Is it possible avoid binding js to use unsafe-eval syntax?

[yunsii]

I have tried to migrate https://github.com/yunsii/fasttext.wasm.js to used in background script of browser extension, after wasm file loaded successful, the binding js encounter the below error:

[brendandahl]

-sDYNAMIC_EXECUTION=0

emscripten/src/settings.js

Lines 1302 to 1333 in 25308a1

	// When set to 0, we do not emit eval() and new Function(), which disables some
	// functionality (causing runtime errors if attempted to be used), but allows
	// the emitted code to be acceptable in places that disallow dynamic code
	// execution (chrome packaged app, privileged firefox app, etc.). Pass this flag
	// when developing an Emscripten application that is targeting a privileged or a
	// certified execution environment, see Firefox Content Security Policy (CSP)
	// webpage for details:
	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
	// in particular the 'unsafe-eval' and 'wasm-unsafe-eval' policies.
	//
	// When this flag is set, the following features (linker flags) are unavailable:
	//
	// - RELOCATABLE: the function loadDynamicLibrary would need to eval().
	//
	// and some features may fall back to slower code paths when they need to:
	// Embind: uses eval() to jit functions for speed.
	//
	// Additionally, the following Emscripten runtime functions are unavailable when
	// DYNAMIC_EXECUTION=0 is set, and an attempt to call them will throw an exception:
	//
	// - emscripten_run_script(),
	// - emscripten_run_script_int(),
	// - emscripten_run_script_string(),
	// - dlopen(),
	// - the functions ccall() and cwrap() are still available, but they are
	// restricted to only being able to call functions that have been exported in
	// the Module object in advance.
	//
	// When -sDYNAMIC_EXECUTION=2 is set, attempts to call to eval() are demoted to
	// warnings instead of throwing an exception.
	// [link]
	var DYNAMIC_EXECUTION = 1;

[yunsii]

@brendandahl Thanks for your quick response, I will have a try today and the settings.js I will read carefully.

[yunsii]

@brendandahl Thanks very much, it works well in my browser extension example project https://github.com/yunsii/browser-extension-with-fasttext.wasm.js

[brendandahl]

I'd note that the bindings will be much slower without eval. Whether that matters is how frequently the JS->C++ code path is used, but there's a new option -sEMBIND_AOT to generate the binding glue code during compilation and keep the speed of the old bindings.

[yunsii]

bindings will be much slower without eval

Yes, I've noticed this problem, but -sDYNAMIC_EXECUTION comment:

emscripten/src/settings.js

Lines 1316 to 1317 in 249cf8c

	// and some features may fall back to slower code paths when they need to:
	// Embind: uses eval() to jit functions for speed.

do not provide the -sEMBIND_AOT infomation.

I will try to use -sEMBIND_AOT today.

[yunsii]

After add -sEMBIND_AOT option, encounter runtime error:

[brendandahl]

Can you set a breakpoint or log what humanName is in craftInvokerFunction and also share the c++ function and what the binding is for it?

[yunsii]

C function here: https://github.com/facebookresearch/fastText/blob/6c2204ba66776b700095ff73e3e599a908ffd9c3/src/fasttext.h#L105

For the convient, my reproduction repo with branch reproduction: https://github.com/yunsii/fasttext.wasm.js/blob/reproduction/xmake.lua#L26