Uglifyjs: ufuzz failure

Created on 17 Nov 2020  路  5Comments  路  Source: mishoo/UglifyJS

// original code
// (beautified)
var _calls_ = 10, a = 100, b = 10, c = 0;

function f0(a_2, parseInt) {
    {
        var b_2 = function f1(foo, a_2, bar_1) {
            var b = (c = c + 1) + (Math_2 && typeof Math_2.Infinity == "function" && --_calls_ >= 0 && Math_2.Infinity({}, (c = c + 1) + /[abc4]/g.exec(((c = c + 1) + (undefined in {} ? 4 in [ (c = 1 + c, 
            22 / "b" / (23..toString() * 24..toString()) & (this, 2) >> (23..toString() > -0)), (c = 1 + c, 
            ([] | 23..toString()) / (38..toString() || NaN) >> (-3 - "object" <= ("a" == 3))), (c = 1 + c, 
            (-5 - -1, [] << "c") | (38..toString() > this) << (c = c + 1, Infinity)), (c = 1 + c, 
            -((24..toString() ^ true) != 2 * 24..toString())) ] : {
                "": (c = 1 + c, ((a_2 = "object" >>> false) !== ("" ^ undefined)) < (c = c + 1, 
                "b") % (25 + "b"))
            }[c = 1 + c, a_2 && (a_2.b = (-1 ^ 5, 22 <= 23..toString()) <= (([ , 0 ][1] && NaN) ^ 0 > 22))]) || b || 5).toString()), false)), Math_2 = --b;
            c = c + 1;
        }();
    }
    try {
        {
            var brake5 = 5;
            do {
                try {
                    {
                        var brake7 = 5;
                        while (typeof foo_1 !== "string" && --brake7 > 0) {
                            try {
                                {
                                    var a_2 = function f2({
                                        foo: a_2
                                    }, b_2) {
                                        try {
                                            c = 1 + c, (NaN >= "b") + (4 << "object") + (([ , 0 ].length === 2) < -2, "undefined" * {});
                                        } catch (bar_1) {
                                        }
                                        var b = (c = 1 + c, (b_2 /= -3 != -5 | Infinity ^ 25) ^ (b_2 && ({
                                            [{
                                                b: (c = 1 + c, -1 <= 23..toString() ^ (b_2 = "function" >> "b") ^ ("number" !== 2) + ("foo" !== -3)),
                                                "\t": (c = 1 + c, (delete "object" | (c = c + 1, true)) === (c = c + 1, "foo" || 23..toString())),
                                                b: function(undefined_1, a_2_1, b_2_2) {
                                                },
                                                length: (c = 1 + c, a_2 += "b" < -5 >= ([ , 0 ].length === 2 | 24..toString()) || b_2 && (b_2.null = "c" < "object" ^ -2 - 3)),
                                                foo: (c = 1 + c, (-3 & {}) % ("bar" && this) * (-5 <= -5 >= "a" % -0))
                                            }]: b_2[--b + [ (c = 1 + c, ((a_2 && (a_2[c = 1 + c, (-4 !== /[a2][^e]+$/, "bar" | -1) & !(5 > "foo")] = 38..toString() >= "undefined")) == "number" >>> "") >= (false == -1 == (b_2 && (b_2.null += [ , 0 ][1] + undefined)))), (c = 1 + c, 
                                            (c = c + 1, -0 === -3) ^ (0 + [ , 0 ][1] || "number" - 38..toString())) ]]
                                        } = {
                                            Infinity: 4 - 3 && 3 ^ -1
                                        })));
                                    }({}, -4, null);
                                }
                            } catch (b_2_1) {
                                {
                                    {
                                    }
                                    for (var brake15 = 5; (c = 1 + c, true < Infinity !== 1 / -3, "foo" << 22 !== (5 ^ "number")) && brake15 > 0; --brake15) {
                                        c = 1 + c, "number" * "function" >> (-3 <= "c") & (/[a2][^e]+$/ << 23..toString()) - ([] >> /[a2][^e]+$/);
                                    }
                                }
                                {
                                    var expr17 = --b + /[abc4]/g.exec((a++ + /[abc4]/.test(((c = 1 + c, ("undefined" / "b" === ("foo" === -0)) - (4 != "undefined" & (true || 4))) || b || 5).toString()) || b || 5).toString());
                                    for (var key17 in expr17) {
                                        c = 1 + c;
                                        var b_2_1 = expr17[key17];
                                        c = c + 1;
                                    }
                                }
                            }
                        }
                    }
                } catch (arguments) {
                    if (b_2 && typeof b_2.a == "function" && --_calls_ >= 0 && b_2.a("object")) {
                        L10629: {
                            {
                                var b_2_1 = function f3(b, b_1) {
                                }();
                            }
                        }
                    } else {}
                }
            } while (b_2 && typeof b_2.length == "function" && --_calls_ >= 0 && b_2.length() && --brake5 > 0);
        }
    } finally {
        c = c + 1;
        {
            var brake26 = 5;
            L10630: do {
            } while ((c = c + 1) + void (("b" << -5 ^ this * [ , 0 ][1]) - ({} / false >>> "object" + 4)) && --brake26 > 0);
        }
    }
}

var foo_1 = f0(-2, --b + a);

console.log(null, a, b, c, Infinity, NaN, undefined);
// uglified code
// (beautified)
var c = 10, r = 100, e = 10, l = 0, y = function() {
    var n = function() {
        var n = (l += 1) + (t && "function" == typeof t.Infinity && 0 <= --c && t.Infinity({}, (l += 1) + /[abc4]/g.exec("" + ((l += 1) + (void 0 in {} ? 4 in [ 0, 0, 0 | (this < "38") << 1 / 0, (l = 1 + ((l = 1 + (1 + (1 + l))) + 1), 
        -1) ] : {
            "": !1
        }[l = 1 + ((l = 1 + l) + 1), 0]) || n || 5)), !1)), t = --n;
        l += 1;
    }();
    try {
        var t = 5;
        do {
            try {
                for (var o = 5; "string" != typeof y && 0 < --o; ) {
                    try {
                        !function({
                            foo: n
                        }, t) {
                            try {
                                l = 1 + l;
                            } catch (n) {}
                            var o = (l = 1 + l, {
                                [{
                                    b: (l = 1 + l, !0 ^ (t = 0) ^ 2),
                                    "\t": (l = 1 + l, (!0 | (l += 1, !0)) === (l += 1, "foo")),
                                    b: function(n, t, o) {},
                                    length: (l = 1 + l, n += (2 === [ , 0 ].length | "24") <= !1 || t && (t.null = -6)),
                                    foo: (l = 1 + l, 0 % this * !1)
                                }]: t[--o + [ (l = 1 + l, (0 == (n && (n[l = 1 + l, 1] = !1))) >= (0 == (t && (t.null += NaN)))), (l = 1 + l, 
                                NaN ^ (l += 1, !1)) ]]
                            } = {
                                Infinity: -4
                            }, 0);
                        }({});
                    } catch (n) {
                        for (var i, f = 5; l = 1 + l, 0 < f; --f) {
                            l = 1 + l;
                        }
                        for (i in --e + /[abc4]/g.exec("" + (r++ + /[abc4]/.test((l = 1 + l, "-1")) || e || 5))) {
                            l = 1 + l, l += 1;
                        }
                    }
                }
            } catch (arguments) {
                n && "function" == typeof n.a && 0 <= --c && n.a("object");
            }
        } while (n && "function" == typeof n.length && 0 <= --c && n.length() && 0 < --t);
    } finally {
        l += 1;
        for (var a = 5; (l += 1) + void 0 && 0 < --a; ) {}
    }
}(--e);

console.log(null, r, e, l, 1 / 0, NaN, void 0);



md5-2a291e900722182426c452ccc5e74cc4



original result:
null 100 9 48 Infinity NaN undefined

uglified result:
null 104 5 96 Infinity NaN undefined



md5-a82a505b7a618c9cf632193b9245920a



minify(options):
{
"compress": {
"passes": 1000000,
"unsafe": true
},
"toplevel": true,
"output": {
"v8": true
}
}

Suspicious compress options:
evaluate
passes
reduce_vars
unused
```

bug

All 5 comments

@kzc this one isn't pre-ES6... 馃槗

$ cat test.js
(function(a) {
    ({
        [a = "FAIL"]: 0[console.log(a)],
    } = 0);
})("PASS");
$ node
v6.17.1
$ cat test.js | node
PASS



md5-fbad1848c76e4d3f3c08d38cd4e4ccb9



```sh
$ node
v10.22.1
$ cat test.js | node
PASS



md5-09eb42edee593d3ea853fab5e60e5550



```sh
$ node
v14.13.1
$ cat test.js | node
FAIL

Good one. ufuzz is paying for itself.

I also see you've added a v8 output option for redundant parens to avoid destructuring bugs. +1.

In addition, --reduce-test certainly helps in maintaining my full head of hair.

I think aliens wrote test/reduce. No one knows why it works as effectively as it does.

FWIW, Firefox agrees with Node.js 6~10

Was this page helpful?
0 / 5 - 0 ratings

Related issues

kzc picture kzc  路  3Comments

pvdz picture pvdz  路  3Comments

GrosSacASac picture GrosSacASac  路  3Comments

hacdias picture hacdias  路  5Comments

chrismanley picture chrismanley  路  5Comments