Normative: Provide source text to HostEnsureCanCompileStrings - #3222

cc @mikesamuel

Updated to reflect the consensus in TC39 plenary of 2023-11-27:

• eval() and friends pass their argument to HostEnsureCanCompileStrings
• new Function() and friends pass their unstringified argument to HostEnsureCanCompileStrings, only if there is a single argument. If there is more than one argument, the previous behaviour is maintained.
• In the case of direct eval, we inform HostEnsureCanCompileStrings of this.

thanks for the update @ptomato, this is looking good!

I've updated this to reflect the option that had the most support in today's plenary meeting: passing the body string to the host hook after stringifying it.

(I've also removed the references to #1498 from the commit message and reset the author; this PR no longer subsumes the goal of #1498, and in fact has ship-of-Theseus'ed so that it now contains nothing from the original)

cc @erights for further discussion

Note that Firefox, Safari and Chrome already implement Option 2. Test case:

<html>
<head>
  <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
</head>
<script>
new Function({
  toString: () => {
    console.log("Should not happen");
    return "return 2"
  },
});
</script>
</html>

All the three browsers log before throwing.

The observable change introduced my option 2 would thus just be matching web reality :)

For posterity, "option 2" refers to this slide.

@tc39/ecma262-editors I realized this one wasn't in the list of things that would be added before ES2024 is cut. But I believe all of the discussions have been resolved, is there anything else preventing it from making the cut?