215608f453
DebugEvaluate contains code since 2009 that bypasses JSGlobalProxy and returns JSGlobalObject when result of expression is global proxy. This behavior may be dangerous: - JSGlobalObject does not perform security checks, - some parts of V8 code do not ready for JSGlobalObject, e.g., SetHashAndUpdateProperties function will crash on DCHECK if we will try to store JSGlobalObject to map. At the same time it looks like there is no any valid use case for it. R=yangguo@chromium.org Bug: none Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel Change-Id: Ib0e35d5ae9ef47318c866e44c5c6856e34ed05a5 Reviewed-on: https://chromium-review.googlesource.com/1198764 Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Cr-Commit-Position: refs/heads/master@{#55550}
108 lines
1.5 KiB
Plaintext
108 lines
1.5 KiB
Plaintext
Checks this in arrow function scope
|
|
(function() {
|
|
let f = () => { #debugger; };
|
|
f();
|
|
|
|
This on callFrame:
|
|
{
|
|
type : undefined
|
|
}
|
|
This in evaluateOnCallFrame:
|
|
{
|
|
type : undefined
|
|
}
|
|
Values equal: true
|
|
|
|
let f = () => { debugger; };
|
|
#f();
|
|
}).call('a');
|
|
|
|
This on callFrame:
|
|
{
|
|
className : String
|
|
description : String
|
|
objectId : <objectId>
|
|
type : object
|
|
}
|
|
This in evaluateOnCallFrame:
|
|
{
|
|
className : String
|
|
description : String
|
|
objectId : <objectId>
|
|
type : object
|
|
}
|
|
Values equal: true
|
|
|
|
f();
|
|
}).#call('a');
|
|
return a;
|
|
|
|
This on callFrame:
|
|
{
|
|
className : Number
|
|
description : Number
|
|
objectId : <objectId>
|
|
type : object
|
|
}
|
|
This in evaluateOnCallFrame:
|
|
{
|
|
className : Number
|
|
description : Number
|
|
objectId : <objectId>
|
|
type : object
|
|
}
|
|
Values equal: true
|
|
|
|
function boo() {
|
|
foo.call(1)#();
|
|
}
|
|
|
|
This on callFrame:
|
|
{
|
|
className : Object
|
|
description : Object
|
|
objectId : <objectId>
|
|
type : object
|
|
}
|
|
This in evaluateOnCallFrame:
|
|
{
|
|
className : Object
|
|
description : Object
|
|
objectId : <objectId>
|
|
type : object
|
|
}
|
|
Values equal: true
|
|
|
|
}
|
|
(() => boo.#call({}))();
|
|
|
|
This on callFrame:
|
|
{
|
|
type : undefined
|
|
}
|
|
This in evaluateOnCallFrame:
|
|
{
|
|
type : undefined
|
|
}
|
|
Values equal: true
|
|
|
|
}
|
|
(() => boo.call({}))#();
|
|
|
|
This on callFrame:
|
|
{
|
|
className : global
|
|
description : global
|
|
objectId : <objectId>
|
|
type : object
|
|
}
|
|
This in evaluateOnCallFrame:
|
|
{
|
|
className : global
|
|
description : global
|
|
objectId : <objectId>
|
|
type : object
|
|
}
|
|
Values equal: true
|
|
|