Re: [w3c/IndexedDB] Clarify usage of SharedArrayBuffer as key (Issue #506)

asutherland left a comment (w3c/IndexedDB#506)

Brief discussion among the Firefox storage team is that we think it makes sense for the spec to explicitly disallow/forbid use of SharedArrayBuffers for keys.  In particular:

1. As the chromium commit message mentions, it's forbidden for values by step 13.1.2 [of StructuredSerializeInternal](https://html.spec.whatwg.org/multipage/structured-data.html#structuredserializeinternal) since it's forStorage so if it's not a valid value why should it be a valid key?
2. The TOCTOU bug that motivated this for Firefox in https://bugzilla.mozilla.org/show\_bug.cgi?id=2024440 is a legitimately annoying thing for spec and implementation purposes and especially for web-compat even if it doesn't cause security bug problems because the time at which any snapshot is made is inherently content-observable.
3. Supporting SharedArrayBuffers seems at best a foot-gun for web developers.  Yes, there would be ways to use it safely, but if you mess up your sync between threads you've now got a really weird data corruption problem on your hands that didn't need to exist.  Requiring callers to snapshot their SharedArrayBuffers themselves is not much to ask and also avoids round-tripping consistency problems since [convert a key to a value](https://w3c.github.io/IndexedDB/#convert-key-to-value) will not mint a SharedArrayBuffer, only an ArrayBuffer.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/IndexedDB/issues/506#issuecomment-5699653317
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/IndexedDB/issues/506/5699653317@github.com>