# How enabling cross-origin isolation silently broke our multi-threaded WASM image compressor

> Source: <https://dev.to/richang/-how-enabling-cross-origin-isolation-silently-broke-our-multi-threaded-wasm-image-compressor-3a0p>
> Published: 2026-09-04 09:39:01+00:00

*A production postmortem. We shipped browser-side image compression (Rust → WASM + WebGPU), turned on cross-origin isolation for speed, and watched every format crash with compression worker crashed. Here's the root cause and the fix.*

We built an image compressor that runs **100% in the browser** — Rust compiled to WASM for the codec work, WebGPU for the heavy ML passes (background removal, denoise, watermark). No upload, so users' pixels never leave the device. Privacy is the whole selling point.

For the multi-threaded code paths we rely on **shared memory + atomics**, which in the browser requires `crossOriginIsolated`

. So we served the document with:

```
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
```

That gives us `crossOriginIsolated === true`

, unlocks `SharedArrayBuffer`

, and lets the `*‑threaded`

WASM builds actually spawn workers.

The build uses a nightly toolchain (`nightly-2025-06-01`

+ `-Z build-std`

) with:

```
RUSTFLAGS="--cfg=... +atomics,+bulk-memory --shared-memory --import-memory"
```

and a **custom rayon handle pool** (`with_turbo_pool`

) instead of `build_global`

, so we control worker lifecycle and can abort/self-heal.

After flipping COEP to `require-corp`

in production, **every format started crashing** with the same message:

```
compression worker crashed
```

Not one codec — JPG, PNG, WebP, AVIF, all of them. It was a P0: the core feature was dead for every user.

What made it nasty: it only reproduced under **real cross-origin isolation**. Local dev without COEP was fine. Staging without the header was fine. So the bug hid until it hit production traffic.

The `*‑threaded`

WASM packages spin up **nested rayon workers** to parallelize the codec. Under COI + COEP `require-corp`

, those nested workers get blocked by `Cross-Origin-Resource-Policy`

/ COEP — the spawned worker script is treated as a cross-origin response without the right CORP header, so the browser refuses it. No worker → the rayon pool never initializes → the compression call throws `compression worker crashed`

.

The trap: we had gated the *‑threaded* build on `crossOriginIsolated`

:

```
// ❌ the bug: environment detection == feature enable
if (crossOriginIsolated) {
  loadThreadedPackage();   // boots nested rayon workers → blocked by COEP
}
```

So **enabling COI auto-enabled the broken path**. COI was supposed to be the enabler, but it also activated the exact code that COEP then killed. A perfect deadlock between two headers we set ourselves.

(This matches the fix commits `569731d`

"默认压缩路径禁用 *-threaded 线程包" and `73e9377`

"COI 下 module worker 被 COEP 拦死".)

Three changes, all in the loader — not the codec:

**1. Decouple "COI is available" from "use threads."**

We no longer load `*‑threaded`

just because `crossOriginIsolated`

is true. It loads **only on an explicit opt-in** — our "Turbo" toggle (`v2.compressAccel`

):

``` js
// ✅ capability != automatic enable
const wantsTurbo = settings.compressAccel === true; // user/plan explicit
if (wantsTurbo && crossOriginIsolated) {
  loadThreadedPackage();
}
// default path stays single-threaded and COEP-safe
```

**2. Keep the single-threaded path as the default and make it robust.**

The non-threaded wasm (e.g. ORT 1.17 legacy, which ships a real single-thread build) works fine under COEP. Defaulting to it means COI no longer breaks the common case.

**3. Self-heal on worker crash.**

`pool.ts`

now catches a dead worker and retries on the safe path, and **aborts Turbo multi-core** rather than bubbling a hard crash:

``` js
worker.oncrash = () => {
  retryOnSingleThread();   // f8c86d5: 自愈重试覆盖 JPG/PNG/WEBP
  disableTurbo();          // fall back, don't hard-fail
};
```

Commits `2177a9f`

(AVIF worker abort self-heal + rebuild `pkg-avif`

) and `f8c86d5`

(self-heal retry covering core paths) closed the remaining formats.

rav1e parallelizes via rayon too, but its pool **doesn't read our custom env pool** — it builds its own. Under COI that meant AVIF either ignored our thread budget or hit the same COEP wall. The takeaway: don't assume one rayon pool config applies across codecs. Each WASM crate may own its threading model. `[需你核对：rav1e 当前是走全局池还是注入句柄，以代码为准]`

`crossOriginIsolated`

unlocks speed `if (crossOriginIsolated) enableThreads`

couples two unrelated decisions. Gate on intent, verify the environment.`crossOriginIsolated`

is false on `localhost`

and most staging setups. If your threaded path only runs when isolated, you will not exercise it until production. Stand up a COEP-serving preview.`cc605f5`

).`COEP: require-corp`

+ `COOP: same-origin`

on a real preview, not localhost.`Cross-Origin-Resource-Policy: same-origin`

(or `cross-origin`

if truly cross-origin).This compressor — and the Turbo path described above — runs in ** zipo.pics**. The full internal postmortem lives in our repo; the architectural facts above are from the fix commits

`569731d`

, `73e9377`

, `2177a9f`

, `f8c86d5`

. Happy to compare notes if you've fought the same COI/COEP war.