Allow SharedArrayBuffer to be used by extensions in vscode.dev (using cross-origin isolation)

[michalbali256]

Does this issue occur when all extensions are disabled?: No

• VS Code Version: 1.62.3 (vscode.dev)
• Browser Version: Chrome 96

Hi,

I am trying to make our extension (https://github.com/eclipse/che-che4z-lsp-for-hlasm) work in browser environment so it can be used with web version of vscode. It is written in C++ and we are using emscripten to compile it into WebAssembly. The C++ backend uses multiple threads, which translate into web workers and emscripten uses SharedArrayBuffer to communicate between them. However SharedArrayBuffer is not available on vscode.dev, since the site does not use cross-origin isolation - see this: https://developer.chrome.com/blog/enabling-shared-array-buffer/

Steps to Reproduce:

1. Open vscode.dev in your browser (I tried with Chrome 96).
2. Install this extension: https://marketplace.visualstudio.com/items?itemName=mbali.hlasm-browser-dev
3. Open arbitrary folder on your computer (empty one is enough)
4. Create a new empty file
5. Open developer tools of browser
6. Choose HLASM as language of the file
   In the Console of developer tools, this message shows:
   
   And of course, the extension is not enabled.

Additional Info:

I have managed to get it working by starting chrome with disabled security:

chrome.exe --enable-features=SharedArrayBuffer --disable-web-security --user-data-dir="<some-folder-on-your-computer>"

If I reproduce those steps with chrome started this way, the extensions works as expected (just try to type something and there will by some diagnostics).

BTW I have opened a similar issue (microsoft/vscode-test-web#14) in the vscode-test-web repository, but nobody noticed it there, so I created this issue with reproducible example.

[bpasero]

Related: #116715

[jrieken]

March to investigate. Enabling crossOrigin isolation can have some ripple on things that we load and those need CORP or CORS to continue to work

[jrieken]

We know what to do here but there is still work to configure our CDNs and to find resources that aren't CORP-ready yet

[jrieken]

Enabling this unfortunately has unwanted side-effects on extensions using webview. I believe we are blocked until browsers relax restrictions for embedded iframe a bit, see #145539 (comment)

[jrieken]

We will do more exploring during June

[jrieken]

Plan for July

• add support for a url-query like ?vscode-coi (cross origin isolation)
• when present the server responds with the COOP/COEP headers
• this enables COI for the renderer
• when creating descendant resources (e.g. worker based extension host, web views) we check for globalThis.crossOriginIsolated and use the the same url-query so that our CDN can respond with the COEP header for them
• this enables COI for the web worker extension host
• (optionally set a cookie so that subsequent loads don't need the vscode-coi query)

[jrieken]

Once we have that we can explore and see what all breaks - webviews loading 3rd party resources, auth, embedding...

[chenzx]

We're building a internal wasm ui design/edtior as a vscode plugin which needs SharedArrayBuffer feature, expect this to ship in July!

[jrieken]

This is now live on insiders.dev. You have to use the vscode-coi-query argument to enable cross-origin isolation, e.g https://insiders.vscode.dev/?vscode-coi.

Note that for now this is only for insiders.vscode.dev - stable (vscode.dev) will follow with the normal release flow and github.dev will follow later, esp after having gained more insights. Also expect that some external resources aren't loading - they need the CORP header to be set. Please file issues for those cases. Last, this is for web only - #116715 tracks a similar effort for desktop

[jrieken]

[jgentes]

I tested this after building from the latest VSC source and running .\scripts\code-web.bat to launch VSCode for Web, but it looks like the vscode-coi argument doesn't work there. I still see crossOriginIsolated = false in the console and also when I initiate that check in a WebView from an extension. This is using version 1.70.0.

I've added a request for vscode-test-web to support this (microsoft/vscode-test-web#31) otherwise is there another way to test it locally?

Thanks!

[jrieken]

To verify

• open insiders.vscode.dev with the ?vscode-coi query
• make sure everything loads
• test a webview extensions and see if they work or not