Archers are broken

[Vaurren]

Currently when trying to use the archer's 'Fire' command the game freezes.

[Vaurren]

This is using the web version from these files.

[lss4]

If you look at F12 console of the browser (Firefox, for example) you'll see an Uncaught DOMException: The operation is insecure. when the freeze happens. The cause of this case is this line.

It seems newer browsers introduced some security features that are causing certain ImageProcessor functions to throw such exceptions thus resulting the freeze, considering this engine is quite dated.

PS: Was able to work this freeze around, but after playing the demo a bit further, it seems this is also broken, causing freeze when a glowing effect occurs due to security violation. Probably there are more breakages than these due to all the security features added in the past few years.

PPS: Consider use a period-correct web browser version (released around the 2014-2015) to see if these functions work correctly there (that is, without the security violations observed in recent browser versions).

EDIT: See my next comment. Unless it's possible to refactor ImageProcessor, this game must be hosted on a web server in order to work correctly.

[lss4]

An update. Looks like you simply cannot just run it by opening index.html locally, because drawing a local file (file://) into canvas will always taint it, preventing certain functions from working for security reasons. This breaks a lot of ImageProcessor functionality.

For now it must be hosted with a local HTTP server and start it from there, and everything will work. A very simple HTTP server should be enough.

I wonder if it's possible to refactor the ImageProcessor part to avoid this issue when running the page locally... There may be some ways:

• Avoid getting existing contents out of the canvas (which cannot be done on a tainted one).
• Change the way of loading the image to avoid containing information that would make browser consider the canvas tainted.

EDIT: Tried this trick and it doesn't work, either (blocked by CORS). Not sure about the possibility of the former, but the latter is pretty much an "attack" against the browser.