mishoo / UglifyJS

JavaScript parser / mangler / compressor / beautifier toolkit
http://lisperator.net/uglifyjs/
Other
13.18k stars 1.25k forks source link

ufuzz failure #5963

Closed alexlamsl closed 1 week ago

alexlamsl commented 1 week ago
// original code
// (beautified)
var _calls_ = 10, a = 100, b = 10, c = 0;

{
    var brake1 = 5;
    while (a++ + (typeof async_2 !== "object") && --brake1 > 0) {
        var brake2 = 5;
        L12058: do {
            try {
                switch ((c = c + 1) + +(delete "c" >> ("" < 1) >>> ([] <= -2) / (a = "object" == 24..toString()))) {
                  case a++ + b++:
                    c = c + 1;
                    break;

                  default:
                    try {
                        {
                            var arguments = function f0(yield_2, NaN, b_1) {}(a++ + (NaN >>> 5 == 1 <= []) % ("foo" * 5 > (2 < "b")) ? --b + delete (((!0o644n) ** 5 | Infinity >> false) ^ (-1 & "number") in true % -3) : --b + (arguments.var = ((arguments.in = -3 ^ "b") && (c = c + 1, 
                            "c")) <= (24..toString() >= [] ^ /[a2][^e]+$/ > NaN)));
                        }
                    } catch ({
                        name: c_2,
                        message: bar
                    }) {
                        {
                            var undefined = --b + (c = 1 + c, (3 || Infinity) != -2 > 23..toString() == (24..toString() >>> -3 | (arguments = /[a2][^e]+$/ !== ""))), undefined_1 = +((-0 >= "") - (2 < NaN) || 23..toString() / "foo" << ("" !== -1));
                        }
                        switch (--_calls_ >= 0 && arguments(--b + -b, 4, /[abc4]/.test(((c = 1 + c, 
                        (c = c + 1, "c" % 4) | "a" == -1 == 22 >> 25) || b || 5).toString()))) {
                          case c_2 && c_2[a++ + arguments]:
                            var yield_2 = /[abc4]/g.exec(((c = 1 + c, (([], 3) === NaN > true) < (("a" ^ -5) >= (25 != "foo"))) || b || 5).toString()), c_1 = --b + (1 === 1 ? a : b);
                            break;

                          case b &= a:
                            switch (--b + !(("b" == this ^ -5 < -4) === (-0, 5) >= (1 !== 22))) {
                              default:
                              case --b + a++:
                                c = 1 + c, 38..toString() != -3 ^ (this ^ 22) && ({} != 5 || c_1 && (c_1.done += "function" ^ "bar"));
                                break;

                              case arguments:
                                c = 1 + c, arguments += NaN * -4 % (-1 - 38..toString()) < ((undefined & "function") == ([] || -0));
                                c = 1 + c, c = c + 1, (1, "bar") <= (22 <= null);
                                c = 1 + c, (!0o644n === 24..toString() ^ 1 > Infinity) >>> (c = c + 1, 
                                [ , 0 ][1] !== /[a2][^e]+$/);
                                break;

                              case typeof yield_2 == "function" && --_calls_ >= 0 && yield_2(true):
                                c = 1 + c, (yield_2.static = 4 <= 1) | [] & "function" || (c = c + 1, 
                                c_1 && (c_1.get = "c" >>> []));
                                break;
                            }
                            break;

                          case --b + void ((25 - "function" === "object" << null) > ((NaN & "a") < ("" | [ , 0 ].length === 2))):
                            {
                                c = 1 + c, [ , 0 ][1] < ([ , 0 ].length === 2) & this !== "bar" | ("b" >>> 24..toString()) - (yield_2 *= undefined != [ , 0 ][1]);
                            }

                          case {}:
                            L12059: for (var brake20 = 5; a++ + delete (([ , 0 ][1] == true) > (c = c + 1, 
                            NaN) == (0 % -4, 25 | {})) && brake20 > 0; --brake20) {
                            }
                            switch ((c = c + 1) + typeof (c = 1 + c, ("b" == 1, 
                            "a" | []) === (NaN + this !== 38..toString() >> null))) {
                              case --b + (c = c + 1, true && "object" && this < NaN):
                                break;

                              case a++ + {}:
                                c = 1 + c, (c = c + 1, -4 / 4) < ((4 | "bar") ^ (c_1 = [] >= false));
                                break;

                              default:
                              case (c = c + 1) + (typeof arguments == "function" && --_calls_ >= 0 && arguments({})):
                                break;
                            }
                            break;
                        }
                    }
                    c = c + 1;

                  case 0 === 1 ? a : b:
                    var async = +function await_1() {
                        {
                            var c = function f1(bar) {
                                c = 1 + c, (25 || undefined) * (undefined != [ , 0 ][1]) << ((arguments && (arguments[c = 1 + c, 
                                ((arguments = 25 >>> 3) || -2 ^ "object") / (false >>> 0 !== /[a2][^e]+$/ + "foo")] -= 23..toString() - NaN)) >>> ("undefined" >> "bar"));
                                c = 1 + c, (-5 - 38..toString(), "undefined" === 23..toString()) === ({} != 5 & undefined <= "foo");
                                c = 1 + c, ([ , 0 ].length === 2) >> -1 <= (false === [ , 0 ][1]) > +(-2 * [ , 0 ][1]);
                            }();
                        }
                        c = c + 1;
                    }(), a_1 = a++ + {
                        a_1: a_1
                    };
                    break;

                  case void b:
                    {
                        var brake31 = 5;
                        while (typeof f0 == "function" && --_calls_ >= 0 && f0(a++ + (typeof arguments == "function" && --_calls_ >= 0 && arguments(a++ + (0 === 1 ? a : b), typeof f3 == "function" && --_calls_ >= 0 && f3()))) && --brake31 > 0) {
                            var Infinity_1 = function f2() {
                                try {
                                    {
                                    }
                                } catch (b_1) {
                                    c = 1 + c, (-1 & 23..toString() & "undefined" >> null) / ((-0 == "foo") < "bar" - this);
                                    c = 1 + c, (4 / this == ([] != -3)) << (-"undefined" | (async && (async.get = "function" == Infinity)));
                                } finally {
                                    c = 1 + c, a_1 += (-null ^ -4 >> 23..toString()) & NaN * !0o644n + (24..toString() >= false);
                                }
                                switch (-1 in {
                                    value: (c = 1 + c, undefined > "function" < (this < "function") && "b" + false ^ 25 > 22)
                                }) {
                                  case --b + (typeof arguments_1 == "symbol"):
                                    break;

                                  case --b + (a_1 && typeof a_1.set == "function" && --_calls_ >= 0 && a_1.set()):
                                    c = 1 + c, +2 | 3 != -2, "function" * "bar" ^ this < 3;
                                    break;

                                  case 3 in {
                                        NaN: (c = 1 + c, (a_1 && (a_1[c = 1 + c, 
                                        (([] == 1) >= (false === "number")) * (38..toString() * undefined <= (38..toString() !== -5))] += 0 * 22)) < (0 == {}) != (24..toString() | null) / (4, 
                                        NaN))
                                    }:
                                    c = 1 + c, +(-0 & NaN | (c = c + 1, 3));
                                    break;

                                  case a++ + a++:
                                    c = 1 + c, a_1 ^= (23..toString() ^ "object") % (22 > -1) ^ (Infinity || "") != (5 && "c");
                                    c = 1 + c, (arguments && (arguments[a++ + /[abc4]/.test(((c = 1 + c, 
                                    3 + 23..toString() === (/[a2][^e]+$/ | 38..toString()), 
                                    (async && (async[c = 1 + c, (async && (async[a++ + arguments] += (c = c + 1, 
                                    -1) === "a" <= -2)) & (-1 != 1 || async && (async[c = 1 + c, 
                                    arguments && (arguments[[]] ^= (async += ("object" << null) + ("undefined" != "foo"), 
                                    "a" === 1 | -0 / true))] |= ([ , 0 ][1], [])))] = "number" <= 22)) === (/[a2][^e]+$/ && [ , 0 ][1])) || b || 5).toString())] = (a_1 && (a_1[c = 1 + c, 
                                    ((c = c + 1, 3) >> ([ , 0 ][1], -1)) + ((1 <= "foo") >>> (38..toString() < -2))] = Number(0xdeadn << 16n | 0xbeefn) % "object")) >> (a_1 = -0 & false))) | undefined / "number" & ("b", 
                                    24..toString());
                                    c = 1 + c, (a_1 += {} * 24..toString() >> (5 ^ "c")) ^ 0 >> "" < (-2 > NaN);
                                }
                                var bar_2 = 0 === 1 ? a : b;
                            }(a--, -5, ..."" + arguments);
                        }
                    }
                    {
                        var brake45 = 5;
                        while (typeof f2 == "function" && --_calls_ >= 0 && f2(-5) && --brake45 > 0) {
                            var b_1 = --b + --b;
                        }
                    }
                    {
                        var expr47 = --b + (arguments && typeof arguments.foo == "function" && --_calls_ >= 0 && (b_1 && b_1.c, 
                        arguments.foo)((a++ + ((Infinity !== "bar") <= /[a2][^e]+$/ >> "c" == (1 <= 24..toString() && 1 & -3)) || 7).toString()[Infinity]));
                        for (a_1 in expr47) {
                            c = 1 + c;
                            var bar_2 = expr47[a_1];
                            {
                                var brake48 = 5;
                                L12060: do {
                                } while ([ 22 ][[ (true && -3) / ("function" || /[a2][^e]+$/) | (3 ^ {}) - ([ , 0 ][1] !== "object") ]] && --brake48 > 0);
                            }
                        }
                    }
                    break;
                }
            } catch (bar_1) {
                --b + void function() {
                    {
                        return --b + (("object" >= 5 >= "object" >> -2) + ((-4 === null) << (async = [ , 0 ][1] == 23..toString())));
                    }
                }();
            } finally {
                ~b;
                {
                    var undefined = function arguments_1(foo_2) {
                        try {
                            {
                                var brake55 = 5;
                                do {
                                    {}
                                } while ((b = a) && --brake55 > 0);
                            }
                        } catch (async) {
                            L12061: {
                                c = 1 + c, (arguments && ({
                                    b: arguments[(c = c + 1) + +b]
                                } = {
                                    b: ("number" + [ , 0 ][1]) / ("object" > "function")
                                })) - ((0 && undefined) >>> (c = c + 1, "foo"));
                            }
                        }
                        switch (--b + "a") {
                          case foo_2 && foo_2[[ (c = 1 + c, 0 * "c" === ("" || NaN) ^ (undefined ^ 5) - ("a" <= [])), (c = 1 + c, 
                            ~([ , 0 ].length === 2) + ({} >>> -0) > (Infinity | -3) - (0 >>> "foo")) ]]:
                            break;

                          case b_1 && b_1.Infinity:
                            L12062: for (var brake60 = 5; a++ + ((c = 1 + c, (23..toString() || "foo") / (arguments && (arguments.null %= [ , 0 ][1] % -5)) + (-2 === -3 || "" < this)) ? (c = 1 + c, 
                            (-2 || 2 || -4 * -4) ^ ("number" || NaN) + (Infinity_1 && (Infinity_1.null += 25 < 0))) : (c = 1 + c, 
                            ("a" >>> "undefined") * ({} > true) ^ ("a" && {}) >> (Infinity_1 && (Infinity_1[c = 1 + c, 
                            (([ 3n ][0] > 2) >>> -3) - (this || -4) + (b_1 += -2 > this) % (a_1 && (a_1.c ^= false | -5))] += "number" & null)))) && brake60 > 0; --brake60) {
                                c = 1 + c, 0 << "undefined" >>> undefined * 25 | 4 << false & "bar" - 0;
                            }
                            {
                                var a_1 = function f3() {
                                }();
                            }
                            {
                                var expr63 = a++ + {
                                    async: (c = 1 + c, (Infinity != "") < (true && "") ^ ("bar" > "foo") / (-2 - false))
                                }[c = 1 + c, ("function" === -2, +Infinity) ^ (c = c + 1, 
                                2) & "" >>> -3];
                                for (var key63 in expr63) {
                                    c = c + 1;
                                }
                            }
                            break;

                          case a++ + {
                                next: (c = c + 1) + (async && async.next),
                                "\t": (c = c + 1) + /[abc4]/.test(((c = 1 + c, "undefined" % NaN - (this << 23..toString()) + ("number" < 3) * (NaN - [ , 0 ][1])) || b || 5).toString()),
                                var: a++,
                                [{
                                    done: (c = 1 + c, (a_1 && (a_1[c = 1 + c, ("c" ** -2 || 38..toString() >>> [ , 0 ][1]) >> (2 < 22) / (/[a2][^e]+$/ % false)] /= "" | this)) > (-4 > "b") != (async && (async[c = 1 + c, 
                                    ("undefined" <= [ , 0 ][1] && 4 / 24..toString()) % (-1 + 0 || arguments && (arguments.a += 2 + 4))] = -3 === 25), 
                                    25 != NaN))
                                }.set]: false in {
                                    in: (c = 1 + c, ("number" <= true) << ("bar" >> 25) != (Infinity !== "undefined" == Infinity < -5)),
                                    a_1: a_1
                                },
                                then: ((b_1, foo_2_2, async) => {
                                })()
                            }:
                            break;

                          case a++ + ++a:
                            {
                                var expr65 = {
                                    b: (c = 1 + c, ([ , 0 ].length === 2) * 4 === -4 / "foo" ^ (-4 < true || "" | [ , 0 ].length === 2)),
                                    NaN: (c = 1 + c, !(arguments && (arguments[c = 1 + c, 
                                    (("c", "c") || 2 / [ , 0 ][1]) !== ("c" < 23..toString()) >>> (c = c + 1, 
                                    -3)] >>>= Infinity != -5)) && ~null ^ ("b" | false))
                                }.in;
                                L12063: for (var key65 in expr65) {
                                    c = 1 + c;
                                    var let_2 = expr65[key65];
                                    switch (c = 1 + c, let_2 && (let_2.a >>= ([ , 0 ][1] ^ "number") > (25 | undefined) >= (c = c + 1, 
                                    [] << this))) {
                                      default:
                                        ;

                                      case c = 1 + c, key65 && (key65[+function() {
                                            c = 1 + c, arguments = 24..toString() + ([ 3n ][0] > 2) !== (Infinity_1 && (Infinity_1.c = 25 - "bar")) === ("undefined" != ([ , 0 ].length === 2)) >> (1 != "foo");
                                            c = 1 + c, (/[a2][^e]+$/ && -4) / (-0 !== 0) + ((this, 
                                            null) === (22 !== 38..toString()));
                                            c = 1 + c, "undefined" - 1 >>> ([] != 1) & true >> Infinity === "foo" >>> "number";
                                            c = 1 + c, (c = c + 1, "function") + (NaN !== 22) - (foo_2 && (foo_2.done += (/[a2][^e]+$/ || 1) * (0 << "undefined")));
                                            c = 1 + c, (c = c + 1, "object") > 2 + 3 < (23..toString() + "foo" ^ (let_2 && (let_2.in += Infinity >>> {})));
                                        }()] <<= (23..toString() * "foo" || 24..toString() << undefined) * (("number" == "foo") + (undefined <= "object"))):
                                        ;
                                        break;

                                      case c = 1 + c, undefined / 3 / (undefined * /[a2][^e]+$/) | (-4 <= "object") + ("" + "b"):
                                        ;
                                        break;

                                      case c = 1 + c, (1 << {}) + (0 << /[a2][^e]+$/) <= -(24..toString() / "undefined"):
                                        ;
                                        break;
                                    }
                                }
                            }
                            {
                                c = 1 + c, "a" === 23..toString() === ([ , 0 ].length === 2 !== "c") || 3 != false ^ false !== -2;
                            }
                            ;
                            break;
                        }
                        {
                            return b--;
                        }
                    }();
                }
            }
        } while (--b + [ typeof b_2 === "symbol", b_1 && b_1.foo, --b + {}.set ].var && --brake2 > 0);
    }
}

console.log(null, a, b, c, Infinity, NaN, undefined);
// uglified code
// (beautified)
for (var t, arguments, i, a, e, n, f, o, c, r, s, u, N, b = 10, h = 100, y = 10, g = 0, l = 5; h++ + ("object" != typeof async_2) && 0 < --l; ) {
    t = 5;
    do {
        try {
            switch ((g += 1) + (0 >>> !1 / (h = !1))) {
              case h++ + y++:
                g += 1;
                break;

              default:
                try {
                    arguments = void (h++ + NaN ? (--y, 0 in 1) : (--y, arguments.var = (g += 1, 
                    !(arguments.in = -3))));
                } catch ({
                    name: t
                }) {
                    switch (i = --y + (g = 1 + g, 1 == (0 | (arguments = !0))), 
                    0 <= --b && arguments(--y - y, 4, /[abc4]/.test((g = 1 + g, 
                    "" + (!0 | (g += 1, NaN)))))) {
                      case t && t[h++ + arguments]:
                        a = /[abc4]/g.exec((g = 1 + g, (y || 5).toString())), e = --y + h;
                        break;

                      case y &= h:
                        switch (--y + !(!0 === ("b" == this ^ !0))) {
                          default:
                          case --y + h++:
                            g = 1 + g;
                            break;

                          case arguments:
                            arguments += NaN < (("function" & i) == []), g = 1 + (g = 1 + g), 
                            g = 1 + (g += 1), g += 1;
                            break;

                          case "function" == typeof a && 0 <= --b && a(!0):
                            g = 1 + g, a.static = !1, g += 1, e && (e.get = 0);
                        }
                        break;

                      case --y + void 0:
                        g = 1 + g, a *= 0 != i;

                      case {}:
                        for (n = 5; h++ + (g += 1, !0) && 0 < n; --n) {}
                        switch ((g += 1) + (g = 1 + g, typeof (0 === (NaN + this !== 38)))) {
                          case --y + (g += 1, this < NaN):
                            break;

                          case h++ + {}:
                            g = 1 + g, g += 1, e = !0;
                            break;

                          default:
                          case (g += 1) + ("function" == typeof arguments && 0 <= --b && arguments({})):
                        }
                    }
                }
                g += 1;

              case y:
                f = +function await_1() {
                    var t = function f1(bar) {
                        t = 1 + t, arguments && (arguments[t = 1 + t, (arguments = 3) / !0] -= NaN), 
                        t = 1 + (t = 1 + t);
                    }();
                    t += 1;
                }(), o = h++ + {
                    a_1: o
                };
                break;

              case void 0:
                for (c = 5; "function" == typeof f0 && 0 <= --b && f0(h++ + ("function" == typeof arguments && 0 <= --b && arguments(h++ + y, "function" == typeof f3 && 0 <= --b && f3()))) && 0 < --c; ) {
                    r = function f2() {
                        switch (o += -1 & NaN * !0o644n + !0, -1 in {
                            value: (g = 1 + (g = 1 + g), "function" < i < (this < "function") && 1)
                        }) {
                          case --y + ("symbol" == typeof arguments_1):
                            break;

                          case --y + (o && "function" == typeof o.set && 0 <= --b && o.set()):
                            g = 1 + g;
                            break;

                          case 3 in {
                                NaN: (g = 1 + g, (o && (o[g = 1 + g, !0 * ("38" * i <= !0)] += 0)) < !1 != NaN)
                            }:
                            g = 1 + g, g += 1;
                            break;

                          case h++ + h++:
                            o ^= 1, g = 1 + (g = 1 + g), arguments && (arguments[h++ + /[abc4]/.test((g = 1 + g, 
                            (0 === (f && (f[g = 1 + g, !0 & (f && (f[h++ + arguments] += !1 === (g += 1, 
                            -1)))] = !1)) || y || 5).toString()))] = (o && (o[g = 1 + g, 
                            g += 1, 0] = +("" + (0xdeadn << 16n | 0xbeefn)) % "object")) >> (o = 0)), 
                            g = 1 + g, o += 0;
                        }
                    }(h--, -5, ..."" + arguments);
                }
                for (s = 5; "function" == typeof f2 && 0 <= --b && f2(-5) && 0 < --s; ) {
                    u = --y + --y;
                }
                for (o in --y + (arguments && "function" == typeof arguments.foo && 0 <= --b && (u && u.c, 
                arguments.foo)(("" + (h++ + !1 || 7)).Infinity))) {
                    for (g = 1 + g, N = 5; [ 22 ][[ 2 ]] && 0 < --N; ) {}
                }
            }
        } catch (t) {
            --y, --y, f = !1;
        } finally {
            i = function arguments_1(foo_2) {
                var t, a, e, n, o, c, s;
                try {
                    for (t = 5; (y = h) && 0 < --t; ) {}
                } catch (t) {
                    g = 1 + g, arguments && ({
                        b: arguments[(g += 1) + +y]
                    } = {
                        b: NaN
                    }), g += 1;
                }
                switch (--y + "a") {
                  case foo_2 && foo_2[[ !1 ^ (5 ^ i) - !1, (g = 1 + (g = 1 + g), 
                    -3 < ~(2 === [ , 0 ].length)) ]]:
                    break;

                  case u && u.Infinity:
                    for (a = 5; h++ + (g = 1 + g, "23" / (arguments && (arguments.null %= 0)) + ("" < this) ? (g = 1 + g, 
                    -2 ^ "number" + (r && (r.null += !1))) : (g = 1 + g, 0 ^ {} >> (r && (r[g = 1 + g, 
                    ((2 < 3n) >>> -3) - (this || -4) + (u += this < -2) % (e && (e.c ^= -5))] += 0)))) && 0 < a; --a) {
                        g = 1 + g;
                    }
                    for (n in e = void 0, h++ + {
                        async: 0
                    }[g = 1 + (g = 1 + g), Infinity ^ 0 & (g += 1, 2)]) {
                        g += 1;
                    }
                    break;

                  case h++ + {
                        next: (g += 1) + (f && f.next),
                        "\t": (g += 1) + /[abc4]/.test((g = 1 + g, (NaN - (this << "23") + NaN || y || 5).toString())),
                        var: h++,
                        [{
                            done: (g = 1 + g, !1 < (e && (e[g = 1 + g, 38] /= "" | this)) != (f && (f[g = 1 + g, 
                            0] = !1), !0))
                        }.set]: !1 in {
                            in: (g = 1 + g, !1),
                            a_1: e
                        },
                        then: void 0
                    }:
                    break;

                  case h++ + ++h:
                    for (c in o = {
                        b: (g = 1 + g, 4 * (2 === [ , 0 ].length) === NaN ^ !0),
                        NaN: (g = 1 + g, !(arguments && (arguments[g = 1 + g, "c" !== !1 >>> (g += 1, 
                        -3)] >>>= !0)) && -1)
                    }.in) {
                        switch (g = 1 + g, s = o[c], g = 1 + g, s && (s.a >>= (25 | i) < 0 >= (g += 1, 
                        [] << this))) {
                          default:
                          case g = 1 + g, c && (c[g = 1 + g, r && (r.c = NaN), g = 1 + (g = 1 + (g = 1 + g)), 
                            g += 1, foo_2 && (foo_2.done += NaN), g = 1 + g, g += 1, 
                            +void (s && (s.in += 0))] <<= ("24" << i) * (!1 + (i <= "object"))):
                          case g = 1 + g, i / 3 / (i * /[a2][^e]+$/) | !1 + "b":
                          case g = 1 + g, !1:
                        }
                    }
                    g = 1 + g;
                }
                return y--;
            }();
        }
    } while (--y + [ "symbol" == typeof b_2, u && u.foo, --y + {}.set ].var && 0 < --t);
}

console.log(null, h, y, g, Infinity, NaN, i);
original result:
null 7 -2 34 Infinity NaN 1

uglified result:
null 7 -2 36 Infinity NaN 1
// reduced test case (output will differ)

// (beautified)
var c = 0;

var brake1 = 5;

while (--brake1) {
    try {
        var arguments = function f0() {}(arguments.var = ((arguments.in = "b") && (c = c + 1, 
        "c")) <= 0);
    } catch (bar_1) {}
}

console.log(c);
// output: 1
// 
// minify: 4
// 
// options: {
//   "compress": {
//     "hoist_vars": true,
//     "keep_infinity": true,
//     "passes": 1000000,
//     "unsafe": true
//   },
//   "keep_fargs": true,
//   "keep_fnames": true,
//   "module": false,
//   "toplevel": true,
//   "output": {
//     "v8": true
//   },
//   "validate": true
// }
minify(options):
{
  "compress": {
    "hoist_vars": true,
    "keep_infinity": true,
    "passes": 1000000,
    "unsafe": true
  },
  "keep_fargs": true,
  "keep_fnames": true,
  "module": false,
  "toplevel": true,
  "output": {
    "v8": true
  }
}

Suspicious compress options:
  booleans
  collapse_vars
  evaluate
  pure_getters
  reduce_vars
  sequences
  unsafe