Soundness bug with Send+Sync implementations in the browser #4158
Labels
🚨 breaking change
This Issue or PR involves a breaking change
📦 lib-api
About wasmer
priority-high
High priority issue
🔈soundness
Bugs causing an unsound API
Milestone
Describe the bug
It looks like we accidentally introduced a soundness bug in #3556 when adding
Send+Sync
bounds to things likewasmer::js::Module
andwasmer::js::Memory
.Here's one example:
wasmer/lib/api/src/js/module.rs
Lines 48 to 57 in d53b9e2
The underlying assumption is that because a type implements
structuredClone
it's fine to implementSend
andSync
.However,
structuredClone
only applies when sending values to a worker usingpostMessage
.If you use any other method to transfer a value to another thread (e.g. channels) then the underlying
JsValue
will point to the wrong object on that thread's wasm-bindgen "heap" and you'll have a bad time.Additional context
See the conversation on Slack for more
The text was updated successfully, but these errors were encountered: