Catch disallowed instantiation when CSP is active

[mnater]

From https://github.com/mnater/Hyphenopoly/issues/121:

If the website has a CSP that doesn't allow WebAssembly (because unsafe-eval isn't allowed) we get an error:

Chrome: Uncaught (in promise) CompileError: WebAssembly.instantiateStreaming(): Wasm code generation disallowed by embedder

Safari: Unhandled Promise Rejection: EvalError: Refused to create a WebAssembly object because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'".

(works in FF)

[dimovpetar]

Hello @mnater ,

Do you have any suggestions how to use Hyphenopoly if WebAssembly is blocked? Right now we fallback to asm.js when unsafe-eval is not present. But the last version that supports asm.js is 3.4.0. Any chance to use it with the latest?

Best regards, Petar

[mnater]

No, I don't have a solution for that at the moment.

I removed the fallback to asm.js from Hyphenopoly on purpose and for various reasons:

• It halves the file size of Hyphenopoly_Loader.js.
• In version 3 I programmed the core in asm.js and then compiled to Webassembly with "Binaryen". This function has disappeared from "Binaryen", because asm.js was no longer developed. Since version 4 the core is written in Assemblyscript and then compiled to Webassembly. Theoretically it is possible to compile from Assemblyscript to Javascript, but the resulting file is huge.

You'll either need to enable unsafe-eval or stick with the legacy version of Hyphenopoly -- or wait for wasm-unsafe-eval (https://github.com/WebAssembly/content-security-policy/blob/master/proposals/CSP.md) to be standardised and implemented in Chrome (it's enabled for extensions and web apps)...