overlookmotel / livepack

Serialize live running code to Javascript
MIT License
30 stars 0 forks source link

Function name can block access to scope vars where frozen by `eval()` in another function #539

Open overlookmotel opened 7 months ago

overlookmotel commented 7 months ago

Input:

let f = function() { return f; };
export default [
  f,
  function(module, exports) { eval('f'); }
];
f = 123;

Output (with mangle option enabled):

const a = (0, eval)(`
  "use strict";
  f=>[
    function f() { return f; },
    function() { eval("f"); }
  ]
`)(123);
export default [a[0], a[1]];

In input, both functions return 123. In output, first function returns itself, because it's been named explicitly in the output, which introduces another binding for f.

Livepack avoids this problem where the eval() is inside the function which is named, but not where the eval() which freezes the external var name is in another function.

Correct output would be:

const a = (0, eval)(`
  "use strict";
  f=>[
    function() { return f; },
    function() { eval("f"); }
  ]
`)(123);
export default [
  Object.defineProperty(a[0], 'name', {value: 'f'}),
  a[1]
];