Files
basis_universal/webgl/encoder/README.md
T
Ben Polinsky b15211474d Add opt-in WebGL builds that do not use eval()/new Function()
With the default DYNAMIC_EXECUTION=1, embind generates its invokers at
runtime with new Function(). A Content-Security-Policy without
'unsafe-eval' blocks this, so the transcoder and encoder fail to start
with an EvalError.

Add two CMake options to webgl/transcoder and webgl/encoder:

- NO_DYNAMIC_EXECUTION (default OFF) adds -s DYNAMIC_EXECUTION=0.
- EMBIND_AOT (default ON, only used with NO_DYNAMIC_EXECUTION) adds
  -s EMBIND_AOT=1. This generates the invokers at build time, so
  embind calls stay as fast as with the default build.

The default build does not change. The .wasm output is byte-identical
in all configurations; only the JS glue changes.

Fixes #464
2026-10-19 09:51:05 -04:00

1.2 KiB

Prebuilt versions of basis_encoder.js and basis_encoder.wasm are included in the build/ folder, and are sufficient for local demos. Note the encoder also includes the transcoder. To build the encoder yourself, first install emscripten (tutorial) and cmake (download). Then run:

cd webgl/encoder/build/
emcmake cmake ../
make

Strict Content-Security-Policy (no unsafe-eval)

By default, the generated JavaScript glue uses new Function() to build its embind bindings at runtime. A Content-Security-Policy without 'unsafe-eval' blocks this, and module startup fails with an EvalError. To build glue that never calls eval() or new Function(), add -DNO_DYNAMIC_EXECUTION=ON:

emcmake cmake ../ -DNO_DYNAMIC_EXECUTION=ON
make

This adds -s DYNAMIC_EXECUTION=0 -s EMBIND_AOT=1 to the link flags. The .wasm file does not change. EMBIND_AOT generates the bindings at build time, so JavaScript-to-WASM calls stay as fast as in the default build. The page still needs 'wasm-unsafe-eval' in script-src to compile the WebAssembly module. Use -DEMBIND_AOT=OFF to get the smaller, generic bindings, which are slower per call.