Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove Send and Sync from wasmer types backed by JavaScript objects #4157

Closed
wants to merge 2 commits into from

Conversation

Michael-F-Bryan
Copy link
Contributor

@Michael-F-Bryan Michael-F-Bryan commented Aug 17, 2023

This fixes a soundness bug introduced in #3556 which added Send+Sync bounds to things like wasmer::js::Module and wasmer::js::Memory.

Here's one example:

// Module implements `structuredClone` in js, so it's safe it to make it Send.
// https://developer.mozilla.org/en-US/docs/Web/API/structuredClone
// ```js
// const module = new WebAssembly.Module(new Uint8Array([
// 0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00
// ]));
// structuredClone(module)
// ```
unsafe impl Send for Module {}
unsafe impl Sync for Module {}

The underlying assumption is that because a type implements structuredClone it's fine to implement Send and Sync.

However, structuredClone only applies when sending values to a worker using postMessage.

If you use any other method to transfer a value to another thread (e.g. channels) then the underlying JsValue will point to the wrong object on that thread's wasm-bindgen "heap" and you'll have a bad time.

Fixes #4158.

@Michael-F-Bryan Michael-F-Bryan added 🔈soundness Bugs causing an unsound API 📦 lib-api About wasmer priority-high High priority issue 🚨 breaking change This Issue or PR involves a breaking change labels Aug 17, 2023
@Michael-F-Bryan Michael-F-Bryan added this to the v4.1.2 milestone Aug 17, 2023
@Michael-F-Bryan Michael-F-Bryan marked this pull request as draft August 17, 2023 06:56
@@ -0,0 +1,32 @@
/// Assert that a type does **not** implement a set of traits.
macro_rules! assert_not_implemented {
($t:ty : !$first:ident $(+ !$rest:ident)*) => {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a small nit: assert_not_implemented!(Instance: !Send + !Sync); sounds like a double negative. so one might initially expect Instance to not implement !Send, i.e. that Instance should be Send. I don't have suggestions for alternate syntax though.

@ptitSeb ptitSeb modified the milestones: v4.1.2, v4.2 Aug 17, 2023
// structuredClone(memory)
// ```
unsafe impl Send for Memory {}
unsafe impl Sync for Memory {}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Side note: should't clippy have required a Safety: ... comment here?

Copy link
Contributor

@theduke theduke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Although: this is technically a breaking change, and would require a 5.0...

Although we can probably get by with just ignoring this here, since it is basically a bug fix.

@@ -11,9 +11,7 @@ pub struct Table {
pub(crate) handle: VMTable,
}

// Table can't be Send in js because it dosen't support `structuredClone`
// https://developer.mozilla.org/en-US/docs/Web/API/structuredClone
// unsafe impl Send for Table {}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we keep a comment on all assert_not_implemented usage points so future readers know what's going on here?

@syrusakbary
Copy link
Member

This PR looks great, but it will require further rework on WASIX to make it work with this changes

@syrusakbary syrusakbary closed this Jan 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🚨 breaking change This Issue or PR involves a breaking change 📦 lib-api About wasmer priority-high High priority issue 🔈soundness Bugs causing an unsound API
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Soundness bug with Send+Sync implementations in the browser
5 participants