Skip to content

Conversation

sbc100
Copy link
Collaborator

@sbc100 sbc100 commented Oct 17, 2025

For some reason creating new workers across origins is not allowed,
even when importScripts is.

Added a test case which was confirmed to fail without this PR.

Fixes: #21937

@sbc100 sbc100 force-pushed the cross_origin_workers branch from bbd5887 to 205fbb3 Compare October 17, 2025 23:21
@sbc100 sbc100 changed the title . Allow pthread-based programs to be loaded cross-origin Oct 17, 2025
Copy link
Member

@dschuff dschuff left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't say I 100% understand the limitation here, but if the feedback from all the folks on the bug is that this workaround works and that the test represents their use case, then LGTM. I wonder if it's also worth running this change through the internal testing script before landing it.

@dschuff
Copy link
Member

dschuff commented Oct 17, 2025

Actually I guess the internal tester might not test serving in a prod environment, but maybe still worth doing.

@dschuff
Copy link
Member

dschuff commented Oct 17, 2025

maybe also worth getting a review from one of our CDN-affiliated friends, such as @RReverser ?

@RReverser
Copy link
Collaborator

RReverser commented Oct 17, 2025

It's a known limitation & workaround, but I suspect we might want to put it behind a separate flag, at least behind -s DYNAMIC_EXECUTION which is what this essentially does (constructing a piece of JS to execute on the fly).

Blob URLs can be prohibited by CSP policies, and in fixing the cross-origin usecase we can break the much more common same-origin one if the origin happens to use stricter security policy that prohibits dynamically created JS / resources in general.

@sbc100 sbc100 force-pushed the cross_origin_workers branch 2 times, most recently from d43946b to dd3e9cc Compare October 17, 2025 23:52
@sbc100
Copy link
Collaborator Author

sbc100 commented Oct 17, 2025

I can't say I 100% understand the limitation here, but if the feedback from all the folks on the bug is that this workaround works and that the test represents their use case, then LGTM. I wonder if it's also worth running this change through the internal testing script before landing it.

I mean I was able to repro the exactly failure.. so this change does provably solve a version of this issue for sure.

And the folks on the bug talk about this workaround working for them. So I'm pretty confident this is a working fix.

@sbc100 sbc100 force-pushed the cross_origin_workers branch from dd3e9cc to e37940f Compare October 17, 2025 23:55
@sbc100
Copy link
Collaborator Author

sbc100 commented Oct 17, 2025

Added a new setting.

@sbc100 sbc100 force-pushed the cross_origin_workers branch 2 times, most recently from 3616d98 to 6d39f04 Compare October 18, 2025 00:05
@sbc100 sbc100 force-pushed the cross_origin_workers branch from 6d39f04 to 7bb2093 Compare October 18, 2025 00:06
For some reason creating new workers across origins is not allowed,
even when `importScripts` is.

Added a test case which was confirmed to fail without this PR.

Fixes: emscripten-core#21937
@sbc100 sbc100 force-pushed the cross_origin_workers branch from 7bb2093 to 0f5c761 Compare October 18, 2025 00:58
@sbc100 sbc100 merged commit d8f3334 into emscripten-core:main Oct 18, 2025
4 of 15 checks passed
@sbc100 sbc100 deleted the cross_origin_workers branch October 18, 2025 00:59
sbc100 added a commit to sbc100/emscripten that referenced this pull request Oct 18, 2025
This setting was recently added in emscripten-core#25581 and it only currently has
en effect on pthread-based programs.

It is also not compatible with `-sNO_DYNAMIC_EXECUTION` because it
depends on starting worker based on JS string.

These errors look like this:

```
$ emcc -sCROSS_ORIGIN -pthread -sDYNAMIC_EXECUTION=0 hello.c
emcc: error: CROSS_ORIGIN is not compatible with DYNAMIC_EXECUTION=0
```
sbc100 added a commit that referenced this pull request Oct 18, 2025
This setting was recently added in #25581 and it only currently has en
effect on pthread-based programs.

It is also not compatible with `-sNO_DYNAMIC_EXECUTION` because it
depends on starting worker based on JS string.

These errors look like this:

```
$ emcc -sCROSS_ORIGIN -pthread -sDYNAMIC_EXECUTION=0 hello.c
emcc: error: CROSS_ORIGIN is not compatible with DYNAMIC_EXECUTION=0
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cross Origin pthread worker

3 participants