Workers and shared memory

A Web Worker runs in a separate global environment and can perform work alongside the main thread. Ordinary postMessage uses structured cloning, while transferable objects move ownership. SharedArrayBuffer lets multiple agents access the same backing memory, but using it does not make an application universally zero-copy or automatically faster. The application must design the buffer layout, partition work, coordinate lifecycle, and handle shutdown.

Atomics provide coordination primitives

Ordinary reads and writes to shared memory do not by themselves establish a synchronization protocol between agents. Atomics provides atomic operations and ordering for shared integer TypedArrays, which can define transitions for counters, flags, and queues. Atomics.wait() cannot block the browser’s main thread; blocking waits are restricted to allowed execution contexts such as workers. The permitted array types and memory model come from ECMAScript. Atomics do not prevent deadlocks or repair a flawed protocol.

Cross-origin isolation in browsers

In modern browsers, web pages generally need a cross-origin isolated context to use SharedArrayBuffer. A common server setup sends Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp, or credentialless where supported, on the top-level document, then checks self.crossOriginIsolated. Under COEP, cross-origin subresources must be permitted through appropriate CORS or CORP responses. Iframes can add Permissions Policy requirements and require the full ancestor and child chain to satisfy isolation conditions. Check current support for the browser and embedding context in use.

Security headers have compatibility costs

COOP affects browsing-context relationships and opener communication; COEP can block embedded resources that do not opt in. Enabling them can change OAuth popups, payment windows, advertising or analytics scripts, and third-party images. Start with Report-Only reporting and test these flows. Isolation is a browser condition for exposing sensitive shared features; it does not guarantee separate operating-system processes or immunity from every side-channel attack.

Expert engineering guidance

The Google Chrome Developers engineering experts’ guide on web.dev explains the deployment work: audit subresources for CORS/CORP, account for the whole iframe isolation chain, and verify crossOriginIsolated. This is implementation guidance, not a substitute for the browser standards. Test feature detection, worker messaging, external assets, and popup flows in the browser versions you support. Browser compatibility changes over time, so use the current compatibility data and runtime checks rather than memorizing one release number as a universal requirement.

References