Edit: I found the exact code that gets evaluated. The code is in "src/third_party/WebKit/Source/WebCore/inspector/InjectedScriptSource.js".
Before the Chrome console evaluates your code, it wraps it in a with
block to bring the command-line functions into scope. So what you type is actually evaluated inside braces. The unexpected "}" token is the one put in automatically by Chrome.
The code that Chrome passes to eval
is
with ((window && window.console && window.console._commandLineAPI) || {}) {
<your code here>
};
Because it's a simple text substitution, the following example works and the result is an object which you can expand to see the answer
property:
} 0, { answer: 42
Which (reformatted) is equivalent to:
with ((window && window.console && window.console._commandLineAPI) || {}) {
}
0, { answer: 42 };
The }
at the beginning closes the with
block. The 0,
part is necessary to force the object literal to be parsed as an expression instead of another block. Then, the { answer: 42
is the beginning of an object literal that gets closed by the inserted }
token.
For more fun, here are some other inputs that work (and their results):
> }{ // an empty block, so no value
undefined
> }!{ // !{} === false
false
> }!!{ // !!{} === true
true
> } +{ valueOf: function() { return 123; }
123
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…