Trying to check if an object is an instance of SharedArrayBuffer throws error.

[redsuperbat]

Describe the bug During runtime Tauri interprets SharedArrayBuffer as a variable when checking instance types using instanceof. For example this code:

console.log({} instanceof SharedArrayBuffer);

would throw :

Unhandled Promise Rejection: ReferenceError: Can't find variable: SharedArrayBuffer

instead of printing false to the console.

To Reproduce

1. Run the code console.log({} instanceof SharedArrayBuffer);
2. Throws error

Expected behavior Should just print false

Platform and Versions (please complete the following information):

OS: Ubuntu 20.10 Node: v15.3.0 NPM: 7.0.14 Rustc: 1.50.0

[amrbashir]

works fine for me, it prints false, do you have a minimal repo where the error happens ?

[redsuperbat]

Sure here is a temporary repo with a blank vuejs app.

https://github.com/redsuperbat/temp-tauri-repo

The error occurs in the main.ts file on the line

console.log({} instanceof SharedArrayBuffer);

To reproduce with the repo:

1. clone repo
2. run npm install
3. open terminal and start server with npm run serve
4. open second terminal and run npm run tauri dev
5. inspect and console should have the error

[amrbashir]

I still see false printed to the console. I am on windows though. I will have to test it on my linux machine later.

[amrbashir]

I can see the error happening on my linux. Tauri uses WebkitGTK on linux, So I went to dig a little bit and found that WebkitGTK has removed the SharedArrayBuffer. See https://webkitgtk.org/2018/01/10/webkitgtk2.18.5-released.html

[nothingismagick]

I guess that it was removed due to Spectre (note the deprecation of high-resolution timers too). We should probably nudge the webkit devs to look into re-enabling.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer#security_requirements

This is definitely upstream and not anything either Tauri nor WRY can do anything about. Sorry

[nothingismagick]

It seems that this should actually be reenabled in a recent version:

wry is consuming an old version:

webkit2gtk = { version = "0.11", features = [ "v2_8" ] }

There are a few other ones - @wusyong - we should probably be closer to a modern version, no? https://github.com/gtk-rs/webkit2gtk-rs/blob/9c1c05f47352b7923d2cb8c472267017ab7b7426/Cargo.toml#L23-L39

[lucasfernog]

Using v2_28 didn't solve the problem.

[wusyong]

I couldn't find the release note in WebkitGtk saying they re-enabled it. So I think update the version won't help.

@nothingismagick We keep the older version because of this issue tauri-apps/wry#51 . It will require updating some upstream crates. I'll find some time to look into it again.

[nothingismagick]

Have we checked lately if this has been resolved in the recent webkitgtk? @wusyong @lucasfernog

[lucasfernog]

I tried to set the headers on macOS and window.crossOriginIsolated is still false.

WindowBuilder::new(
        app,
        "main",
        tauri::WindowUrl::App("index.html".into()),
      )
      .title("Tauri")
      .on_web_resource_request(|req, resp| {
        if req.uri().starts_with("tauri://") {
          resp.headers_mut().insert(
            "Cross-Origin-Opener-Policy",
            "same-origin".try_into().unwrap(),
          );
          resp.headers_mut().insert(
            "Cross-Origin-Embedder-Policy",
            "require-corp".try_into().unwrap(),
          );
          println!("done");
        }
      })
      .build()?;

This might not be supported on webviews at all.

[wusyong]

Still no on linux either.

[lucasfernog]

I tried to set the headers on macOS and window.crossOriginIsolated is still false.

WindowBuilder::new(
        app,
        "main",
        tauri::WindowUrl::App("index.html".into()),
      )
      .title("Tauri")
      .on_web_resource_request(|req, resp| {
        if req.uri().starts_with("tauri://") {
          resp.headers_mut().insert(
            "Cross-Origin-Opener-Policy",
            "same-origin".try_into().unwrap(),
          );
          resp.headers_mut().insert(
            "Cross-Origin-Embedder-Policy",
            "require-corp".try_into().unwrap(),
          );
          println!("done");
        }
      })
      .build()?;

This might not be supported on webviews at all.

This solution can be used on Windows though.

[pwespi]

I tried to look for information regarding webkitgtk re-enabling SharedArrayBuffer, but I couldn't find anything.

Does anybody know anything about that?

[pwespi]

I just tested on Ubuntu 22.04 with libwebkit2gtk-4.0-dev/jammy,now 2.36.0-2ubuntu1. Using the localhost plugin (https://github.com/tauri-apps/tauri/issues/3917#issuecomment-1104433755), I can get window.crossOriginIsolated to be true, but SharedArrayBuffer is still not available.

[jlarmstrongiv]

Supporting SharedArrayBuffer would unblock access to packages like:

• https://wasm-vips.kleisauke.nl/
• https://ffmpegwasm.netlify.app/
• https://webcontainers.io/guides/quickstart

Does anyone have any updates or workarounds?

[franz-fletcher]

WebKit/WebKit#8578 (comment) describes the implementation and platform support surface attached to the merged changes that enable access to SharedArrayBuffer Objects docs using Atomics.waitAsync() docs on the main thread running JavaScriptCore.

Might be worth re-running tests on latest release of iOS, OSX and a linux build with updated WebKitGTK

[pwespi]

WebKit/WebKit#8578 (comment) describes the implementation and platform support surface attached to the merged changes that enable access to SharedArrayBuffer Objects docs using Atomics.waitAsync() docs on the main thread running JavaScriptCore.

Might be worth re-running tests on latest release of iOS, OSX and a linux build with updated WebKitGTK

@franz-fletcher Thank you for the link!

I just tested on Ubuntu 22.04.3 with libwebkit2gtk-4.0-dev/jammy-updates,jammy-security,now 2.42.3-0ubuntu0.22.04.1 and it's unfortunately still the same: I can get window.crossOriginIsolated to be true, but SharedArrayBufferis still not available.

[pwespi]

This is the app I'm using for testing: https://github.com/pwespi/tauri-app-shared-array-buffer (uses the localhost plugin).

The frontend part of it is deployed to https://tauri-app-shared-array-buffer.vercel.app/, such that it can also be used to test browsers.

Notable results:

Test	SharedArrayBuffer available
Tauri App on Ubuntu 22.04.3, WebKitGTK 2.42.3	false
Epiphany Browser on Ubuntu 22.04.3, WebKitGTK 2.42.3	false
Tauri App on macOS 14.2.1	true
Safari on macOS 14.2.1	true
Safari on iOS 17.2.1	true

[liudonghua123]

This is the app I'm using for testing: https://github.com/pwespi/tauri-app-shared-array-buffer (uses the localhost plugin).

The frontend part of it is deployed to https://tauri-app-shared-array-buffer.vercel.app/, such that it can also be used to test browsers.

Notable results:

Test SharedArrayBuffer available Tauri App on Ubuntu 22.04.3, WebKitGTK 2.42.3 false Epiphany Browser on Ubuntu 22.04.3, WebKitGTK 2.42.3 false Tauri App on macOS 14.2.1 true Safari on macOS 14.2.1 true Safari on iOS 17.2.1 true

@pwespi Hi, I tried your project to package webvm, but the tauri-plugin-localhost plugin use tiny-http which do not support range features currently.

See also https://github.com/tauri-apps/plugins-workspace/issues/880.

[halfkai]

after setting COOP/COEP headers, start app with env: __XPC_JSC_useSharedArrayBuffer=1 on MacOS will do the trick.

[vladfaust]

Current state:

• I can not make window.crossOriginIsolated to be true despite the headers being correctly set in production (using the on_web_resource_request approach). I'm on MacOS 14.5.

• Running the app with __XPC_JSC_useSharedArrayBuffer=1 force-enables SAB, but window.crossOriginIsolated stays false. The option is not viable for mass-production apps (users won't run the app via CLI).

• Using the localhost plugin works, but it emits this ugly "Allow incoming connections?" window.