Files
basis_universal/webgl/encoder/README.md
T
Ben Polinsky b15211474d Add opt-in WebGL builds that do not use eval()/new Function()
With the default DYNAMIC_EXECUTION=1, embind generates its invokers at
runtime with new Function(). A Content-Security-Policy without
'unsafe-eval' blocks this, so the transcoder and encoder fail to start
with an EvalError.

Add two CMake options to webgl/transcoder and webgl/encoder:

- NO_DYNAMIC_EXECUTION (default OFF) adds -s DYNAMIC_EXECUTION=0.
- EMBIND_AOT (default ON, only used with NO_DYNAMIC_EXECUTION) adds
  -s EMBIND_AOT=1. This generates the invokers at build time, so
  embind calls stay as fast as with the default build.

The default build does not change. The .wasm output is byte-identical
in all configurations; only the JS glue changes.

Fixes #464
2026-10-19 09:51:05 -04:00

27 lines
1.2 KiB
Markdown

Prebuilt versions of `basis_encoder.js` and `basis_encoder.wasm` are included in the `build/` folder, and are sufficient for local demos. Note the encoder also includes the transcoder. To build the encoder yourself, first install emscripten ([tutorial](https://webassembly.org/getting-started/developers-guide/)) and cmake ([download](https://cmake.org/download/)). Then run:
```shell
cd webgl/encoder/build/
emcmake cmake ../
make
```
### Strict Content-Security-Policy (no `unsafe-eval`)
By default, the generated JavaScript glue uses `new Function()` to build its
embind bindings at runtime. A Content-Security-Policy without `'unsafe-eval'`
blocks this, and module startup fails with an `EvalError`. To build glue that
never calls `eval()` or `new Function()`, add `-DNO_DYNAMIC_EXECUTION=ON`:
```shell
emcmake cmake ../ -DNO_DYNAMIC_EXECUTION=ON
make
```
This adds `-s DYNAMIC_EXECUTION=0 -s EMBIND_AOT=1` to the link flags. The
`.wasm` file does not change. `EMBIND_AOT` generates the bindings at build
time, so JavaScript-to-WASM calls stay as fast as in the default build. The
page still needs `'wasm-unsafe-eval'` in `script-src` to compile the
WebAssembly module. Use `-DEMBIND_AOT=OFF` to get the smaller, generic
bindings, which are slower per call.