test.js

var blob = new Blob([
    "onmessage = function(e) { postMessage('msg from worker'); }"],
    {type:"application/javascript"}
);

// Obtain a blob URL reference to our worker 'file'.
var blobURL = window.URL.createObjectURL(blob);

var worker = new Worker(blobURL);
worker.onmessage = function(e) {
  var p = document.createElement('p');
  p.textContent = e.data;
  document.body.appendChild(p);
  console.log(e.data);
  // e.data == 'msg from worker'
};
worker.postMessage(""); // Start the worker.

When I test this on a Keon using FFOS 1.1 I get no output and no error. Of course, I rarely get any errors for anything even syntax errors. It works just fine using the simulator. Also Chrome Apps which also enforce CSP, allow this to work.

This is not a CSP problem. Workers don't have access to the root's global environment. Which means, they can't access document or window objects.

Workers can do XMLRequests to the same domain, but the only way to communicate with the parent environment which is CSP enforced is via messages.

Read the code again, all the worker is doing is onmessage = function(e) { postMessage('msg from worker'); }". The dom manipulation is done in the main context where it belongs.