这篇Javascript中发生了什么？

Question

Can someone explain to me what the following Javascript is doing in terms of the constructors and how it is using / calling the function defined in the variable a?

<script>
a = 'alert("Hi");'
{}["apple"]["constructor"]["constructor"](a)();
</script>

Thanks!

Answer 1

The first {} is just a bait, it's interpreted as an empty block and ignored. So we have

["apple"]["constructor"]["constructor"](a)()

which is

[].constructor.constructor(a)()

which is

Array.constructor(a)()

which is

Function(a)()

which is

(function() { alert('Hi') })()

constructor s are resolved via prototypes, here's the structure: