Consider using an indirect eval for DYNAMIC_EXECUTION

[segevfiner]

The supporting JS code for DYNAMIC_EXECUTION currently uses a direct eval, which gives the eval-ed code access to names in the scope it is called from, as bundlers (Rollup, esbuild, and so on) cannot analyze such accesses, they emit a warning and might have to resort to performing less tree shaking.

Using an indirect eval ((0, eval)) avoids this, and if possible, should be preferred.

Of course, using eval at all is a problem with a CSP, though I think it might be possible to workaround that by injecting dynamic script tags with a nonce instead of using eval to allow running without unsafe-eval. But that's another issue.

[sbc100]

I wonder if we should also simply consider removing DYNAMIC_EXECUTION? (Especially now that we have the AOT option)

[segevfiner]

I think it is still used for dynamic module loading. Though implementing dynamic module loading without eval would of course be nice.

[sbc100]

Fair enough. Would you be up for making a pr to switch to eval ((0, eval))?