Edit: I found the exact code that is being evaluated. The code is in "src / third_party / WebKit / Source / WebCore / inspector / InjectedScriptSource.js".
Before the Chrome console evaluates your code, it completes it in a with block to include command-line features in scope. So, what you type is actually evaluated inside braces. An unexpected "}" token is one that is automatically placed in Chrome.
The code that Chrome passes to eval is
with ((window && window.console && window.console._commandLineAPI) || {}) { <your code here> };
Since this is a simple text substitution, the following example works, and the result is an object that you can expand to see the answer property:
} 0, { answer: 42
Which (reformatted) is equivalent:
with ((window && window.console && window.console._commandLineAPI) || {}) { } 0, { answer: 42 };
} at the beginning closes the with block. Part 0, needed to force the object literal to be parsed as an expression instead of another block. Then { answer: 42 is the beginning of the object literal, which is closed by the inserted marker } .
For more fun, here are some other inputs that work (and their results):
> }{ // an empty block, so no value undefined > }!{ // !{} === false false > }!!{ // !!{} === true true > } +{ valueOf: function() { return 123; } 123
Matthew Crumley
source share