Uglifyjs: [ufuzz] `run_code()` gives different result from normal execution

Created on 9 Jun 2017  路  21Comments  路  Source: mishoo/UglifyJS

// original code
// (beautified)
var a = 100, b = 10, c = 0;

{
    L15972: {
        try {
        } catch (foo) {
            try {
                [ --b + ((c = 1 + c, c = c + 1, (null && 23..toString()) >> (22 >>> false)) || 5).toString()[(c = 1 + c, 
                22 == 23..toString() & 5 / 2 | 3 / "foo" <= (NaN ^ "function"))], a++ + (typeof NaN !== "string") ][a++ + b++];
            } finally {
                ({
                    NaN: (c = 1 + c, ([] !== {}) - (2 & 0) >> (2 + 2 != ("object" ^ -5)))
                })[(c = c + 1) + void (/[a2][^e]+$/ << /[a2][^e]+$/ & -4 << "object" | (a && (a[{
                    undefined: (c = 1 + c, (a && (a.a = 38..toString() >>> "bar" === (a |= "foo" * NaN))) + (-3 !== 2 && [] <= 1)),
                    "": (c = 1 + c, (a && (a[0 === 1 ? a : b] *= (a >>= 25 !== true) >= (a = /[a2][^e]+$/ - 0))) * ((undefined == -0) < (23..toString() || NaN))),
                    length: (c = 1 + c, void (a && (a[(c = 1 + c, (a && (a.a += {} / [ , 0 ][1] ^ "number" != true)) == (("object" ^ 24..toString()) !== !"object"))] = -1 >= "number")) << ((-1 ^ -5) > /[a2][^e]+$/ / /[a2][^e]+$/))
                }[(c = 1 + c, "function" === "undefined" === (a && (a.b = 3 >>> 38..toString())) != (undefined >>> undefined) / (25 >>> 3))]] += (1, 
                24..toString()) / (2 & []))))];
            }
            switch ((c = c + 1) + ((38..toString() < 3, 4 << -1) ^ 38..toString() >= "object" != /[a2][^e]+$/ > "number")) {
              case a++:
                {
                    var expr10 = typeof a_1;
                    L15973: for (var key10 in expr10) {
                        a--;
                    }
                }

              default:
                var Math = (22 & [ , 0 ].length === 2) == 4 / 1 & (38..toString() === "object") + true % "number", a = a++ + a--;

              case {}:
                ;
                c = c + 1;
                break;

              case {
                    undefined: +a,
                    in: b = a,
                    1.5: {}.null,
                    b: {
                        1.5: (c = 1 + c, ((24..toString(), 4) ^ undefined % "object") != ([ , 0 ].length === 2 ^ 4) >> (-3 && "foo")),
                        var: (c = 1 + c, a = (a && (a[(c = 1 + c, (c = c + 1, "number" >= {}) !== (void 25 != "function" % 22))] = 38..toString() <= "")) * (false != Infinity), 
                        (-2 ^ 25) % (25 === "foo")),
                        1.5: (c = 1 + c, a && (a[(c = c + 1) + void ((NaN != {}) - ("bar" < undefined) >= (c = c + 1, 
                        Infinity >> 0))] = (null >>> null) % (3 ^ 1) ^ void (25 ^ 4)))
                    }.Infinity,
                    c: (c = c + 1) + typeof {
                        foo: (c = 1 + c, (a |= -1 === -3 === "number" > -3) - (-4 ^ 3 ^ -2 >= -5)),
                        a: (c = 1 + c, void 25 << (([ , 0 ].length === 2) <= 2) < [ , 0 ][1] >>> 5 >> (a && (a[(c = 1 + c, 
                        (5 % 4 >>> "" / -2) * (("foo" && 24..toString()) * (-2 == 1)))] -= -5 != 25))),
                        undefined: (c = 1 + c, (a && (a.Infinity %= 3 != -1 | -4 ^ 22)) ^ (5 <= []) % (38..toString() > [ , 0 ][1]))
                    }
                }:
                [ , 0 ].length === 2;
                break;
            }
        } finally {
            switch ((c = c + 1) + [ (c = c + 1) + (--b + ((c = 1 + c, (a && (a.Infinity = 2 === "foo")) << +1 != (a && (a[--b + [ (c = 1 + c, 
            (-3 >= [] | 38..toString() ^ "function") >= ((3 | false) < ("bar" ^ [ , 0 ].length === 2))) ].NaN] = "bar" << "function" ^ {} * ([ , 0 ].length === 2)))) || a || 3).toString() || 2).toString()[(c = 1 + c, 
            (undefined % 22 ^ /[a2][^e]+$/ * false) >>> (undefined / 25 | -1 != 24..toString()))], a++ + !function() {
                c = 1 + c, 22 > 24..toString() !== [] > 3 ^ ({} << -2) % (a && (a.NaN = "function" && []));
            }(), (++b || 9).toString()[{
                "\t": (c = 1 + c, ~(25 == 38..toString(), 25 - undefined))
            }], ,  ]) {
              case a++ + (a && a[--b + b--]):
                var b = {
                    NaN: (c = 1 + c, (a && (a[(c = 1 + c, ((c = c + 1, "bar") & -0 === null) >>> (Infinity == NaN ^ "bar" - 38..toString()))] = -0 + false)) >>> -1 / 22 & (-2 < "" ^ "number" == /[a2][^e]+$/)),
                    "\t": (c = 1 + c, (0 && "number") != ([ , 0 ].length === 2 == undefined) | 22 >> true >> 1 % 3),
                    length: (c = 1 + c, (4 ^ {}) << ("object" >>> "bar"), (5 ^ /[a2][^e]+$/) * (a && (a.undefined = -5 === -3)))
                };
                break;

              case (c = c + 1) + ~((("bar" <= "foo") >> -0 - "") % (Infinity / 1 & 25 >= "number")) ? a-- : a++ + [ --b + (a && a.b), (c = c + 1) + ~b ]["object"]:
                0 === 1 ? a : b;
                break;

              case 1 === 1 ? a : b:
                break;

              case --b + (0 === 1 ? a : b):
                switch (0 === 1 ? a : b) {
                  case a++:
                    c = 1 + c, a && (a.var *= (-0 >> true !== (3 ^ 2)) >= ((a && (a.Infinity = -1 >>> "undefined")) > ("function" | [ , 0 ].length === 2)));
                    break;

                  default:
                    L15974: {
                    }

                  case --b + +function arguments_1() {
                        c = 1 + c, (c = c + 1, [] >= true) >= (arguments_1 |= 2 - undefined + undefined % 3);
                        c = 1 + c, arguments_1 = (25 > -5) % (22 == true) === (5 ^ "undefined") / ("function" & 23..toString());
                        c = 1 + c, (-3 <= "" && "number" / 2) | (arguments_1 && (arguments_1.Infinity += undefined >>> "object" & (false ^ "foo")));
                        c = 1 + c, (-3 | -1) !== "undefined" >>> [] !== ("" && Infinity) >= (-1 >= NaN);
                    }():
                    {
                        var brake27 = 5;
                        do {
                            c = 1 + c, (([ , 0 ].length === 2 || 22) === (38..toString() && false)) > (([] ^ -2) & (/[a2][^e]+$/ ^ -0));
                        } while ((c = 1 + c, ((a && (a[(c = 1 + c, a = (a &= "" <= "object" != (a && (a[(c = 1 + c, 
                        (/[a2][^e]+$/ > ([ , 0 ].length === 2)) >> (25 === -2) > (38..toString() | 24..toString()) << (undefined < 38..toString()))] = 2 + 5))) === [] << "" <= (undefined != -0))] = 2 + 3)) <= (a /= "" <= "object")) + (c = c + 1, 
                        23..toString() >= null)) && --brake27 > 0);
                    }
                    {
                        var brake29 = 5;
                        do {
                            c = 1 + c, ({} == 25, 38..toString() / "function") && (-4 ^ -5) !== -5 * null;
                        } while ((c = 1 + c, (/[a2][^e]+$/ === -4 != 3 * "object") + (3 / 3 >> (-1 ^ ""))) && --brake29 > 0);
                    }
                    break;

                  case [ (c = 1 + c, a && (a[--b + {
                        b: (c = 1 + c, !(3 + -4 || a && (a.var = "number" > 24..toString()))),
                        undefined: (c = 1 + c, (25 * -2 & (a && (a.a += 2 << false))) === (-1 && 3) / (-3 < -1)),
                        NaN: (c = 1 + c, (2 | -2 || +[]) <= (-5 >= -1 | Infinity << -5))
                    }[(-2 ^ -4) >>> (2 >>> -4) >> (5 >>> -0 == (-1 & 0))]] = (null & 4 ^ -5 + undefined) & (a && (a.in >>>= -3 % 24..toString() !== 38..toString() * 5)))), (c = 1 + c, 
                    a && (a.var >>>= 2 >>> ([ , 0 ].length === 2) >>> (4 >> undefined) !== ("function" % true, 
                    -2 + -3))), (c = 1 + c, (-0 | "" | (a && (a.null &= 24..toString() !== "function"))) == (2 > [ , 0 ][1] ^ {} & "number")) ].a:
                    {
                    }
                    break;
                }
                break;
            }
            c = c + 1;
        }
        for (var brake33 = 5; (a++ + (1 === 1 ? a : b) ? [ {
            undefined: a++ + {
                3: (c = 1 + c, a ^= (23..toString() >>> /[a2][^e]+$/ == ("bar" != Infinity)) / ((undefined && /[a2][^e]+$/) === delete NaN)),
                3: (c = 1 + c, (23..toString() * NaN != (a && (a[(c = 1 + c, ((-1 !== 0) >= "function" << {}) >>> (-5 > 0) % ("foo" === 5))] = [ , 0 ][1] === -2))) % ((a = "object" != ([ , 0 ].length === 2)) >= (-5 ^ ""))),
                0: (c = 1 + c, (a = (undefined >> undefined) / ([ , 0 ][1] ^ Infinity)) / ~(2 | [ , 0 ].length === 2)),
                NaN: (c = 1 + c, a = (a += (2 != []) * (24..toString() + -4)) / ({} - /[a2][^e]+$/ ^ (c = c + 1, 
                -3)))
            }[(c = 1 + c, (c = c + 1, 2) >> (NaN << []) >>> (25 + NaN) % (([ , 0 ].length === 2) / 23..toString()))],
            length: --b + b--,
            foo: (c = c + 1) + (typeof b != "unknown")
        }.a, --b + (a++ + +((4, "foo") % (true && 4) + (a = 38..toString() >> "foo") % ("" > "bar")) || 8).toString()[a++ + (typeof a_1 == "unknown")] ].length : a++ + ((c = c + 1) + typeof foo)) && brake33 > 0; --brake33) {
            switch (5) {
              case void ("number" * 25 >> (0 <= -0) < ([ , 0 ].length === 2 ^ Infinity) >>> -0 - {}):
                {
                    {
                        var brake36 = 5;
                        while (--b + (typeof b_2 === "boolean") && --brake36 > 0) {
                            for (var brake37 = 5; (c = 1 + c, -((a = [] >= 0) | (a /= -3 >> 25))) && brake37 > 0; --brake37) {
                                c = 1 + c, (1 !== false | 22 >> -4) > (false > 24..toString() < ("number" | 38..toString()));
                            }
                        }
                    }
                }
                [ +((a = null > -0 | ({} && true)) < (a /= ([ , 0 ][1] ^ -3) >>> (c = c + 1, "foo"))), 0 === 1 ? a : b, (c = c + 1) + function() {
                }() ][[ (c = 1 + c, a = ({} ^ "undefined") / (23..toString() && 4) ^ (-0 ^ 38..toString() || -1 >= 23..toString())), (c = 1 + c, 
                a += ({} < 1) - (2 || 0) !== ((Infinity | 38..toString()) != 23..toString() / 4)), (c = 1 + c, 
                (Infinity <= 22 > -3 % [ , 0 ][1]) + ("number" | true && "function" & /[a2][^e]+$/)), (c = 1 + c, 
                c = c + 1, (NaN || true) <= (23..toString() | true)), (c = 1 + c, (23..toString() !== -0) % ("object" >= "foo") <= (true - null >= (22 >= NaN))) ]];
                break;

              default:
              case [ --b + 1, (c = c + 1) + a++, (c = c + 1) + (a-- || 5).toString()[b = a], ("undefined" === -0) % (25 & "") < (a && (a[!((undefined === 38..toString() | (a = 24..toString() == -5)) != (-0 <= ([ , 0 ].length === 2)) + (null >>> undefined))] = (1 !== 22) >= (a && (a[(c = 1 + c, 
                (-0 >= {} !== (25 || true)) > 22 * -2 % (25 ^ -5))] %= 0 - 2)))) ]:
                c = c + 1;
                break;

              case a++ + function() {
                    {
                        var brake41 = 5;
                        L15975: do {
                            {
                                var brake42 = 5;
                                while ((c = 1 + c, ((1 ^ -4) <= ("bar", "")) >> (a = (23..toString() ^ "") & (3 || "bar"))) && --brake42 > 0) {
                                    c = 1 + c, ((a && (a.var = "number" << "number")) === ("function" === 23..toString())) <= ((1 == 25) >= (-3 | 1));
                                }
                            }
                        } while ((c = c + 1) + (a && a.null) && --brake41 > 0);
                    }
                    {
                        var brake44 = 5;
                        do {
                        } while (--b + (b + 1 - .1 - .1 - .1) && --brake44 > 0);
                    }
                }:
                break;
            }
        }
        (c = c + 1) + (typeof undefined_1 === "undefined");
    }
}

switch (typeof a_1) {
  default:
  case (c = c + 1) + !b:
    {
        var a = function f0(Infinity_2, bar_1, Infinity_2_1) {
            {
                var brake49 = 5;
                L15976: while ((c = c + 1) + +a && --brake49 > 0) {
                    var brake50 = 5;
                    while ({
                        1.5: a++,
                        length: --b + ((-0 && true) + (-5 ^ 25) !== (38..toString() > {} !== (Infinity_2 && (Infinity_2[(c = 1 + c, 
                        void (-2 << 25 && undefined % "foo"))] += ("bar", [ , 0 ][1]))))),
                        foo: --b + ((c = 1 + c, -0 * -4 << (-5 >> "object") >> -4 - ("number" >> 1)) ? (c = 1 + c, 
                        -2 * 2 | 23..toString() !== null && (Infinity_2 && (Infinity_2[(c = 1 + c, (-3 & [ , 0 ][1] & !23..toString()) != +(false == NaN))] |= -3 > {})) - ("function" !== "")) : (c = 1 + c, 
                        ({} >>> "foo") - delete 22 == (c = c + 1, -4) >>> /[a2][^e]+$/ % ([ , 0 ].length === 2))) ? a++ + function() {
                        } : b++,
                        foo: -((4 - 0 ^ NaN !== -0) == (false ^ {}) >= (0 && -5)),
                        "\t": {
                            3: (c = 1 + c, ([ , 0 ].length === 2 == "number" ^ 5 * "undefined") * ((bar_1 && (bar_1[(c = 1 + c, 
                            (([ , 0 ][1], 4) | (Infinity_2_1 = false == 38..toString())) ^ (NaN >>> [] | Infinity ^ Infinity))] += "undefined" < 2)) == (24..toString() === 22))),
                            undefined: (c = 1 + c, (NaN * 2 !== -0 >> [ , 0 ][1]) >= (Infinity_2_1 && (Infinity_2_1.in >>>= 0 % "bar" < (-3 ^ "number")))),
                            Infinity: (c = 1 + c, +(Infinity_2 && (Infinity_2.null <<= (3, 24..toString()) == -4 >>> 25))),
                            1.5: (c = 1 + c, -4 <= [ , 0 ][1] == (-4 & /[a2][^e]+$/) != ((c = c + 1, 2) | [ , 0 ][1] - 2)),
                            null: (c = 1 + c, ("" && 0) > "foo" * Infinity, c = c + 1, -5 - 0)
                        }
                    } && --brake50 > 0) {
                        for (var brake51 = 5; a++ + (typeof NaN != "undefined") && brake51 > 0; --brake51) {
                            switch (c = 1 + c, (c = c + 1, -5 != "") && (2 >> 22 && "object" + -3)) {
                              case c = 1 + c, (c = c + 1, "number" % 0) >> ((Infinity || 1) >>> (23..toString() ^ 5)):
                                ;
                                break;

                              case c = 1 + c, (c = c + 1, -1 + null) <= ({} + 3 & (25 && "bar")):
                                ;
                                break;

                              case c = 1 + c, (bar_1 && (bar_1[(c = 1 + c, ({} > "function") - ("bar" << ([ , 0 ].length === 2)) != (Infinity_2_1 && (Infinity_2_1.in = (-0 | "") >>> ([ , 0 ].length === 2) - "number")))] += true + 4)) - (3 !== 4) < (-0 < undefined) * (bar_1 += /[a2][^e]+$/ == 25):
                                ;
                                break;

                              default:
                                ;
                            }
                            try {
                                c = 1 + c, void -5 === (bar_1 && (bar_1[(c = 1 + c, (2 > "object") % (Infinity === NaN) | (-1 & []) === (bar_1 = "foo" > 25))] = -4 % "function")) != ("", 
                                23..toString()) * ([] >= {});
                            } catch (foo_1) {
                            }
                        }
                    }
                }
            }
            {
                var expr58 = a++ + function() {};
                for (var key58 in expr58) {
                    L15977: {
                        switch ((c = c + 1) + (b = a)) {
                          case b += a:
                            try {
                                c = 1 + c, (2 > undefined === false << -4) < ((Infinity == -1) >= (-4 != -2));
                            } catch (bar) {
                            } finally {
                            }
                            var bar_1_2 = (c = 1 + c, (bar_1 = 24..toString() <= Infinity) / (2 >= null) == (undefined + 4 ^ 24..toString() === 1));
                            break;

                          case {
                                length: (c = 1 + c, (c = c + 1, -3 & 5) === (bar_1_2 && (bar_1_2.b = -0 - 22 || 4 >> -0))),
                                set a(a) {
                                    this.null = "bar" || 0;
                                }
                            }[(38..toString() < 4) % (3 ^ true) && (true & NaN) + (bar_1 && (bar_1.undefined = "undefined" || "bar"))]:
                            if (c = 1 + c, Infinity_2 = (1 && 22) !== ([ , 0 ].length === 2) >= [] === ("function" >> -0 != false + -3)) {
                                c = 1 + c, (c = c + 1, true <= NaN) >= "function" % 22 + (c = c + 1, -5);
                            } else {
                                c = 1 + c, ([ , 0 ][1] < "number") * (4 === -2) && (c = c + 1, 22 & null);
                            }
                            break;

                          case (c = c + 1) + [ (c = 1 + c, -((c = c + 1, [ , 0 ][1]) > (c = c + 1, ""))), (c = 1 + c, 
                            Infinity_2 && (Infinity_2.b /= (Infinity == 1 != 22 < "bar") << (NaN * Infinity >> (24..toString() !== -5)))), (c = 1 + c, 
                            (c = c + 1, "") != false - 25 || (5 > -3) - (38..toString(), "number")), (c = 1 + c, 
                            ("object" | 5) - 24..toString() * "function" <= ((0 || undefined) > ("" ^ ""))), (c = 1 + c, 
                            3 * -3 < (c = c + 1, -2) || ("bar" !== "undefined") > (bar_1_2 = null & [ , 0 ][1])) ].length:
                            break;

                          default:
                            ;
                        }
                        if (++a) {
                            L15978: for (var brake69 = 5; (undefined && {}) === 5 < -2 != (bar_1 && (bar_1.b = "number" >> [] >> (1 >= "bar"))) && brake69 > 0; --brake69) {
                                switch (c = 1 + c, ((1 == "function") >= (24..toString() && "bar")) % ((c = c + 1, 
                                -5) && 1 >= true)) {
                                  case c = 1 + c, (bar_1_2 = (22 <= 38..toString()) - ("number" - 38..toString())) >= (Infinity_2 && (Infinity_2[a++ + [ , (c = 1 + c, 
                                    !(23..toString() >> "number") | (23..toString() >> "bar") - ("foo" - null)), (c = 1 + c, 
                                    "number" < 0 !== "function" > 22, bar_1 && (bar_1[a++ + [ (c = 1 + c, ("" != ([ , 0 ].length === 2)) * ([] && 2) >= (5 * /[a2][^e]+$/ ^ -2 % 3)) ][(c = 1 + c, 
                                    (Infinity_2_1 = ("undefined" && null, 25 >= true)) < (Infinity_2_1 && (Infinity_2_1[--b + (4 <= 1 < (bar_1_2 = 2 % -3) > (-5 ^ 24..toString()) >>> (true << 2))] = (c = c + 1, 
                                    -5) | -2 < [])))]] %= -4 >> "foo" === (false != "number"))) ]] = {} << 38..toString() > -3 << 0)):
                                    ;
                                    break;

                                  case c = 1 + c, (Infinity_2_1 = (5 & 23..toString()) % ("object" == 1)) / (4 > "foo" | (bar_1_2 && (bar_1_2.null = Infinity >> /[a2][^e]+$/))):
                                    ;
                                    break;

                                  case c = 1 + c, (Infinity && [ , 0 ].length === 2 || true ^ 24..toString()) / ((/[a2][^e]+$/ !== "function") % (-1 !== 38..toString())):
                                    ;
                                    break;

                                  case c = 1 + c, bar_1 && (bar_1.c = 24..toString() * -2 >> (c = c + 1, "object") <= ("bar" && null) % (undefined | -4)):
                                    ;
                                    break;
                                }
                            }
                        }
                    }
                }
            }
        }(--b + new function bar() {
            this[--b + delete b] = (((c = c + 1, -5 | NaN) & false < ([ , 0 ].length === 2) === ([ , 0 ].length === 2 == -4)) != (38..toString() << "foo" < {} / 0) << (22 - 4 != (true == ""))) <= (-("bar" + /[a2][^e]+$/) / ((a && (a[(c = 1 + c, 
            (([] & NaN) + NaN * -2) % (("number" < undefined) + (22 || 1)))] += 38..toString() / 5)) != (undefined === -0)) <= (a = ({} && -2) == 22 * 22) / ("function" >> 24..toString(), 
            38..toString() || {})) === ((true * [ , 0 ][1] >= ("object" !== "undefined")) >> ((a && (a[(c = 1 + c, 
            "undefined" / 22 % (-1 <= -3) ^ (23..toString(), 2) >= ({} <= -0))] /= [ , 0 ][1] / 2)) | "undefined" !== undefined) >> ((0 === -0) / (0 << "") < ((c = c + 1, 
            false) | "object" < "number"))) + ((null * 2 - ([ , 0 ].length === 2 || 3)) * ("function" <= -1 < (-1 || {})) != !({} != 5) << ((0 || 22) ^ 25 > 3)) === ((c = c + 1, 
            (([ , 0 ].length === 2, -2) != false % -1) <= (2 >>> 0 != (22 ^ 25))) > (a += ![] - (-2 || -5)) + ((5 >>> -0) - (25 ^ -0)) >> ((38..toString() & 38..toString() | "" + 24..toString()) >> (({} ^ -1) >= 2 >>> 5)) ^ ((4 & []) >>> (-4 <= -2) != (25 << NaN ^ (25 && 5)) ^ (a && (a.undefined |= (null === 1 | -3 != -1) !== -2 < null <= (-4 < "bar"))) ^ ((-4 <= 23..toString()) * (24..toString(), 
            5) ^ (a && (a.Infinity = ([ , 0 ][1] <= ([ , 0 ].length === 2)) >> 2 / 0))) >>> ((delete 25 ^ true < ([ , 0 ].length === 2)) >>> (-1 < -4 <= (true || 0)))));
        }());
    }
    try {
        var a = void (([] / 1 ^ true * NaN) > (23..toString() == false & 3 + [ , 0 ][1]));
    } finally {
        c = c + 1;
        L15979: {
            {
                var brake75 = 5;
                L15980: while (--b + -b && --brake75 > 0) {
                    for (var brake76 = 5; typeof foo != "special" && brake76 > 0; --brake76) {
                        if (a++ + -b) {
                            var brake78 = 5;
                            do {
                                {
                                    var brake79 = 5;
                                    while ((c = 1 + c, ((c = c + 1, -2) <= -2 >> /[a2][^e]+$/) * (NaN - 22 >> 2 / true)) && --brake79 > 0) {
                                        c = 1 + c, (c = c + 1, []) % (2 & "function") / ((a && (a.a = undefined + "function")) / (false % "bar"));
                                    }
                                }
                            } while (new function() {
                                this[(c = 1 + c, ((false, "number") ^ 2 + 24..toString()) / (("bar" ^ 24..toString()) < [] / 4))] &= "bar" !== Infinity;
                            }() && --brake78 > 0);
                        }
                    }
                }
            }
            {
                var brake81 = 5;
                while (--b + ((delete 1 != ("undefined" || -2)) + (a && (a.NaN = (2, 22) != (Infinity && 1)))) && --brake81 > 0) {
                    c = c + 1;
                }
            }
            if (1 === 1 ? a : b) {
                if (--b + (b = a)) {
                    switch (!function() {
                        c = 1 + c, ((c = c + 1, /[a2][^e]+$/) ^ (a && (a[(c = 1 + c, a && (a.var |= (38..toString() | "number") ^ (a && (a.null = -2 | -3))) || (a && (a[(c = 1 + c, 
                        (-1 >> -4 ^ ("undefined" ^ Infinity)) !== (Infinity === [ , 0 ][1] | ([ , 0 ].length === 2) > 24..toString()))] = [] && 1) || 22 + ([ , 0 ].length === 2)))] = [] !== 2))) + ((undefined <= 1) << (a && (a[(c = 1 + c, 
                        void 38..toString() + (38..toString() || 5) === ("foo" !== {} ^ [ , 0 ][1] >> -5))] = undefined - /[a2][^e]+$/)));
                        c = 1 + c, (a && (a.in = -3 < -1)) < (3 ^ "undefined") ^ -2 / -2 - (true > true);
                    }()) {
                      case --b + (a++ + (typeof a == "object")):
                        break;

                      case a++ + (0 === 1 ? a : b):
                        c = 1 + c, (a += -5 ^ -2) && -4 & NaN && 23..toString() % -3 << (a = 38..toString() >>> -0);
                        var bar_1 = (c = 1 + c, bar_1 && (bar_1.foo = (c = c + 1, 5) % (4 % "function") - ((22 & "") >> (-2 === 4))));
                        break;

                      case (c = c + 1) + [ (c = 1 + c, 22 > 3 <= 24..toString() + "foo" != (bar_1 && (bar_1.in += ([] !== 25) + (-4 <= -1)))), (c = 1 + c, 
                        +(~25, -3 | -3)), (c = 1 + c, !+22 | (1 > "number" && 38..toString() >= 0)), (c = 1 + c, 
                        (2 < -3 | ([ , 0 ].length === 2) + "object") & (null - /[a2][^e]+$/ | -5 - 24..toString())), (c = 1 + c, 
                        (3 * 1 << "bar" * "") / (/[a2][^e]+$/ % -0 < -4 >>> 3)) ].a:
                        {
                        }
                        break;

                      default:
                        ;
                        if (c = 1 + c, (5 >> 5) - (5 != []) ^ (38..toString(), 38..toString()) < (true != 2)) {
                            c = 1 + c, (5 / "undefined" || -1 >>> -3) <= ((-2 === true) >= (null < -3));
                        }
                    }
                } else if (--b + [ --b + /[abc4]/.test(((c = 1 + c, (~"bar" | ([ , 0 ].length === 2) > "foo") & (null, 
                24..toString()) > (-2 !== "function")) || b || 5).toString()), a++ + ((38..toString() >= 5) >> (23..toString() >> 1) ^ (undefined & NaN ^ -4 != /[a2][^e]+$/)), a++ + (bar_1 && bar_1[(c = 1 + c, 
                ((4 == 25) << (null >>> 5)) % (25 / 5 >> (-4 != "bar")))]), , a++ + /[abc4]/.test(((c = 1 + c, 
                (true || 25) * (NaN - -1), !(Infinity !== ([ , 0 ].length === 2))) || b || 5).toString()) ].undefined) {
                    b = a;
                }
            }
        }
    }
    break;

  case 1 === 1 ? a : b:
    switch ((c = c + 1) + (typeof foo_2 === "unknown")) {
      case a++ + (b = a):
        break;

      default:
        try {
            {
                {
                    var expr100 = a++ + ~((false != true) / (false === Infinity) > ("undefined" | "bar") >>> 0 - 22);
                    for (var key100 in expr100) {
                        c = 1 + c;
                        var bar_1_2 = expr100[key100];
                        {
                            var bar_2 = function f1(a, foo_2, foo_1) {
                                c = 1 + c, -1 >>> 2 >> ("bar" >>> undefined) || 0 * 38..toString() != 23..toString() * 38..toString();
                                c = 1 + c, (-1 | 5, c = c + 1, "undefined") ^ "object" === -2 & (foo_2 && (foo_2.foo = "" > ([ , 0 ].length === 2)));
                            }(delete ((true != undefined, "foo" ^ 23..toString()) * (-5 >>> true <= (0 && true))));
                        }
                    }
                }
            }
        } finally {
            switch ([ typeof bar_2 !== "object", /[abc4]/.test((--b + ((c = 1 + c, (bar_1_2 && (bar_1_2.var += {} >= null)) !== (bar_2 && (bar_2.NaN += 1 && "number")) && (c = c + 1, 
            false >>> "foo")) || 4).toString()[(c = 1 + c, ("function" >>> "foo" && (bar_1_2 && (bar_1_2.null += ([], 
            -0)))) ^ ({} < -0 || 22 << -2))] || b || 5).toString()) ][a--]) {
              case (c = c + 1) + {
                    a: a++ + delete a,
                    in: void b
                }:
                {
                    var brake105 = 5;
                    while (0 && --brake105 > 0) {}
                }
                break;

              case /[abc4]/.test(([ --b + {
                    0: (c = 1 + c, (true === 3) >= (c = c + 1, "") ^ {} !== 3 & "bar" !== "bar"),
                    1.5: (c = 1 + c, bar_2 && (bar_2.a = (22 - 4 != -4 * false) / ((1 & -4) > 38..toString() / /[a2][^e]+$/)))
                }.in, a++ + (0 === 1 ? a : b), --b + a++ ] || b || 5).toString()):
                break;

              case (c = c + 1) + /[abc4]/.test(([] || b || 5).toString()):
                switch (a++ + b++) {
                  default:
                    switch (c = 1 + c, (c = c + 1, c = c + 1, 3) / (1 >= 25 !== "undefined" % "")) {
                      case c = 1 + c, ((true ^ 25) != (c = c + 1, "bar")) - (([ , 0 ][1] == Infinity) + ("undefined" && Infinity)):
                        ;
                        break;

                      case c = 1 + c, bar_1 && (bar_1.c = (NaN || [ , 0 ][1]) < undefined / 38..toString() >= ((true ^ Infinity) > (0 & -4))):
                        ;
                        break;

                      case c = 1 + c, (bar_2 && (bar_2[--b + (0 === 1 ? a : b)] = (NaN ^ 1) > 1 / 5)) >>> ([ , 0 ].length === 2 && 0) / (25 - -2):
                        ;
                        break;

                      case c = 1 + c, !(undefined === "number") & ((null ^ -2) & null << null):
                        ;
                        break;
                    }

                  case +function b() {
                        c = 1 + c, (24..toString() !== ([ , 0 ].length === 2)) << Infinity + {} < (3 ^ true) + (bar_2 && (bar_2.undefined = 38..toString() / 3));
                        c = 1 + c, bar_1 = ((bar_2 && (bar_2.var = 3 ^ "bar")) + (bar_2 && (bar_2.a += [] << -1))) * ((24..toString() ^ [ , 0 ][1]) - (2 !== ([ , 0 ].length === 2)));
                        c = 1 + c, (([ , 0 ].length === 2 ^ "foo") & -4 <= 4) - ((24..toString() ^ [ , 0 ].length === 2) === 23..toString() << "number");
                        c = 1 + c, (false ^ -5) >> (25 >> ([ , 0 ].length === 2)) >>> (4 ^ "") - (5 && 22);
                    }():
                    c = c + 1;
                    break;

                  case bar_2 && bar_2.null:
                    break;

                  case bar_2 && bar_2[--b + (1 === 1 ? a : b)]:
                    if (c = 1 + c, (4 + 5 & [ , 0 ][1] >= NaN) / ((2 & 5) << (-2 >= ([ , 0 ].length === 2)))) {
                        c = 1 + c, bar_2 && (bar_2.undefined *= 5 + 4 >= (Infinity, "function") || -5 - 3 << ("function" != 22));
                    } else {
                        c = 1 + c, bar_1_2 = void ("function" >> []) << (bar_1 && (bar_1.a += 3 ^ -4), [ , 0 ][1] << "bar");
                    }
                    break;
                }
                a++ + void function() {
                    c = 1 + c, delete ((3 || 5) != "bar" * 24..toString());
                    c = 1 + c, bar_1_2 = (-2 >= Infinity && (bar_1_2 /= "number" === 24..toString())) === (bar_2 && (bar_2.c += 1 < null), 
                    -3 > ([ , 0 ].length === 2));
                    c = 1 + c, (-2 >> 24..toString() == (bar_1 = "function" & 22)) > ((38..toString() ^ -0) < (5 < 3));
                }();
                break;

              case b &= a:
                {
                    var brake121 = 5;
                    while ((c = c + 1) + b++ && --brake121 > 0) {
                        -((bar_1 = ("object" || "object") >>> (NaN >> 25)) !== (-4 * -1 || "undefined" >>> -4));
                    }
                }
                if (--b + [ (c = 1 + c, (null < 1 | (bar_1 = "undefined" === ([ , 0 ].length === 2))) != (1 !== 23..toString()) + (23..toString() <= false)) ]) {
                    var brake124 = 5;
                    while (-1 && --brake124 > 0) {
                    }
                }
                break;
            }
            {
                var brake126 = 5;
                do {
                    c = c + 1;
                } while (--b + void (c = c + 1, bar_2 <<= (c = c + 1, "object") > 24..toString() + 5) && --brake126 > 0);
            }
        }
        {
            var expr128 = delete a;
            L15981: for (var key128 in expr128) {
                c = 1 + c;
                var b_1 = expr128[key128];
                {
                    {
                        var undefined = function f2() {
                            {
                                var brake131 = 5;
                                while ((c = 1 + c, (("undefined" | "undefined") === 22 * 1) >>> (0 + [ , 0 ][1] < (c = c + 1, 
                                38..toString()))) && --brake131 > 0) {
                                    c = 1 + c, (25 != [ , 0 ][1]) >= (null ^ 0) || (bar_1_2 && (bar_1_2.a >>= true / [])) ^ "foo" > 23..toString();
                                }
                            }
                            try {
                                c = 1 + c, bar_1_2 && (bar_1_2[a++ + {
                                    NaN: (c = 1 + c, (23..toString() & {}) < ("function" < "") && (bar_2 &= (/[a2][^e]+$/ & "number") == ("function" !== {}))),
                                    1.5: (c = 1 + c, (+24..toString() <= 5 * 3) * (24..toString() / 23..toString() / ~"foo")),
                                    null: (c = 1 + c, delete (b_1 && (b_1.in = false | 1)) == ((-5 ^ [ , 0 ].length === 2) !== 38..toString() << -0)),
                                    null: (c = 1 + c, undefined <= Infinity == (Infinity ^ 22) !== ({} > "object" & 5 + "function"))
                                }.Infinity] = ("foo" == -4 && "" + 23..toString()) > (-3 > "undefined" && NaN == "function"));
                            } finally {
                            }
                        }(--b + typeof (--b + (b + 1 - .1 - .1 - .1)));
                    }
                    c = c + 1;
                    bar_2 && bar_2[a++ + (--b + b--)];
                    {
                        var brake137 = 5;
                        while ((c = c + 1) + (--b + (bar_1 && bar_1[(c = c + 1) + (1 === 1 ? a : b)]) || a || 3).toString() && --brake137 > 0) {
                            (c = c + 1) + a++;
                        }
                    }
                }
            }
        }

      case (c = c + 1) + ((-4 ^ 3 ^ "object" % 0) & ((c = c + 1, []) && (-2 || 23..toString()))):
        var arguments_1 = --b + !+((23..toString() && []) ^ /[a2][^e]+$/ >> {});
        break;

      case a++ + (1 === 1 ? a : b):
        break;
    }
    break;

  case /[a2][^e]+$/:
    [ (c = c + 1) + 3 ];
    /[abc4]/.test((--b + ([ {
        3: (c = c + 1, /[a2][^e]+$/) + (bar_2 += "number" || [ , 0 ][1]) - (-4 ^ 3 | (NaN | 22)),
        var: (c = c + 1) + {
            length: (c = 1 + c, false >> "number" >> ([] || {}) ^ (24..toString() < -3 || [] ^ -2)),
            Infinity: (c = 1 + c, b_1 = (c = c + 1, 38..toString()) | 1 % 25 && void "object" << null / 4),
            3: (c = 1 + c, (-0, [ , 0 ][1]) <= (-2 > Infinity), "function" >= Infinity | 24..toString() % "object"),
            Infinity: (c = 1 + c, c = c + 1, ("" & false) == "object" * 22),
            "": (c = 1 + c, bar_2 && (bar_2.NaN <<= (bar_1 = /[a2][^e]+$/ * -5 !== [ , 0 ][1] - null) && ("object" && -2) ^ 0 * "function"))
        }.Infinity,
        "-2": typeof new function c_1() {
            this[(c = 1 + c, ((/[a2][^e]+$/ == NaN) <= (/[a2][^e]+$/ ^ 4)) * ((false === 23..toString()) * (NaN >>> "bar")))] = 1 / true;
        }(),
        0: 0 === 1 ? a : b
    }[(c = c + 1) + (b += a)], --b + [].c, (c = c + 1) + ((c = c + 1) + (0 === 1 ? a : b)) ][--b + (0 % "bar" % (24..toString() / -5) > ((NaN && false) ^ (-4 || false)))] || a || 3).toString() || b || 5).toString());
    break;
}

console.log(null, a, b, c);
// uglified code
// (beautified)
var b = 10, c = 0, expr10, key10, Math, a;

switch ((c += 1) + [ (c += 1) + (--b + (c = 1 + c, ((a = 100) && (a.Infinity = !1)) << 1 != (a && (a[--b + [ (c = 1 + c, 
(-3 >= [] | "function" ^ 38..toString()) >= (3 < ("bar" ^ 2 === [ , 0 ].length))) ].NaN] = 0 ^ {} * (2 === [ , 0 ].length))) || a || 3).toString() || 2).toString()[(c = 1 + c, 
(undefined % 22 ^ NaN) >>> (undefined / 25 | -1 != 24..toString()))], a++ + (c = 1 + c, 
24..toString(), !void (a && (a.NaN = []))), (++b || 9).toString()[{
    "\t": (c = 1 + c, 38..toString(), ~(25 - undefined))
}], ,  ]) {
  case a++ + (a && a[--b + b--]):
    var b = {
        NaN: (c = 1 + c, (a && (a[(c = 1 + c, (!1 & (c += 1, "bar")) >>> (!1 ^ "bar" - 38..toString()))] = 0)) >>> -1 / 22 & 1),
        "\t": (c = 1 + c, 0 != (2 === [ , 0 ].length == undefined) | 5),
        length: (c = 1 + c, 5 * (a && (a.undefined = !1)))
    };
    break;

  case (c += 1) + -1 ? a-- : a++ + [ --b + (a && a.b), (c += 1) + ~b ].object:
  case a:
    break;

  case --b + b:
    switch (b) {
      case a++:
        c = 1 + c, a && (a.var *= !0 >= ((a && (a.Infinity = 4294967295)) > ("function" | 2 === [ , 0 ].length)));
        break;

      default:
      case --b + +function arguments_1() {
            c = 1 + c, arguments_1 |= 2 - undefined + undefined % 3, c = 1 + (c += 1), arguments_1 = NaN === 5 / ("function" & 23..toString()), 
            c = 1 + c, arguments_1 && (arguments_1.Infinity += undefined >>> "object" & 0), 
            c = 1 + c;
        }():
        var brake27 = 5;
        do {
            c = 1 + c, 38..toString();
        } while (c = 1 + c, ((a && (a[(c = 1 + c, a = (a &= 1 != (a && (a[(c = 1 + c, (/[a2][^e]+$/ > (2 === [ , 0 ].length)) >> !1 > (38..toString() | 24..toString()) << (undefined < 38..toString()))] = 7))) === [] << "" <= (-0 != undefined))] = 5)) <= (a /= !0)) + (c += 1, 
        23..toString() >= null) && --brake27 > 0);
        var brake29 = 5;
        do {
            c = 1 + c, 38..toString();
        } while (c = 1 + c, --brake29 > 0);
        break;

      case [ (c = 1 + c, a && (a[--b + {
            b: (c = 1 + c, !1),
            undefined: (c = 1 + c, 3 == (-50 & (a && (a.a += 2)))),
            NaN: (c = 1 + c, !0)
        }[2]] = (0 ^ -5 + undefined) & (a && (a.in >>>= -3 % 24..toString() != 5 * 38..toString())))), (c = 1 + c, 
        a && (a.var >>>= 2 >>> (2 === [ , 0 ].length) >>> (4 >> undefined) != -5)), (c = 1 + c, 
        (0 | (a && (a.null &= "function" !== 24..toString()))) == (2 > [ , 0 ][1] ^ "number" & {})) ].a:
    }
}

c += 1;

for (var brake33 = 5; (a++ + a ? [ {
    undefined: a++ + {
        3: (c = 1 + c, a ^= (23..toString() >>> /[a2][^e]+$/ == 1) / ((undefined && /[a2][^e]+$/) === delete NaN)),
        3: (c = 1 + c, (NaN * 23..toString() != (a && (a[(c = 1 + c, (!0 >= "function" << {}) >>> NaN)] = -2 === [ , 0 ][1]))) % ((a = "object" != (2 === [ , 0 ].length)) >= -5)),
        0: (c = 1 + c, (a = (undefined >> undefined) / ([ , 0 ][1] ^ 1 / 0)) / ~(2 | 2 === [ , 0 ].length)),
        NaN: (c = 1 + c, a = (a += (2 != []) * (24..toString() + -4)) / ({} - /[a2][^e]+$/ ^ (c += 1, 
        -3)))
    }[(c = 1 + c, c += 1, 2 >> (NaN << []) >>> NaN % ((2 === [ , 0 ].length) / 23..toString()))],
    length: --b + b--,
    foo: (c += 1) + ("unknown" != typeof b)
}.a, --b + (a++ + +(NaN + (a = 38..toString() >> "foo") % !1) || 8).toString()[a++ + ("unknown" == typeof a_1)] ].length : a++ + ((c += 1) + typeof foo)) && brake33 > 0; --brake33) {
    switch (5) {
      default:
        var brake36;
        var brake37;

      case [ 1 + --b, (c += 1) + a++, (c += 1) + (a-- || 5).toString()[b = a], NaN < (a && (a[!((undefined === 38..toString() | (a = -5 == 24..toString())) != (-0 <= (2 === [ , 0 ].length)) + (null >>> undefined))] = !0 >= (a && (a[(c = 1 + c, 
        (-0 >= {} !== 25) > -14)] %= -2)))) ]:
        c += 1;
        break;

      case a++ + function() {
            var brake41 = 5;
            do {
                for (var brake42 = 5; c = 1 + c, !0 >> (a = 3 & ("" ^ 23..toString())) && --brake42 > 0; ) {
                    c = 1 + c, a && (a.var = 0), 23..toString();
                }
            } while ((c += 1) + (a && a.null) && --brake41 > 0);
            var brake44 = 5;
            do {} while (--b + (b + 1 - .1 - .1 - .1) && --brake44 > 0);
        }:
    }
}

switch (c += 1, typeof a_1) {
  default:
  case (c += 1) + !b:
    var a = function(Infinity_2, bar_1, Infinity_2_1) {
        for (var brake49 = 5; (c += 1) + +a && --brake49 > 0; ) {
            for (var brake50 = 5; a++, --b, 38..toString(), Infinity_2 && (Infinity_2[void (c = 1 + c)] += [ , 0 ][1]), 
            --b + (c = 1 + c, c = 1 + c, ({} >>> "foo") - !0 == (c += 1, -4 >>> /[a2][^e]+$/ % (2 === [ , 0 ].length))) ? a++ : b++, 
            c = 1 + c, bar_1 && (bar_1[(c = 1 + c, (4 | (Infinity_2_1 = 0 == 38..toString())) ^ (NaN >>> [] | 0))] += !1), 
            24..toString(), c = 1 + c, Infinity_2_1 && (Infinity_2_1.in >>>= !1), c = 1 + c, 
            Infinity_2 && (Infinity_2.null <<= 127 == 24..toString()), c = 1 + c, c += 1, c = 1 + c, 
            c += 1, --brake50 > 0; ) {
                for (var brake51 = 5; a++ + !0 && brake51 > 0; --brake51) {
                    switch (c = 1 + c, c += 1, 0) {
                      case c = 1 + c, c += 1, NaN >> (1 / 0 >>> (5 ^ 23..toString())):
                      case c = 1 + c, c += 1, -1 <= ({} + 3 & "bar"):
                      case c = 1 + c, (bar_1 && (bar_1[(c = 1 + c, ({} > "function") - ("bar" << (2 === [ , 0 ].length)) != (Infinity_2_1 && (Infinity_2_1.in = 0 >>> (2 === [ , 0 ].length) - "number")))] += 5)) - !0 < (-0 < undefined) * (bar_1 += !1):
                    }
                    try {
                        c = 1 + c, bar_1 && (bar_1[(c = 1 + c, NaN | (-1 & []) === (bar_1 = !1))] = NaN), 
                        23..toString();
                    } catch (foo_1) {}
                }
            }
        }
        var expr58 = a++ + function() {};
        for (var key58 in expr58) {
            switch ((c += 1) + (b = a)) {
              case b += a:
                try {
                    c = 1 + c;
                } catch (bar) {}
                var bar_1_2 = (c = 1 + c, (bar_1 = 24..toString() <= 1 / 0) / !0 == (undefined + 4 ^ 1 === 24..toString()));
                break;

              case {
                    length: (c = 1 + c, c += 1, 5 === (bar_1_2 && (bar_1_2.b = -22))),
                    set a(a) {
                        this.null = "bar";
                    }
                }[(38..toString() < 4) % 2 && 0 + (bar_1 && (bar_1.undefined = "undefined"))]:
                c = 1 + c, (Infinity_2 = 22 !== (2 === [ , 0 ].length) >= [] == !0) ? (c = 1 + c, 
                c += 1, c += 1) : (c = 1 + c, !1 * ([ , 0 ][1] < "number") && (c += 1));
                break;

              case (c += 1) + [ (c = 1 + c, c += 1, -([ , 0 ][1] > (c += 1, ""))), (c = 1 + c, Infinity_2 && (Infinity_2.b /= !1 << (NaN >> (-5 !== 24..toString())))), (c = 1 + c, 
                -25 != (c += 1, "") || !0 - (38..toString(), "number")), (c = 1 + c, 5 - "function" * 24..toString() <= (undefined > 0)), (c = 1 + c, 
                -9 < (c += 1, -2) || !0 > (bar_1_2 = null & [ , 0 ][1])) ].length:
            }
            if (++a) {
                for (var brake69 = 5; !1 === (undefined && {}) != (bar_1 && (bar_1.b = "number" >> [] >> !1)) && brake69 > 0; --brake69) {
                    switch (c = 1 + c, (!1 >= (24..toString() && "bar")) % (c += 1, !0)) {
                      case c = 1 + c, (bar_1_2 = (22 <= 38..toString()) - ("number" - 38..toString())) >= (Infinity_2 && (Infinity_2[a++ + [ , (c = 1 + c, 
                        !(23..toString() >> "number") | (23..toString() >> "bar") - NaN), (c = 1 + c, bar_1 && (bar_1[a++ + [ (c = 1 + c, 
                        ("" != (2 === [ , 0 ].length)) * ([] && 2) >= -2) ][(c = 1 + c, (Infinity_2_1 = !0) < (Infinity_2_1 && (Infinity_2_1[--b + (!1 < (bar_1_2 = 2) > (-5 ^ 24..toString()) >>> 4)] = (c += 1, 
                        -5 | -2 < []))))]] %= !1)) ]] = {} << 38..toString() > -3)):
                      case c = 1 + c, (Infinity_2_1 = (5 & 23..toString()) % !1) / (!1 | (bar_1_2 && (bar_1_2.null = 0))):
                      case c = 1 + c, (2 === [ , 0 ].length || !0 ^ 24..toString()) / (!0 % (-1 !== 38..toString())):
                      case c = 1 + c, bar_1 && (bar_1.c = -2 * 24..toString() >> (c += 1, "object") <= null % (-4 | undefined)):
                    }
                }
            }
        }
    }(--b + new function() {
        this[--b + delete b] = (c += 1, ((-5 & !1 < (2 === [ , 0 ].length) == (2 === [ , 0 ].length == -4)) != (38..toString() << "foo" < {} / 0) << !0) <= (NaN / ((a && (a[(c = 1 + c, 
        ((NaN & []) + NaN) % (("number" < undefined) + 22))] += 38..toString() / 5)) != (-0 === undefined)) <= (a = 484 == ({} && -2)) / (24..toString(), 
        38..toString() || {})) === ((!0 * [ , 0 ][1] >= !0) >> ((a && (a[(c = 1 + c, NaN ^ (23..toString(), 
        2 >= ({} <= -0)))] /= [ , 0 ][1] / 2)) | "undefined" !== undefined) >> (1 / 0 < (!1 | (c += 1, 
        !1)))) + (!1 * (0 - (2 === [ , 0 ].length || 3)) != !(5 != {}) << 23) === (c += 1, 
        !0 > (a += ![] - -2) + -20 >> ((38..toString() & 38..toString() | "" + 24..toString()) >> ((-1 ^ {}) >= 0)) ^ (4 & []) >>> !0 != 28 ^ (a && (a.undefined |= !0)) ^ ((-4 <= 23..toString()) * (24..toString(), 
        5) ^ (a && (a.Infinity = ([ , 0 ][1] <= (2 === [ , 0 ].length)) >> 1 / 0))) >>> ((!0 ^ !0 < (2 === [ , 0 ].length)) >>> !0)));
    }());
    try {
        var a = void 23..toString();
    } finally {
        c += 1;
        for (var brake75 = 5; --b - b && --brake75 > 0; ) {
            for (var brake76 = 5; "special" != typeof foo && brake76 > 0; --brake76) {
                if (a++ - b) {
                    var brake78 = 5;
                    do {
                        for (var brake79 = 5; c = 1 + c, 0 * (c += 1, !0) && --brake79 > 0; ) {
                            c = 1 + c, c += 1, a && (a.a = undefined + "function");
                        }
                    } while (new function() {
                        this[(c = 1 + c, ("number" ^ 2 + 24..toString()) / (("bar" ^ 24..toString()) < [] / 4))] &= !0;
                    }() && --brake78 > 0);
                }
            }
        }
        for (var brake81 = 5; --b + (!0 + (a && (a.NaN = !0))) && --brake81 > 0; ) {
            c += 1;
        }
        if (a) {
            if (--b + (b = a)) {
                switch (c = 1 + c, c += 1, a && (a[(c = 1 + c, a && (a.var |= ("number" | 38..toString()) ^ (a && (a.null = -1))) || a && (a[(c = 1 + c, 
                -1 != (1 / 0 === [ , 0 ][1] | (2 === [ , 0 ].length) > 24..toString()))] = [] && 1) || 22 + (2 === [ , 0 ].length))] = 2 !== []), 
                a && (a[(c = 1 + c, void 38..toString() + (38..toString() || 5) === ("foo" !== {} ^ [ , 0 ][1] >> -5))] = undefined - /[a2][^e]+$/), 
                c = 1 + c, !void (a && (a.in = !0))) {
                  case --b + (a++ + ("object" == typeof a)):
                    break;

                  case a++ + b:
                    c = 1 + c, (a += 5) && 0 && (23..toString(), a = 38..toString() >>> -0);
                    var bar_1 = (c = 1 + c, bar_1 && (bar_1.foo = (c += 1, NaN)));
                    break;

                  case (c += 1) + [ (c = 1 + c, !0 <= 24..toString() + "foo" != (bar_1 && (bar_1.in += (25 !== []) + !0))), (c = 1 + c, 
                    -3), (c = 1 + c, 0), (c = 1 + c, (!1 | (2 === [ , 0 ].length) + "object") & (NaN | -5 - 24..toString())), (c = 1 + c, 
                    1 / 0) ].a:
                    break;

                  default:
                    c = 1 + c, 0 - (5 != []) ^ (38..toString(), 38..toString() < !0) && (c = 1 + c);
                }
            } else {
                --b + [ --b + /[abc4]/.test((c = 1 + c, (-1 | (2 === [ , 0 ].length) > "foo") & 24..toString() > !0 || b || 5).toString()), a++ + ((38..toString() >= 5) >> (23..toString() >> 1) ^ NaN & undefined ^ !0), a++ + (bar_1 && bar_1[(c = 1 + c, 
                0)]), , a++ + /[abc4]/.test((c = 1 + c, !(1 / 0 !== (2 === [ , 0 ].length)) || b || 5).toString()) ].undefined && (b = a);
            }
        }
    }
    break;

  case a:
    switch ((c += 1) + ("unknown" == typeof foo_2)) {
      case a++ + (b = a):
        break;

      default:
        try {
            var expr100 = a++ - 2;
            for (var key100 in expr100) {
                c = 1 + c;
                var bar_1_2 = expr100[key100], bar_2 = function(a, foo_2, foo_1) {
                    c = 1 + c, -1 >>> 2 >> ("bar" >>> undefined) || (38..toString(), 23..toString(), 
                    38..toString()), c = 1 + c, c += 1, foo_2 && (foo_2.foo = "" > (2 === [ , 0 ].length));
                }(23..toString());
            }
        } finally {
            switch ([ "object" != typeof bar_2, /[abc4]/.test((--b + (c = 1 + c, (bar_1_2 && (bar_1_2.var += {} >= null)) !== (bar_2 && (bar_2.NaN += "number")) && (c += 1, 
            0) || 4).toString()[(c = 1 + c, 0 ^ ({} < -0 || 22 << -2))] || b || 5).toString()) ][a--]) {
              case (c += 1) + {
                    a: a++ + delete a,
                    in: void 0
                }:
                var brake105 = 5;
                break;

              case /[abc4]/.test(([ --b + {
                    0: (c = 1 + c, !1 >= (c += 1, "") ^ 3 !== {} & !1),
                    1.5: (c = 1 + c, bar_2 && (bar_2.a = !0 / (0 > 38..toString() / /[a2][^e]+$/)))
                }.in, a++ + b, --b + a++ ] || b || 5).toString()):
                break;

              case (c += 1) + /[abc4]/.test(([] || b || 5).toString()):
                switch (a++ + b++) {
                  default:
                    switch (c = 1 + c, c += 1, c += 1, 3) {
                      case c = 1 + c, (24 != (c += 1, "bar")) - (([ , 0 ][1] == 1 / 0) + 1 / 0):
                      case c = 1 + c, bar_1 && (bar_1.c = [ , 0 ][1] < undefined / 38..toString() >= !0):
                      case c = 1 + c, (bar_2 && (bar_2[--b + b] = !0)) >>> (2 === [ , 0 ].length && 0) / 27:
                      case c = 1 + c, 0 & !("number" === undefined):
                    }

                  case c = 1 + c, 24..toString(), bar_2 && (bar_2.undefined = 38..toString() / 3), c = 1 + c, 
                    bar_1 = ((bar_2 && (bar_2.var = 3)) + (bar_2 && (bar_2.a += [] << -1))) * ((24..toString() ^ [ , 0 ][1]) - (2 !== (2 === [ , 0 ].length))), 
                    c = 1 + c, 24..toString(), 23..toString(), +void (c = 1 + c):
                    c += 1;
                    break;

                  case bar_2 && bar_2.null:
                    break;

                  case bar_2 && bar_2[--b + a]:
                    c = 1 + c, (9 & [ , 0 ][1] >= NaN) / (0 << (-2 >= (2 === [ , 0 ].length))) ? (c = 1 + c, 
                    bar_2 && (bar_2.undefined *= -16)) : (c = 1 + c, bar_1_2 = void 0 << (bar_1 && (bar_1.a += -1), 
                    [ , 0 ][1] << "bar"));
                }
                a++, c = 1 + c, 24..toString(), c = 1 + c, bar_1_2 = 0 == (bar_2 && (bar_2.c += !1), 
                -3 > (2 === [ , 0 ].length)), c = 1 + c, 24..toString(), bar_1 = 0, 38..toString();
                break;

              case b &= a:
                for (var brake121 = 5; (c += 1) + b++ && --brake121 > 0; ) {
                    bar_1 = 0;
                }
                if (--b + [ (c = 1 + c, (!0 | (bar_1 = "undefined" === (2 === [ , 0 ].length))) != (1 !== 23..toString()) + (23..toString() <= !1)) ]) {
                    for (var brake124 = 5; --brake124 > 0; ) {}
                }
            }
            var brake126 = 5;
            do {
                c += 1;
            } while (--b + (c += 1, void (bar_2 <<= (c += 1, "object" > 24..toString() + 5))) && --brake126 > 0);
        }
        var expr128 = delete a;
        for (var key128 in expr128) {
            c = 1 + c;
            var b_1 = expr128[key128], undefined = function() {
                for (var brake131 = 5; c = 1 + c, !1 >>> (0 + [ , 0 ][1] < (c += 1, 38..toString())) && --brake131 > 0; ) {
                    c = 1 + c, (25 != [ , 0 ][1]) >= 0 || (bar_1_2 && (bar_1_2.a >>= !0 / []), 23..toString());
                }
                try {
                    c = 1 + c, bar_1_2 && (bar_1_2[a++ + {
                        NaN: (c = 1 + c, (23..toString() & {}) < !1 && (bar_2 &= 0 == ("function" !== {}))),
                        1.5: (c = 1 + c, (+24..toString() <= 15) * (24..toString() / 23..toString() / -1)),
                        null: (c = 1 + c, b_1 && (b_1.in = 1), !0 == ((-5 ^ 2 === [ , 0 ].length) != 38..toString() << -0)),
                        null: (c = 1 + c, undefined <= 1 / 0 == 22 !== ({} > "object" & "5function"))
                    }.Infinity] = !1);
                } finally {}
            }((--b, --b));
            c += 1, bar_2 && bar_2[a++ + (--b + b--)];
            for (var brake137 = 5; (c += 1) + (--b + (bar_1 && bar_1[(c += 1) + a]) || a || 3).toString() && --brake137 > 0; ) {
                c += 1, a++;
            }
        }

      case (c += 1) + (-1 & (c += 1, [] && -2)):
        var arguments_1 = --b + !+((23..toString() && []) ^ /[a2][^e]+$/ >> {});
        break;

      case a++ + a:
    }
    break;

  case /[a2][^e]+$/:
    c += 1, /[abc4]/.test((--b + ([ {
        3: (c += 1, /[a2][^e]+$/ + (bar_2 += "number") - -1),
        var: (c += 1) + {
            length: (c = 1 + c, 0 >> ([] || {}) ^ (24..toString() < -3 || -2 ^ [])),
            Infinity: (c = 1 + c, b_1 = 1 | (c += 1, 38..toString()) && 0),
            3: (c = 1 + c, !1 | 24..toString() % "object"),
            Infinity: (c = 1 + c, c += 1, !1),
            "": (c = 1 + c, bar_2 && (bar_2.NaN <<= (bar_1 = NaN !== [ , 0 ][1] - null) && -2))
        }.Infinity,
        "-2": typeof new function() {
            this[(c = 1 + c, !0 * (0 * (!1 === 23..toString())))] = 1;
        }(),
        0: b
    }[(c += 1) + (b += a)], --b + [].c, (c += 1) + ((c += 1) + b) ][--b + (NaN % (24..toString() / -5) > -4)] || a || 3).toString() || b || 5).toString());
}

console.log(null, a, b, c);



md5-328aea54b3e27019a3cc1fa7cc0a1791



original result:
null undefined 466 1611

uglified result:
null undefined 454 1558

minify(options):
{
  "mangle": false
}

Suspicious compress options:
  booleans
  side_effects
bug

All 21 comments

This one is in its own class of weirdness (test.js is the original code from above):

$ cat test.js | node
null undefined 466 1611

$ uglifyjs test.js -c | node
null undefined 454 1558

$ uglifyjs test.js -cb | node
null undefined 466 1611

Weird indeed. Could be uglify is not emitting parens without beautify for some precedence issue.

This is a case where Suspicious compress options failed us, because it was testing against original (non-beautified) input, whereas we printed the beautified original after we checked the outputs are identical.

Something to fix in test/ufuzz.js as well.

Narrowed this one down to space to far:

--- a/lib/output.js
+++ b/lib/output.js
@@ -323,9 +323,7 @@ function OutputStream(options) {
         last = str;
     };

-    var space = options.beautify ? function() {
-        print(" ");
-    } : function() {
+    var space = function() {
         might_need_space = true;
     };

I think this is just another false positive, albeit a somewhat annoying one:

$ cat test.js
var a = 1;
var expr58 = a++ + function() {};
console.log(expr58);

$ cat test.js | node
1function () {}

$ uglifyjs test.js -c | node
1function (){}

$ uglifyjs test.js -cb | node
1function () {}

So this time I use the diff in https://github.com/mishoo/UglifyJS2/issues/2079#issuecomment-307463548 to produce good.js and bad.js, then use https://github.com/mishoo/UglifyJS2/issues/2075#issuecomment-307459903 to narrow it down to one line.

What I need to figure out now is why test/sandbox.js doesn't turn that function() {} into [Function: 1]

Turns out this one is quite nasty - the coincidence in https://github.com/mishoo/UglifyJS2/issues/2079#issuecomment-307465836 almost mask the fact that there's another place where run_code() seems to behave differently:

--- a/good.js
+++ b/bad.js
@@ -93,20 +93,12 @@ switch (c += 1, typeof a_1) {
   case (c += 1) + !b:
     var a = function(Infinity_2, bar_1, Infinity_2_1) {
         for (var brake49 = 5; (c += 1) + +a && --brake49 > 0; ) {
-            for (var brake50 = 5; {
-                1.5: a++,
-                length: --b + (-30 !== (38..toString() > {} !== (Infinity_2 && (Infinity_2[void (c = 1 + c)] += [ , 0 ][1])))),
-                foo: --b + (c = 1 + c, c = 1 + c, ({} >>> "foo") - true == (c += 1, -4 >>> /[a2][^e]+$/ % (2 === [ , 0 ].length))) ? a++ + function() {} : b++,
-                foo: -(5 == (false ^ {}) >= 0),
-                "\t": {
-                    3: (c = 1 + c, (2 === [ , 0 ].length == "number" ^ NaN) * ((bar_1 && (bar_1[(c = 1 + c,
-                    (4 | (Infinity_2_1 = false == 38..toString())) ^ (NaN >>> [] | 0))] += false)) == (22 === 24..toString()))),
-                    undefined: (c = 1 + c, (NaN !== -0 >> [ , 0 ][1]) >= (Infinity_2_1 && (Infinity_2_1.in >>>= false))),
-                    Infinity: (c = 1 + c, +(Infinity_2 && (Infinity_2.null <<= 127 == 24..toString()))),
-                    1.5: (c = 1 + c, -4 <= [ , 0 ][1] == 0 != (c += 1, 2 | [ , 0 ][1] - 2)),
-                    null: (c = 1 + c, c += 1, -5)
-                }
-            } && --brake50 > 0; ) {
+            for (var brake50 = 5; a++, --b, 38..toString(), Infinity_2 && (Infinity_2[void (c = 1 + c)] += [ , 0 ][1]),
+            --b + (c = 1 + c, c = 1 + c, ({} >>> "foo") - !0 == (c += 1, -4 >>> /[a2][^e]+$/ % (2 === [ , 0 ].length))) ? a++ : b++,
+            c = 1 + c, bar_1 && (bar_1[(c = 1 + c, (4 | (Infinity_2_1 = 0 == 38..toString())) ^ (NaN >>> [] | 0))] += !1),
+            24..toString(), c = 1 + c, Infinity_2_1 && (Infinity_2_1.in >>>= !1), c = 1 + c,
+            Infinity_2 && (Infinity_2.null <<= 127 == 24..toString()), c = 1 + c, c += 1, c = 1 + c,
+            c += 1, --brake50 > 0; ) {
                 for (var brake51 = 5; a++ + true && brake51 > 0; --brake51) {
                     switch (c = 1 + c, c += 1, 0) {
                       case c = 1 + c, c += 1, NaN >> (1 / 0 >>> (5 ^ 23..toString())):
$ node good.js
null undefined 466 1611

$ node bad.js
null undefined 466 1611

$ node
> var run_code = require("./test/sandbox").run_code;
> run_code(fs.readFileSync("good.js", "utf8"));
'null undefined 466 1611\n'
> run_code(fs.readFileSync("bad.js", "utf8"));
'null undefined 454 1558\n'

good.js
bad.js

What I need to figure out now is why test/sandbox.js doesn't turn that function() {} into [Function: 1]

It is emitting [Function: 1] on master...

$ cat sand.js 
var run_code = require("./test/sandbox.js").run_code;
var minify = require(".").minify;
var orig  = "var a = 1; var expr58 = a++ + function () {}; console.log(expr58);";

var code = orig;
var result = run_code(code);
console.log(code, "\n", result);

var code = minify(orig).code;
var result = run_code(code);
console.log(code, "\n", result);

var code = minify(orig, {output: {beautify: true}}).code;
var result = run_code(code);
console.log(code, "\n", result);
$ node sand.js 
var a = 1; var expr58 = a++ + function () {}; console.log(expr58); 
 1[Function: 1]

var a=1,expr58=a+++function(){};console.log(expr58); 
 1[Function: 1]

var a = 1, expr58 = a++ + function() {};

console.log(expr58); 
 1[Function: 1]

It is emitting [Function: 1] on master...

Indeed you are correct. So what I discovered so far:

The fact that the before/after console output are identical in these two cases almost let this run_code() issue slip away.

Okay, so this is still a false positive:

--- a/good.js
+++ b/bad.js
@@ -96,7 +96,7 @@ switch (c += 1, typeof a_1) {
             for (var brake50 = 5; {
                 1.5: a++,
                 length: --b + (-30 !== (38..toString() > {} !== (Infinity_2 && (Infinity_2[void (c = 1 + c)] += [ , 0 ][1])))),
-                foo: --b + (c = 1 + c, c = 1 + c, ({} >>> "foo") - true == (c += 1, -4 >>> /[a2][^e]+$/ % (2 === [ , 0 ].length))) ? a++ + function() {} : b++,
+                foo: --b + (c = 1 + c, c = 1 + c, ({} >>> "foo") - true == (c += 1, -4 >>> /[a2][^e]+$/ % (2 === [ , 0 ].length))) ? a++ : b++,
                 foo: -(5 == (false ^ {}) >= 0),
                 "\t": {
                     3: (c = 1 + c, (2 === [ , 0 ].length == "number" ^ NaN) * ((bar_1 && (bar_1[(c = 1 + c,

(Note the absence of function() {} in bad.js - the return value isn't being used, so drop_side_effects() got rid of the dead weight.)

Now it actually went and affect the same line var expr58 = a++ + function() {}; because we now end up with different number of digits:

> run_code(fs.readFileSync('../good.js','utf8'))
'137[Function: 25]\nnull undefined 466 1611\n'
> run_code(fs.readFileSync('../bad.js','utf8'))
'137[Function: 6]\nnull undefined 454 1558\n'

So the solution is to pad id within Function.prototype.toString override:

--- a/test/sandbox.js
+++ b/test/sandbox.js
@@ -19,7 +19,7 @@ function safe_log(arg, level) {

 var FUNC_TOSTRING = [
     "Function.prototype.toString = Function.prototype.valueOf = function() {",
-    "    var id = 0;",
+    "    var id = 100000;",
     "    return function() {",
     '        if (this === Array) return "[Function: Array]";',
     '        if (this === Object) return "[Function: Object]";',
> run_code(fs.readFileSync('../good.js','utf8'))
'137[Function: 100025]\nnull undefined 514 1823\n'
> run_code(fs.readFileSync('../bad.js','utf8'))
'137[Function: 100006]\nnull undefined 514 1823\n'

I'm having trouble following this. Is this the well known sandbox issue where anything + function(){} is converted to anything, function(){} and the sandbox Function count gets out of whack?

Reduced test case:

$ cat test.js
for (var i = 0; i < 100; i++) Math.PI + function() {};
console.log(1 + function() {});

$ uglifyjs test.js -cb bracketize -o min.js
$ cat min.js
for (var i = 0; i < 100; i++) {
    Math.PI;
}

console.log(1 + function() {});

$ node
> var run_code=require("uglify-js/test/sandbox").run_code;
> run_code(fs.readFileSync("test.js", "utf8"));
'1[Function: 101]\n'
> run_code(fs.readFileSync("min.js", "utf8"));
'1[Function: 1]\n'

Note that in this case, it's the length of the function count which makes trouble, because it was used within a for-in loop

That was a known issue we discovered a month or two ago. I can't find the github issue.

I don't know how starting the sandbox Function number at 10000 fixes this issue though. It's something we cannot trap.

This may better illustrate this particular issue:

$ cat test.js
for (var i = 0; i < 100; i++) {
    Math.PI + function() {};
}

var j = 0, o = 1 + function() {};

for (var k in o) {
    j++;
}

console.log(j);

$ uglifyjs test.js -cb bracketize -o min.js
$ cat min.js
for (var i = 0; i < 100; i++) {
    Math.PI;
}

var j = 0, o = 1 + function() {};

for (var k in o) {
    j++;
}

console.log(j);

$ node
> var run_code=require("uglify-js/test/sandbox").run_code;
> run_code(fs.readFileSync("test.js", "utf8"));
'16\n'
> run_code(fs.readFileSync("min.js", "utf8"));
'14\n'

With #2080:

> run_code(fs.readFileSync('../test.js','utf8'))
'19\n'
> run_code(fs.readFileSync('../min.js','utf8'))
'19\n'

I don't know how starting the sandbox Function number at 10000 fixes this issue though. It's something we cannot trap.

I believe it will fix this particular case, but in general we will have other false positives that remain. Unless of course I've overlooked something important :sweat_smile:

I get it now. Thanks.

A string was made with a sandbox Function id, and that string length influences the rest of the test. Your 100000 fix will reduce a certain class of false positives involving Function identity. However if the fuzzed code happens to examine the string elements themselves, the sandbox will always differ from the original node program.

However if the fuzzed code happens to examine the string elements themselves, the sandbox will always differ from the original node program.

That's right - I do and will still get a bunch of [Function: 1] vs. [Function: 2] false positives every now and then.

@alexlamsl So a couple of false positives were found, but no true regressions found in fuzzing master since v3.0.15?

@kzc there was #2062, otherwise the rest didn't make it.

(Haven't checked the current ufuzz progress from home as I'm travelling right now, so may be a few more surprises.)

Was this page helpful?
0 / 5 - 0 ratings

Related issues

alexlamsl picture alexlamsl  路  5Comments

alexlamsl picture alexlamsl  路  4Comments

buu700 picture buu700  路  5Comments

hacdias picture hacdias  路  5Comments

kzc picture kzc  路  3Comments