Uglifyjs: Bug: shadowed var decl in switch default causing trouble

[pvdz]

• Bug report or feature request?
  Bug. Found by fuzzer. Finally.

• uglify-js version (uglifyjs -V)
  uglify-js 2.8.15 (git master)

var a = 100, b = 10;
function f() {
  switch (1) {
    case 1:
      b = a++;
      return ++b
    default:
      var b;
  }
}
f();
console.log(a, b);

$ node s.js && bin/uglifyjs s.js -c | node
101 10
101 101

The fuzzer strikes again! Took me quite some effort. You did too good a job.

[alexlamsl]

@qfox thanks for the report 😉

Haven't dabble into the land of AST_Switch yet, so I won't be surprised there are a few bugs in there.

In this case, it got rid of the default block without extracting the declaration var b; out:

$ uglify-js test.js -c -b bracketize
function f() {
    return b = a++, ++b;
}

var a = 100, b = 10;

f(), console.log(a, b);

So f() ends up polluting the global scope.

[pvdz]

This is probably a dupe, perhaps more to the point. At least shows that the problem is not related to default in particular.

var a = 100, b = 10;
function f() {
  var a = (b = a);
  switch (undefined) {
    case 0:
      var b = "foo";
  }
}
f();
console.log(a, b);

I'll disable the switch from the fuzzer for now... :)

[kzc]

I'll disable the switch from the fuzzer for now... :)

Keep pushing those fuzzer changes our way.

[kzc]

-c hoist_vars=true is a workaround for the "var declared in a switch" bug.

A proper fix without this option would involve hoisting vars from unused case or switch blocks about to be dropped.

[kzc]

It appears that hoist_vars=true only helps the second example in https://github.com/mishoo/UglifyJS2/issues/1663#issuecomment-289158511

[alexlamsl]

Good morning - let me investigate a fix for this 😉

[alexlamsl]

FWIW, this rule is guarded under dead_code, so disabling that would fix this issue as well.

I think the proper fix is to utilise extract_declarations_from_unreachable_code() like we do in OPT(AST_If)

[kzc]

This bug is as old as Uglify in all likelihood.