Under The Hood
frontend javascript ES2017+ (SharedArrayBuffer, Atomics)

SharedArrayBuffer & Atomics: Multi-Thread Memory and Futex Locking

Last updated
Prerequisites:
Web Workers and message passing basics
Understanding of typed arrays and ArrayBuffer
  • sharedarraybuffer
  • atomics
  • worker
  • memory-model
  • futex
  • concurrency

Read at your depth

The practical view

SharedArrayBuffer is an ArrayBuffer that multiple workers can access at the same time — no copying/messaging. You view it with a typed array: const sab = new SharedArrayBuffer(4); const view = new Int32Array(sab);. Atomics provides atomic operations: Atomics.add(view, 0, 1), Atomics.load, Atomics.store, Atomics.compareExchange, and Atomics.wait / Atomics.notify for blocking coordination. This enables lock-free data structures and faster shared state than postMessage copying. Note: SharedArrayBuffer requires cross-origin isolation (COOP/COEP headers) in browsers for security (Spectre mitigation).

The same idea in other frameworks

react equivalent
React Native and web worker offloading can use SharedArrayBuffer for image/frame buffers between threads.

Legacy vs modern

Worker coordination: postMessage copying vs SharedArrayBuffer + Atomics

postMessage clones data per message (allocation + serialization); a SharedArrayBuffer shares the same bytes with atomic synchronization for zero-copy handoff.

before → after
postMessage with cloning
worker.postMessage(bigData); // ❌ OLD: structured-clones the whole buffer per message
SharedArrayBuffer + Atomics handoff
const sab = new SharedArrayBuffer(100_000_000); // ✅ NEW: zero-copy shared region
Atomics.store(view, i, value); Atomics.notify(view, 0);

Interview gotchas

Context

This tests awareness of the security-driven deployment constraint, not just API knowledge — a real gotcha when shipping SAB-based apps.

The mechanical answer

SharedArrayBuffer was disabled after the Spectre/Meltdown CPU vulnerabilities because shared memory plus high-resolution timers enable timing side channels. Browsers re-enabled it only inside a cross-origin-isolated context: the page must serve COOP: same-origin and COEP: require-corp (and the response must be valid for those headers), and self-isolated iframes. Without those headers, window.SharedArrayBuffer and window.Atomics are undefined or throw (in some engines they are disabled entirely). This affects deployment: CDNs, third-party scripts, and subresources must all satisfy the COEP requirement, or the feature is unavailable in production even though it works in localhost dev.

Trap

The naive answer is 'SAB is just an ArrayBuffer you share, no setup needed'. In modern browsers the security headers are mandatory. Another trap: assuming the error is a feature-availability check you can polyfill — SAB cannot be polyfilled because it requires OS-level shared memory; you must restructure headers or fall back to postMessage cloning.

Under The Hood — a multi-depth technical interview hub.

Third-party licenses Press ⌘ K to search.