Skip to content

Fail fast without cross-origin isolation; keep WebGPU out of 0-layer loads - #219

Merged
leehack merged 3 commits into
mainfrom
lane-1025-coi-failfast
Nov 13, 2026
Merged

leehack merged 3 commits into
mainfrom
lane-1025-coi-failfast

Conversation

@leehack

@leehack leehack commented Nov 13, 2026 •

Copy link
Copy Markdown
Owner

Part of leehack/llamadart#1025 (0.19.10 plan leehack/llamadart#1995). Fixes #215 and #218. #216 (memory64 reason) and #217 (Safari GPU cap/probe) stay open.

Changes

  • B1 (Fail fast with a typed error when the page is not cross-origin isolated #215): _ensureCore probes MessageChannel.postMessage(new WebAssembly.Memory({shared:true})) before loading a coreModuleUrl core. When it throws, the load rejects at once with CrossOriginIsolationError (code: 'CROSS_ORIGIN_ISOLATION_REQUIRED'), naming COOP/COEP require-corp and that credentialless does not isolate Safari. The error survives the worker protocol. It probes the post, not crossOriginIsolated, so Chrome with SharedArrayBuffer enabled by flag still loads.
  • Opt-out: allowSingleThreadCore: true is for a core built without pthreads (WEBGPU_BRIDGE_PTHREADS=0). It loads on a non-isolated page, capped to one thread, with the threads_capped_no_coi note. A custom coreModuleFactory skips the gate, so a custom pthread core still waits for coreInitTimeoutMs (documented).
  • B4 (Do not create or initialise the WebGPU backend when nGpuLayers is 0 #218): load_model_internal passes an empty devices list when n_gpu_layers == 0, so the model and context never get the WebGPU backend. splitMode: 3 (TENSOR) falls back to LAYER there, since the empty list has no device.
  • GPU fallback note: a load with nGpuLayers > 0 that ends on the CPU adds gpu_unavailable:<reason> (no_webgpu, no_adapter, adapter_missing_shader_f16, unknown) and one warning. Chrome hides shader-f16 on NVIDIA drivers older than 615.71 and ggml-webgpu then registers no device.
  • Public: CrossOriginIsolationError and allowSingleThreadCore exported/declared; docs/api.md and changelog updated.

Validation

Check Result
npm run check:js 606 pass, 4 skipped (python-only), 0 fail
New tests cross_origin_isolation_test.mjs, cpu_only_devices_native_test.mjs, gpu_unavailable_reason_test.mjs; each failed before its fix
Mutations gate, isolated-page, worker code, 0-layer devices, opt-out, thread cap, cap note, TENSOR fallback, and 6 GPU-note mutations: all killed
state_persistence.mjs wasm32 and wasm64 ok
Browser (stories15M, 0 layers) main this PR
Chrome, not isolated 20.2 s timeout (two attempts at 10 s) CrossOriginIsolationError at 0.09-0.16 s
Firefox 160, not isolated 20.3 s 0.24 s
Safari 27, not isolated 20.0 s 0.03 s
Firefox 160, isolated, direct and worker 10 tok/s 220-340 tok/s (WebGPU off: 225-330)
Chrome, isolated / 99 layers works works, WebGPU active
Pthread-off core, not isolated loads rejects; loads, 1 thread, with allowSingleThreadCore
splitMode: 3 at 0 layers loads loads

Audits (local evidence): first audit at 515582e and delta re-audit at efbf0ae, both no-block, in llamadart-evidence/bridge-pr-219/ and llamadart-evidence/bridge-pr-219/delta-efbf0aea/.

…er loads

A page that cannot post shared memory to workers now rejects a load at once
with CrossOriginIsolationError instead of waiting for the core init timeout,
and the dead threads_capped_no_coi note is removed. A load with nGpuLayers 0
passes an empty device list so Firefox's 100 ms WebGPU queue ticks no longer
gate every CPU sync.

Fixes #215
Fixes #218
… layers, explain GPU fallback

allowSingleThreadCore lets a core built without pthreads load on a page that is
not cross-origin isolated, capped to one thread. A zero-layer load with
splitMode TENSOR falls back to LAYER because the CPU-only device list is empty.
A load with nGpuLayers > 0 that runs on the CPU adds gpu_unavailable:<reason>
and one warning.
@leehack
leehack merged commit f1ac2fc into main Nov 13, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fail fast with a typed error when the page is not cross-origin isolated

1 participant