.