Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ufuzz failure #5580

Closed
alexlamsl opened this issue Jul 28, 2022 · 0 comments · Fixed by #5581
Closed

ufuzz failure #5580

alexlamsl opened this issue Jul 28, 2022 · 0 comments · Fixed by #5581
Labels

Comments

@alexlamsl
Copy link
Collaborator

// original code
// (beautified)
var _calls_ = 10, a = 100, b = 10, c = 0;

function f0(NaN_2) {
    try {
        {
            var a_2 = function f1(undefined_1, undefined_1) {
                switch (b = a) {
                  case --b + (b += a):
                    try {
                        {
                            var c_2 = function NaN_2_2(foo_1, b_1, NaN_2_1) {
                            }();
                        }
                    } finally {
                        var c_1 = (c = 1 + c, (NaN_2_2.undefined = ("c" | "b") !== (-2 === ([ , 0 ].length === 2))) >>> (23..toString() >> -2 >> (Infinity > 4))), NaN_2_2 = (c = 1 + c, 
                        (Infinity - "a" !== (-5 !== null)) >= ("b" >> "foo" ^ (false ^ /[a2][^e]+$/)));
                    }
                    break;

                  case undefined_1 && undefined_1.done:
                    {
                        var expr7 = /[abc4]/g.exec((--b + [ (c = 1 + c, (undefined_1 = (25 ^ "") === (undefined_1 && (undefined_1.next = "c" > undefined))) | (false | "number") % ("foo" === [ , 0 ][1])), (c = 1 + c, 
                        ({} & "b") >= [] * 38..toString() || Infinity >> ([ , 0 ].length === 2) >> (undefined >> "foo")) ][c = 1 + c, 
                        ((undefined_1 && (undefined_1[c = 1 + c, (24..toString() || "undefined") + (-5 !== {}), 
                        22 + -3 <= ~-1] += 1 < [ , 0 ][1])) >= (1, {})) >>> (false <= [ , 0 ][1] & "function" << {})] || b || 5).toString());
                        L12907: for (undefined_1 in expr7) {
                            a++ + (typeof c_2 == "function" && --_calls_ >= 0 && c_2());
                        }
                    }
                    c = c + 1;
                    break;

                  case (c = c + 1) + b--:
                    ;
                    break;

                  case a++ + (typeof foo_2 !== "crap"):
                    (c = c + 1) + [ (c = 1 + c, (undefined_1 >>= 0 > "object" > (24..toString() && 5)) - (("b" == "c") << (NaN == NaN))), (c = 1 + c, 
                    ((5 & 0) <= (this | "foo")) >> (undefined_1 = this * 4 || "bar" >>> /[a2][^e]+$/)), ..."" + c_2, (c = 1 + c, 
                    (undefined_1 && (undefined_1.done += "undefined" == "foo")) >> "" % ([ , 0 ].length === 2) !== ([] != -5 & "bar" - "object")), (c = 1 + c, 
                    "foo" + false >= (-1 ^ 24..toString()) && (c_2 && (c_2.value += (NaN_2 && (NaN_2.value = 25 != [])) - (-3 && this)))) ].done;
                    break;
                }
                try {
                    {
                        {
                            var bar_2 = function f2(a_2, foo_1) {
                            }();
                        }
                        var async;
                        {
                            return 24..toString() % Number(0xdeadn << 16n | 0xbeefn) >= (c = c + 1, 
                            [ , 0 ].length === 2) || NaN_2 && (NaN_2[typeof f1 == "function" && --_calls_ >= 0 && f1()] <<= [ , 0 ][1] << 24..toString() <= (0 !== 24..toString()));
                        }
                        if (a++ + {
                            c: (c = 1 + c, ([] - -2 !== (undefined_1 && (undefined_1[c = 1 + c, 
                            (delete "function" ^ 1 <= -5) < (23..toString() < {}) - -3 / [ , 0 ][1]] |= "undefined" > 3))) >= (async && (async.then %= ("foo" || -1) && ([ , 0 ].length === 2) >= 23..toString())))
                        }.c) {
                        }
                    }
                } catch (a) {
                    ~((("", Infinity) && (undefined_1 **= 38..toString() / ([ , 0 ].length === 2))) in -2 + Infinity >>> ("undefined" || this));
                    for (var brake20 = 5; (Infinity === "undefined" | true >= 25) & 5 <= "bar" <= Infinity >>> NaN && brake20 > 0; --brake20) {
                        c = c + 1;
                    }
                } finally {
                    --b + (b += a);
                    L12908: {
                        if (c = 1 + c, (undefined_1 && (undefined_1.value += ("function" || -3) / ([ , 0 ][1] + -0))) ^ (c_2 = "c" > -4) == ("bar" ^ 0)) {
                            c = 1 + c, this / -3 ^ /[a2][^e]+$/ % -4 && (undefined ^ 24..toString()) != +undefined;
                        }
                        L12909: {
                        }
                        switch (c = 1 + c, ~"" >> ("object" ^ "number") === (null < "foo") / (-4 === Number(0xdeadn << 16n | 0xbeefn))) {
                          case c = 1 + c, (c_2 <<= ("bar" >> "foo") / delete []) >>> ((NaN_2 /= [ , 0 ][1] ** [ , 0 ][1]) < (null || 4)):
                            ;
                            break;

                          case c = 1 + c, (c = c + 1, 4 & "c") ^ -4 > null === "a" <= Infinity:
                            ;
                            break;

                          case c = 1 + c, delete 38..toString() <= (false >= true) & (undefined_1 && (undefined_1.var &= ("a" && true) + +"function")):
                            ;
                            break;

                          case c = 1 + c, (NaN_2 && (NaN_2.b = 22 ** (-42n).toString())) in undefined - null && (-3 ^ -3 && 0 % "a"):
                            ;
                            break;
                        }
                        if (c = 1 + c, (-0 != NaN || "undefined" instanceof false) < (([ , 0 ].length === 2, 
                        "object") | 23..toString() >= 5)) {
                            c = 1 + c, ("bar" || -5) >>> (0 >= 3) ^ ("c" !== "undefined", 
                            delete false);
                        }
                    }
                }
            }();
        }
    } catch (foo) {
        {
            var undefined = function a_1() {
                {
                    var brake31 = 5;
                    while (a++ + (a_2 += (c = c + 1) + (c = c + 1, (24..toString() || "bar") ^ 25 == 4)) && --brake31 > 0) {
                        return;
                        [ ..."" + NaN_2, (c = 1 + c, (("a" || null) && false ^ NaN) ^ ("bar" === 23..toString()) <= (foo && (foo.set -= -2 % false))) ][typeof a_2 == "function" && --_calls_ >= 0 && a_2()];
                    }
                }
                {
                    var expr33 = --b + b--;
                    for (var NaN_2 in expr33) {
                        c = 1 + c;
                        var await_2 = expr33[NaN_2];
                    }
                }
            }((-42n).toString(), ...[ 23..toString(), a++, --b, a++ + (b + 1 - .1 - .1 - .1) ], --b);
        }
        return --b + new function() {
            switch (NaN_2 && typeof NaN_2.Infinity == "function" && --_calls_ >= 0 && NaN_2.Infinity([ , 0 ].length === 2, true)) {
              default:
                switch (--b + (typeof a_2 == "function" && --_calls_ >= 0 && a_2())) {
                  case -((24..toString() | "object" || "undefined" && 22) != (foo && (foo.b **= {} || "")) / ("undefined" & [ , 0 ].length === 2)):
                    c = 1 + c, (undefined += false / "object") - (!0o644n != "undefined") >= ("object" * 3 | 38..toString() & -2);
                    c = 1 + c, (foo && (foo.async <<= [ , 0 ][1] << 38..toString() > ("foo" > 5))) !== (3 || NaN) >= (22 ^ "number");
                    break;

                  case a++ + typeof b_2:
                    c = 1 + c, ("number" >= "", NaN_2 && (NaN_2[c = 1 + c, (c = c + 1, 
                    a_2 = 23..toString() % -5) ^ (c = c + 1, 0 && 23..toString())] += 24..toString() >>> NaN)) & ("b" | undefined) >>> "object" + "";
                    break;

                  case a++ + (c = 1 + c, (3 >> "undefined" || -3 >= "bar") ^ -("c" < false)):
                    c = 1 + c, (foo &= 2 >= ([ , 0 ].length === 2) ^ "undefined" / /[a2][^e]+$/) < (null >> "bar" >= (1 <= 5));
                    c = 1 + c, (25 | [ , 0 ][1]) === (Infinity & "foo") ^ -4 - 4 + ([ , 0 ][1] <= "object");
                    break;

                  case a++ + (typeof b_1 != "symbol"):
                    c = 1 + c, c = c + 1, (5, []) ^ /[a2][^e]+$/ == "b";
                    break;
                }
                try {
                    var NaN = (c = 1 + c, (a_2 && (a_2[foo && typeof foo.a == "function" && --_calls_ >= 0 && foo.a([ , 0 ][1], (c = 1 + c, 
                    -("bar" <= NaN) ^ ("" == 5) >>> (false === "c")), 1)] = -0 != "b" === undefined - "foo")) != ({} === "function") % (-2 >>> {}));
                } finally {
                    c = 1 + c, NaN && (NaN[(c = c + 1) + a_2] **= ({} | NaN) * (-0 >>> {})) && (c = c + 1, 
                    4) ^ Infinity === "undefined";
                    c = 1 + c, a_2 && (a_2.Infinity %= (NaN += (23..toString() + -1) / (a_2 = undefined && -0)) != [] >> -1 >>> "number" * 25);
                }

              case (c = c + 1) + (0 === 1 ? a : b):
                try {
                    {
                        var brake49 = 5;
                        L12910: while ((c = 1 + c, NaN && (NaN.c += {} % 38..toString() < "bar" >> 23..toString() === ("bar" in Infinity || -3 >> 22))) && --brake49 > 0) {
                            c = 1 + c, ([ , 0 ][1] <= -1 | 25 ^ []) + ((Infinity | undefined) & -1 % ([ , 0 ].length === 2));
                        }
                    }
                } catch (b) {
                    c = 1 + c, ("function" >= "bar") << (5 < -5) < (-2 * 24..toString() === (undefined && (undefined[c = 1 + c, 
                    (NaN && ({
                        "-2": NaN[c = 1 + c, (-1 & [ 3n ][0] > 2) === (NaN_2 && (NaN_2[c = 1 + c, 
                        (this ^ NaN) << (25 > this) ^ ((-5, 22) | (c = c + 1, -4))] = "foo" * ([ , 0 ].length === 2))) ^ {} >= "" !== -1 < "function"]
                    } = {
                        "-2": (1, [])
                    }) || -3 !== 2) << (NaN_2 && (NaN_2[b && typeof b.foo == "function" && --_calls_ >= 0 && b.foo()] >>= ([ 3n ][0] > 2) * 23..toString() | -4 + 25))] = -1 + 25)));
                    c = 1 + c, (NaN >>>= ([ , 0 ].length === 2 == -2) * (24..toString() + 1)) ^ (NaN_2 && ([ NaN_2[c = 1 + c, 
                    (false * 5 === (-5 ^ this)) <= (23..toString() / 2 && 2 ^ "a")] ] = [ undefined > -2 ])) !== (undefined && (undefined.then >>= [ , 0 ][1] || 4));
                }
                break;

              case void function foo() {}():
                if (a++ + ((c = 1 + c, (Infinity >= "foo") % !true && ~(0 != Infinity)) || 5).toString()[c = 1 + c, 
                (3 <= 22) % ("function" > 23..toString()) + (("" ^ [ , 0 ].length === 2) != 0 >= 4)]) {
                    try {
                        c = 1 + c, ("b", 5) % (a_2 && (a_2[c = 1 + c, ("object" > [ , 0 ][1]) >>> ("bar" >>> -5) << ({} >> [] <= (-3 !== null))] >>= 23..toString() << "undefined")) !== (c = c + 1, 
                        -3 / 25);
                    } finally {
                    }
                } else {
                    break;
                }
                {
                    c = 1 + c, (c = c + 1, "bar" * "b") ^ (a_2 %= ("number" >= -4) / (0, 
                    true));
                    c = 1 + c, (this | "b") / (/[a2][^e]+$/ >>> "a") * ((Infinity | 0) / ({} % "a"));
                    c = 1 + c, !(NaN, 25) ^ (-2 << 22 && "b" !== this);
                    c = 1 + c, (2 >> -1 && 38..toString() == 25) | (5 / 23..toString() | (1 || "foo"));
                }
                break;

              case {
                    "-2": a++ + (1 === 1 ? a : b),
                    var: {
                        Infinity: (c = 1 + c, ([ , 0 ][1] ** -4 != (38..toString() | -1)) >> (({} <= -1) >>> ([ , 0 ][1] < NaN))),
                        1.5: (c = 1 + c, ("foo" << 3) + -0 % -4, 38..toString() - (-42n).toString() ^ 3 >>> 4)
                    },
                    null: (c = 1 + c, (38..toString() >> -3 | undefined * ([ , 0 ].length === 2)) >>> ((c = c + 1, 
                    -2) > (undefined && (undefined[c = 1 + c, undefined && (undefined.async += (NaN / 22 + (4 >>> "a")) % (5 ^ "number" | [] >> 22))] /= "" == ([ , 0 ].length === 2))))) ? (c = 1 + c, 
                    (NaN_2 = "function" !== /[a2][^e]+$/) / ~0 | (a_2 %= -0 < "a" == "number" - "function")) : (c = 1 + c, 
                    "foo" << 2 | -0 & "object", (2, []) % ("b" || null))
                }.get:
                {}
                try {
                    for (var brake64 = 5; (c = 1 + c, c = c + 1, (foo >>>= 24..toString() & "a") === (1 & "")) && brake64 > 0; --brake64) {
                        c = 1 + c, ("bar" !== "foo") % (1 === []) || ([], "c") + (c = c + 1, 
                        [ , 0 ].length === 2);
                    }
                } finally {}
                break;
            }
            {
                var expr66 = typeof a;
                L12911: for (var key66 in expr66) {
                    c = 1 + c;
                    const foo = expr66[key66];
                    {
                        return --b + [ (c = 1 + c, "" % 0 + (NaN += 1 < this) >>> (("undefined" ^ this) <= -0 * true)), (c = 1 + c, 
                        (a_2 && (a_2[--b + "undefined"] -= "b" && NaN || 2 * /[a2][^e]+$/)) * (2 << [ , 0 ][1] < -4 << 25)) ].foo;
                    }
                }
            }
        }(a++ + a_2, +((23..toString() | 2) / (-5 * 25) && "c" >> "undefined" <= Infinity >>> 2), a++ + -("b" / "number" ^ (foo && ([ foo[c = 1 + c, 
        (5 << 1) % (a_2 *= NaN + 23..toString()) == ("undefined" >= 2 != (this & 23..toString()))] ] = [ !0o644n | 1 ])) ^ ("" > "function") / (!0o644n ^ -4)));
    } finally {
        const foo = (c = c + 1) + (NaN_2 && typeof NaN_2.c == "function" && --_calls_ >= 0 && ((("undefined" & "") != (a_2 += Infinity % 5)) / (([] | "object") > (2 > /[a2][^e]+$/)), 
        NaN_2.c)());
        (c = c + 1) + [ --b + (typeof NaN_2 == "function" && --_calls_ >= 0 && NaN_2(typeof f2 == "function" && --_calls_ >= 0 && f2(-3, (c = 1 + c, 
        (-4 !== 2) > {} * 2 && "b" === "foo" !== (null ^ 38..toString()))), 3)), a++ ][a++ + (b + 1 - .1 - .1 - .1)];
    }
    {
        var brake69 = 5;
        L12912: while (`${NaN_2 && typeof NaN_2.foo == "function" && --_calls_ >= 0 && NaN_2.foo((c = c + 1) + (-0 in {
            [a++ + (a_2 && typeof a_2.set == "function" && --_calls_ >= 0 && a_2.set(..."" + a_2, -3, (c = 1 + c, 
            a_2 = ("foo" * -3 && -5 - 24..toString()) ^ (NaN_2 = 0 - -4) * ("b" || "undefined"))))]: typeof f2 == "function" && --_calls_ >= 0 && f2(),
            [a++ + (a_2 && a_2.async)]: (b = a) ? a++ + b-- : a++ + (b += a),
            null: ((1 * {} || -2 !== -3) != (c = c + 1, -4 + "object") || a || 3).toString(),
            undefined: a++,
            "\t": a++ + "function"
        }), delete b, "undefined")}` && --brake69 > 0) {}
    }
}

var c = f0([], NaN, (c = c + 1) + a++);

console.log(null, a, b, c, Infinity, NaN, undefined);
// uglified code
// (beautified)
var _calls_ = 10, a = 100, b = 10, c = 0;

function f0(s) {
    try {
        {
            var r = function n(t, t) {
                switch (b = a) {
                  case --b + (b += a):
                    try {
                        {
                            var e = function c(n, t, e) {}();
                        }
                    } finally {
                        var i = (c = 1 + c, (o.undefined = ("c" | "b") !== (-2 === ([ , 0 ].length === 2))) >>> (23..toString() >> -2 >> (Infinity > 4))), o = (c = 1 + c, 
                        (Infinity - "a" !== (-5 !== null)) >= ("b" >> "foo" ^ (false ^ /[a2][^e]+$/)));
                    }
                    break;

                  case t && t.done:
                    {
                        var f = /[abc4]/g.exec((--b + [ (c = 1 + c, (t = (25 ^ "") === (t && (t.next = "c" > g))) | (false | "number") % ("foo" === [ , 0 ][1])), (c = 1 + c, 
                        ({} & "b") >= [] * 38..toString() || Infinity >> ([ , 0 ].length === 2) >> (g >> "foo")) ][c = 1 + c, 
                        ((t && (t[c = 1 + c, (24..toString() || "undefined") + (-5 !== {}), 
                        22 + -3 <= ~-1] += 1 < [ , 0 ][1])) >= (1, {})) >>> (false <= [ , 0 ][1] & "function" << {})] || b || 5).toString());
                        c: for (t in f) {
                            a++ + (typeof e == "function" && --_calls_ >= 0 && e());
                        }
                    }
                    c = c + 1;
                    break;

                  case (c = c + 1) + b--:
                    ;
                    break;

                  case a++ + (typeof foo_2 !== "crap"):
                    (c = c + 1) + [ (c = 1 + c, (t >>= 0 > "object" > (24..toString() && 5)) - (("b" == "c") << (NaN == NaN))), (c = 1 + c, 
                    ((5 & 0) <= (this | "foo")) >> (t = this * 4 || "bar" >>> /[a2][^e]+$/)), ..."" + e, (c = 1 + c, 
                    (t && (t.done += "undefined" == "foo")) >> "" % ([ , 0 ].length === 2) !== ([] != -5 & "bar" - "object")), (c = 1 + c, 
                    "foo" + false >= (-1 ^ 24..toString()) && (e && (e.value += (s && (s.value = 25 != [])) - (-3 && this)))) ].done;
                    break;
                }
                try {
                    {
                        {
                            var r = function c(n, t) {}();
                        }
                        var l;
                        {
                            return 24..toString() % Number(0xdeadn << 16n | 0xbeefn) >= (c = c + 1, 
                            [ , 0 ].length === 2) || s && (s[typeof n == "function" && --_calls_ >= 0 && n()] <<= [ , 0 ][1] << 24..toString() <= (0 !== 24..toString()));
                        }
                        if (a++ + {
                            c: (c = 1 + c, ([] - -2 !== (t && (t[c = 1 + c, (delete "function" ^ 1 <= -5) < (23..toString() < {}) - -3 / [ , 0 ][1]] |= "undefined" > 3))) >= (l && (l.then %= ("foo" || -1) && ([ , 0 ].length === 2) >= 23..toString())))
                        }.c) {}
                    }
                } catch (n) {
                    ~((("", Infinity) && (t **= 38..toString() / ([ , 0 ].length === 2))) in -2 + Infinity >>> ("undefined" || this));
                    for (var u = 5; (Infinity === "undefined" | true >= 25) & 5 <= "bar" <= Infinity >>> NaN && u > 0; --u) {
                        c = c + 1;
                    }
                } finally {
                    --b + (b += a);
                    c: {
                        if (c = 1 + c, (t && (t.value += ("function" || -3) / ([ , 0 ][1] + -0))) ^ (e = "c" > -4) == ("bar" ^ 0)) {
                            c = 1 + c, this / -3 ^ /[a2][^e]+$/ % -4 && (g ^ 24..toString()) != +g;
                        }
                        n: {}
                        switch (c = 1 + c, ~"" >> ("object" ^ "number") === (null < "foo") / (-4 === Number(0xdeadn << 16n | 0xbeefn))) {
                          case c = 1 + c, (e <<= ("bar" >> "foo") / delete []) >>> ((s /= [ , 0 ][1] ** [ , 0 ][1]) < (null || 4)):
                            ;
                            break;

                          case c = 1 + c, (c = c + 1, 4 & "c") ^ -4 > null === "a" <= Infinity:
                            ;
                            break;

                          case c = 1 + c, delete 38..toString() <= (false >= true) & (t && (t.var &= ("a" && true) + +"function")):
                            ;
                            break;

                          case c = 1 + c, (s && (s.b = 22 ** (-42n).toString())) in g - null && (-3 ^ -3 && 0 % "a"):
                            ;
                            break;
                        }
                        if (c = 1 + c, (-0 != NaN || "undefined" instanceof false) < (([ , 0 ].length === 2, 
                        "object") | 23..toString() >= 5)) {
                            c = 1 + c, ("bar" || -5) >>> (0 >= 3) ^ ("c" !== "undefined", 
                            delete false);
                        }
                    }
                }
            }();
        }
    } catch (f) {
        {
            var g = function n() {
                {
                    var t = 5;
                    while (a++ + (r += (c = c + 1) + (c = c + 1, (24..toString() || "bar") ^ 25 == 4)) && --t > 0) {
                        return;
                        [ ..."" + i, (c = 1 + c, (("a" || null) && false ^ NaN) ^ ("bar" === 23..toString()) <= (f && (f.set -= -2 % false))) ][typeof r == "function" && --_calls_ >= 0 && r()];
                    }
                }
                {
                    var e = --b + b--;
                    for (var i in e) {
                        c = 1 + c;
                        var o = e[i];
                    }
                }
            }((-42n).toString(), ...[ 23..toString(), a++, --b, a++ + (b + 1 - .1 - .1 - .1) ], --b);
        }
        return --b + new function() {
            switch (s && typeof s.Infinity == "function" && --_calls_ >= 0 && s.Infinity([ , 0 ].length === 2, true)) {
              default:
                switch (--b + (typeof r == "function" && --_calls_ >= 0 && r())) {
                  case -((24..toString() | "object" || "undefined" && 22) != (f && (f.b **= {} || "")) / ("undefined" & [ , 0 ].length === 2)):
                    c = 1 + c, (g += false / "object") - (!0o644n != "undefined") >= ("object" * 3 | 38..toString() & -2);
                    c = 1 + c, (f && (f.async <<= [ , 0 ][1] << 38..toString() > ("foo" > 5))) !== (3 || t) >= (22 ^ "number");
                    break;

                  case a++ + typeof b_2:
                    c = 1 + c, ("number" >= "", s && (s[c = 1 + c, (c = c + 1, r = 23..toString() % -5) ^ (c = c + 1, 
                    0 && 23..toString())] += 24..toString() >>> t)) & ("b" | g) >>> "object" + "";
                    break;

                  case a++ + (c = 1 + c, (3 >> "undefined" || -3 >= "bar") ^ -("c" < false)):
                    c = 1 + c, (f &= 2 >= ([ , 0 ].length === 2) ^ "undefined" / /[a2][^e]+$/) < (null >> "bar" >= (1 <= 5));
                    c = 1 + c, (25 | [ , 0 ][1]) === (Infinity & "foo") ^ -4 - 4 + ([ , 0 ][1] <= "object");
                    break;

                  case a++ + (typeof b_1 != "symbol"):
                    c = 1 + c, c = c + 1, (5, []) ^ /[a2][^e]+$/ == "b";
                    break;
                }
                try {
                    var t = (c = 1 + c, (r && (r[f && typeof f.a == "function" && --_calls_ >= 0 && f.a([ , 0 ][1], (c = 1 + c, 
                    -("bar" <= t) ^ ("" == 5) >>> (false === "c")), 1)] = -0 != "b" === g - "foo")) != ({} === "function") % (-2 >>> {}));
                } finally {
                    c = 1 + c, t && (t[(c = c + 1) + r] **= ({} | t) * (-0 >>> {})) && (c = c + 1, 
                    4) ^ Infinity === "undefined";
                    c = 1 + c, r && (r.Infinity %= (t += (23..toString() + -1) / (r = g && -0)) != [] >> -1 >>> "number" * 25);
                }

              case (c = c + 1) + (0 === 1 ? a : b):
                try {
                    {
                        var n = 5;
                        c: while ((c = 1 + c, t && (t.c += {} % 38..toString() < "bar" >> 23..toString() === ("bar" in Infinity || -3 >> 22))) && --n > 0) {
                            c = 1 + c, ([ , 0 ][1] <= -1 | 25 ^ []) + ((Infinity | g) & -1 % ([ , 0 ].length === 2));
                        }
                    }
                } catch (n) {
                    c = 1 + c, ("function" >= "bar") << (5 < -5) < (-2 * 24..toString() === (g && (g[c = 1 + c, 
                    (t && ({
                        "-2": t[c = 1 + c, (-1 & [ 3n ][0] > 2) === (s && (s[c = 1 + c, 
                        (this ^ t) << (25 > this) ^ ((-5, 22) | (c = c + 1, -4))] = "foo" * ([ , 0 ].length === 2))) ^ {} >= "" !== -1 < "function"]
                    } = {
                        "-2": (1, [])
                    }) || -3 !== 2) << (s && (s[n && typeof n.foo == "function" && --_calls_ >= 0 && n.foo()] >>= ([ 3n ][0] > 2) * 23..toString() | -4 + 25))] = -1 + 25)));
                    c = 1 + c, (t >>>= ([ , 0 ].length === 2 == -2) * (24..toString() + 1)) ^ (s && ([ s[c = 1 + c, 
                    (false * 5 === (-5 ^ this)) <= (23..toString() / 2 && 2 ^ "a")] ] = [ g > -2 ])) !== (g && (g.then >>= [ , 0 ][1] || 4));
                }
                break;

              case void function c() {}():
                if (a++ + ((c = 1 + c, (Infinity >= "foo") % !true && ~(0 != Infinity)) || 5).toString()[c = 1 + c, 
                (3 <= 22) % ("function" > 23..toString()) + (("" ^ [ , 0 ].length === 2) != 0 >= 4)]) {
                    try {
                        c = 1 + c, ("b", 5) % (r && (r[c = 1 + c, ("object" > [ , 0 ][1]) >>> ("bar" >>> -5) << ({} >> [] <= (-3 !== null))] >>= 23..toString() << "undefined")) !== (c = c + 1, 
                        -3 / 25);
                    } finally {}
                } else {
                    break;
                }
                {
                    c = 1 + c, (c = c + 1, "bar" * "b") ^ (r %= ("number" >= -4) / (0, 
                    true));
                    c = 1 + c, (this | "b") / (/[a2][^e]+$/ >>> "a") * ((Infinity | 0) / ({} % "a"));
                    c = 1 + c, !(t, 25) ^ (-2 << 22 && "b" !== this);
                    c = 1 + c, (2 >> -1 && 38..toString() == 25) | (5 / 23..toString() | (1 || "foo"));
                }
                break;

              case {
                    "-2": a++ + (1 === 1 ? a : b),
                    var: {
                        Infinity: (c = 1 + c, ([ , 0 ][1] ** -4 != (38..toString() | -1)) >> (({} <= -1) >>> ([ , 0 ][1] < t))),
                        1.5: (c = 1 + c, ("foo" << 3) + -0 % -4, 38..toString() - (-42n).toString() ^ 3 >>> 4)
                    },
                    null: (c = 1 + c, (38..toString() >> -3 | g * ([ , 0 ].length === 2)) >>> ((c = c + 1, 
                    -2) > (g && (g[c = 1 + c, g && (g.async += (t / 22 + (4 >>> "a")) % (5 ^ "number" | [] >> 22))] /= "" == ([ , 0 ].length === 2))))) ? (c = 1 + c, 
                    (s = "function" !== /[a2][^e]+$/) / ~0 | (r %= -0 < "a" == "number" - "function")) : (c = 1 + c, 
                    "foo" << 2 | -0 & "object", (2, []) % ("b" || null))
                }.get:
                {}
                try {
                    for (var e = 5; (c = 1 + c, c = c + 1, (f >>>= 24..toString() & "a") === (1 & "")) && e > 0; --e) {
                        c = 1 + c, ("bar" !== "foo") % (1 === []) || ([], "c") + (c = c + 1, 
                        [ , 0 ].length === 2);
                    }
                } finally {}
                break;
            }
            {
                var i = typeof a;
                c: for (var o in i) {
                    c = 1 + c;
                    const t = i[o];
                    {
                        return --b + [ (c = 1 + c, "" % 0 + (t += 1 < this) >>> (("undefined" ^ this) <= -0 * true)), (c = 1 + c, 
                        (r && (r[--b + "undefined"] -= "b" && t || 2 * /[a2][^e]+$/)) * (2 << [ , 0 ][1] < -4 << 25)) ].foo;
                    }
                }
            }
        }(a++ + r, +((23..toString() | 2) / (-5 * 25) && "c" >> "undefined" <= Infinity >>> 2), a++ + -("b" / "number" ^ (f && ([ f[c = 1 + c, 
        (5 << 1) % (r *= NaN + 23..toString()) == ("undefined" >= 2 != (this & 23..toString()))] ] = [ !0o644n | 1 ])) ^ ("" > "function") / (!0o644n ^ -4)));
    } finally {
        const t = (c = c + 1) + (s && typeof s.c == "function" && --_calls_ >= 0 && ((("undefined" & "") != (r += Infinity % 5)) / (([] | "object") > (2 > /[a2][^e]+$/)), 
        s.c)());
        (c = c + 1) + [ --b + (typeof s == "function" && --_calls_ >= 0 && s(typeof f2 == "function" && --_calls_ >= 0 && f2(-3, (c = 1 + c, 
        (-4 !== 2) > {} * 2 && "b" === "foo" !== (null ^ 38..toString()))), 3)), a++ ][a++ + (b + 1 - .1 - .1 - .1)];
    }
    {
        var n = 5;
        c: while (`${s && typeof s.foo == "function" && --_calls_ >= 0 && s.foo((c = c + 1) + (-0 in {
            [a++ + (r && typeof r.set == "function" && --_calls_ >= 0 && r.set(..."" + r, -3, (c = 1 + c, 
            r = ("foo" * -3 && -5 - 24..toString()) ^ (s = 0 - -4) * ("b" || "undefined"))))]: typeof f2 == "function" && --_calls_ >= 0 && f2(),
            [a++ + (r && r.async)]: (b = a) ? a++ + b-- : a++ + (b += a),
            null: ((1 * {} || -2 !== -3) != (c = c + 1, -4 + "object") || a || 3).toString(),
            undefined: a++,
            "\t": a++ + "function"
        }), delete b, "undefined")}` && --n > 0) {}
    }
}

var c = f0([], NaN, (c = c + 1) + a++);

console.log(null, a, b, c, Infinity, NaN, undefined);
original result:
null 113 293 296[object Object] Infinity NaN undefined

uglified result:
evalmachine.<anonymous>:1
var _calls_=10,a=100,b=10,c=0;function f0(s){try{{var r=function n(t,t){switch(b=a){case--b+(b+=a):try{{var e=function c(n,t,e){}()}}finally{var i=(c=1+c,(o.undefined=("c"|"b")!==(-2===([,0].length===2)))>>>(23..toString()>>-2>>(Infinity>4))),o=(c=1+c,(Infinity-"a"!==(-5!==null))>=("b">>"foo"^(false^/[a2][^e]+$/)))}break;case t&&t.done:{var f=/[abc4]/g.exec((--b+[(c=1+c,(t=(25^"")===(t&&(t.next="c">g)))|(false|"number")%("foo"===[,0][1])),(c=1+c,({}&"b")>=[]*38..toString()||Infinity>>([,0].length===2)>>(g>>"foo"))][c=1+c,((t&&(t[c=1+c,(24..toString()||"undefined")+(-5!=={}),22+-3<=~-1]+=1<[,0][1]))>=(1,{}))>>>(false<=[,0][1]&"function"<<{})]||b||5).toString());c:for(t in f){a+++(typeof e=="function"&&--_calls_>=0&&e())}}c=c+1;break;case(c=c+1)+b--:;break;case a+++(typeof foo_2!=="crap"):(c=c+1)+[(c=1+c,(t>>=0>"object">(24..toString()&&5))-(("b"=="c")<<(NaN==NaN))),(c=1+c,((5&0)<=(this|"foo"))>>(t=this*4||"bar">>>/[a2][^e]+$/)),...""+e,(c=1+c,(t&&(t.done+="undefined"=="foo"))>>""%([,0].length===2)!==([]!=-5&"bar"-"object")),(c=1+c,"foo"+false>=(-1^24..toString())&&(e&&(e.value+=(s&&(s.value=25!=[]))-(-3&&this))))].done;break}try{{{var r=function c(n,t){}()}var l;{return 24..toString()%Number(0xdeadn<<16n|0xbeefn)>=(c=c+1,[,0].length===2)||s&&(s[typeof n=="function"&&--_calls_>=0&&n()]<<=[,0][1]<<24..toString()<=(0!==24..toString()))}if(a+++{c:(c=1+c,([]- -2!==(t&&(t[c=1+c,(delete"function"^1<=-5)<(23..toString()<{})- -3/[,0][1]]|="undefined">3)))>=(l&&(l.then%=("foo"||-1)&&([,0].length===2)>=23..toString())))}.c){}}}catch(n){~((("",Infinity)&&(t**=38..toString()/([,0].length===2)))in-2+Infinity>>>("undefined"||this));for(var u=5;(Infinity==="undefined"|true>=25)&5<="bar"<=Infinity>>>NaN&&u>0;--u)c=c+1}finally{--b+(b+=a);c:{if(c=1+c,(t&&(t.value+=("function"||-3)/([,0][1]+-0)))^(e="c">-4)==("bar"^0))c=1+c,this/-3^/[a2][^e]+$/%-4&&(g^24..toString())!=+g;n:{}switch(c=1+c,~"">>("object"^"number")===(null<"foo")/(-4===Number(0xdeadn<<16n|0xbeefn))){case c=1+c,(e<<=("bar">>"foo")/delete[])>>>((s/=[,0][1]**[,0][1])<(null||4)):;break;case c=1+c,(c=c+1,4&"c")^-4>null==="a"<=Infinity:;break;case c=1+c,delete 38..toString()<=(false>=true)&(t&&(t.var&=("a"&&true)+ +"function")):;break;case c=1+c,(s&&(s.b=22**(-42n).toString()))in g-null&&(-3^-3&&0%"a"):;break}if(c=1+c,(-0!=NaN||"undefined"instanceof false)<(([,0].length===2,"object")|23..toString()>=5))c=1+c,("bar"||-5)>>>(0>=3)^("c"!=="undefined",delete false)}}}()}}catch(f){{var g=function n(){{var t=5;while(a+++(r+=(c=c+1)+(c=c+1,(24..toString()||"bar")^25==4))&&--t>0){return;[...""+i,(c=1+c,(("a"||null)&&false^NaN)^("bar"===23..toString())<=(f&&(f.set-=-2%false)))][typeof r=="function"&&--_calls_>=0&&r()]}}{var e=--b+b--;for(var i in e){c=1+c;var o=e[i]}}}((-42n).toString(),...[23..toString(),a++,--b,a+++(b+1-.1-.1-.1)],--b)}return--b+new function(){switch(s&&typeof s.Infinity=="function"&&--_calls_>=0&&s.Infinity([,0].length===2,true)){default:switch(--b+(typeof r=="function"&&--_calls_>=0&&r())){case-((24..toString()|"object"||"undefined"&&22)!=(f&&(f.b**={}||""))/("undefined"&[,0].length===2)):c=1+c,(g+=false/"object")-(!0o644n!="undefined")>=("object"*3|38..toString()&-2);c=1+c,(f&&(f.async<<=[,0][1]<<38..toString()>("foo">5)))!==(3||t)>=(22^"number");break;case a+++typeof b_2:c=1+c,("number">="",s&&(s[c=1+c,(c=c+1,r=23..toString()%-5)^(c=c+1,0&&23..toString())]+=24..toString()>>>t))&("b"|g)>>>"object"+"";break;case a+++(c=1+c,(3>>"undefined"||-3>="bar")^-("c"<false)):c=1+c,(f&=2>=([,0].length===2)^"undefined"/ /[a2][^e]+$/)<(null>>"bar">=(1<=5));c=1+c,(25|[,0][1])===(Infinity&"foo")^-4-4+([,0][1]<="object");break;case a+++(typeof b_1!="symbol"):c=1+c,c=c+1,(5,[])^/[a2][^e]+$/=="b";break}try{var t=(c=1+c,(r&&(r[f&&typeof f.a=="function"&&--_calls_>=0&&f.a([,0][1],(c=1+c,-("bar"<=t)^(""==5)>>>(false==="c")),1)]=-0!="b"===g-"foo"))!=({}==="function")%(-2>>>{}))}finally{c=1+c,t&&(t[(c=c+1)+r]**=({}|t)*(-0>>>{}))&&(c=c+1,4)^Infinity==="undefined";c=1+c,r&&(r.Infinity%=(t+=(23..toString()+-1)/(r=g&&-0))!=[]>>-1>>>"number"*25)}case(c=c+1)+(0===1?a:b):try{{var n=5;c:while((c=1+c,t&&(t.c+={}%38..toString()<"bar">>23..toString()===("bar"in Infinity||-3>>22)))&&--n>0)c=1+c,([,0][1]<=-1|25^[])+((Infinity|g)&-1%([,0].length===2))}}catch(n){c=1+c,("function">="bar")<<(5<-5)<(-2*24..toString()===(g&&(g[c=1+c,(t&&({"-2":t[c=1+c,(-1&[3n][0]>2)===(s&&(s[c=1+c,(this^t)<<(25>this)^((-5,22)|(c=c+1,-4))]="foo"*([,0].length===2)))^{}>=""!==-1<"function"]}={"-2":(1,[])})||-3!==2)<<(s&&(s[n&&typeof n.foo=="function"&&--_calls_>=0&&n.foo()]>>=([3n][0]>2)*23..toString()|-4+25))]=-1+25)));c=1+c,(t>>>=([,0].length===2==-2)*(24..toString()+1))^(s&&([s[c=1+c,(false*5===(-5^this))<=(23..toString()/2&&2^"a")]]=[g>-2]))!==(g&&(g.then>>=[,0][1]||4))}break;case void function c(){}():if(a+++((c=1+c,(Infinity>="foo")%!true&&~(0!=Infinity))||5).toString()[c=1+c,(3<=22)%("function">23..toString())+((""^[,0].length===2)!=0>=4)])try{c=1+c,("b",5)%(r&&(r[c=1+c,("object">[,0][1])>>>("bar">>>-5)<<({}>>[]<=(-3!==null))]>>=23..toString()<<"undefined"))!==(c=c+1,-3/25)}finally{}else break;{c=1+c,(c=c+1,"bar"*"b")^(r%=("number">=-4)/(0,true));c=1+c,(this|"b")/(/[a2][^e]+$/>>>"a")*((Infinity|0)/({}%"a"));c=1+c,!(t,25)^(-2<<22&&"b"!==this);c=1+c,(2>>-1&&38..toString()==25)|(5/23..toString()|(1||"foo"))}break;case{"-2":a+++(1===1?a:b),var:{Infinity:(c=1+c,([,0][1]**-4!=(38..toString()|-1))>>(({}<=-1)>>>([,0][1]<t))),1.5:(c=1+c,("foo"<<3)+-0%-4,38..toString()-(-42n).toString()^3>>>4)},null:(c=1+c,(38..toString()>>-3|g*([,0].length===2))>>>((c=c+1,-2)>(g&&(g[c=1+c,g&&(g.async+=(t/22+(4>>>"a"))%(5^"number"|[]>>22))]/=""==([,0].length===2)))))?(c=1+c,(s="function"!==/[a2][^e]+$/)/~0|(r%=-0<"a"=="number"-"function")):(c=1+c,"foo"<<2|-0&"object",(2,[])%("b"||null))}.get:{}try{for(var e=5;(c=1+c,c=c+1,(f>>>=24..toString()&"a")===(1&""))&&e>0;--e)c=1+c,("bar"!=="foo")%(1===[])||([],"c")+(c=c+1,[,0].length===2)}finally{}break}{var i=typeof a;c:for(var o in i){c=1+c;const t=i[o];{return--b+[(c=1+c,""%0+(t+=1<this)>>>(("undefined"^this)<=-0*true)),(c=1+c,(r&&(r[--b+"undefined"]-="b"&&t||2*/[a2][^e]+$/))*(2<<[,0][1]<-4<<25))].foo}}}}(a+++r,+((23..toString()|2)/(-5*25)&&"c">>"undefined"<=Infinity>>>2),a+++-("b"/"number"^(f&&([f[c=1+c,(5<<1)%(r*=NaN+23..toString())==("undefined">=2!=(this&23..toString()))]]=[!0o644n|1]))^("">"function")/(!0o644n^-4)))}finally{const t=(c=c+1)+(s&&typeof s.c=="function"&&--_calls_>=0&&((("undefined"&"")!=(r+=Infinity%5))/(([]|"object")>(2>/[a2][^e]+$/)),s.c)());(c=c+1)+[--b+(typeof s=="function"&&--_calls_>=0&&s(typeof f2=="function"&&--_calls_>=0&&f2(-3,(c=1+c,(-4!==2)>{}*2&&"b"==="foo"!==(null^38..toString()))),3)),a++][a+++(b+1-.1-.1-.1)]}{var n=5;c:while(`${s&&typeof s.foo=="function"&&--_calls_>=0&&s.foo((c=c+1)+(-0 in{[a+++(r&&typeof r.set=="function"&&--_calls_>=0&&r.set(...""+r,-3,(c=1+c,r=("foo"*-3&&-5-24..toString())^(s=0- -4)*("b"||"undefined"))))]:typeof f2=="function"&&--_calls_>=0&&f2(),[a+++(r&&r.async)]:(b=a)?a+++b--:a+++(b+=a),null:((1*{}||-2!==-3)!=(c=c+1,-4+"object")||a||3).toString(),undefined:a++,"\t":a+++"function"}),delete b,"undefined")}`&&--n>0);}}var c=f0([],NaN,(c=c+1)+a++);console.log(null,a,b,c,Infinity,NaN,undefined);
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            

TypeError: Assignment to constant variable.
    at new <anonymous> (evalmachine.<anonymous>:1:6004)
    at f0 (evalmachine.<anonymous>:1:2828)
    at evalmachine.<anonymous>:1:7127
    at Script.runInContext (vm.js:130:18)
    at Object.runInContext (vm.js:293:6)
    at run_code_vm (/home/runner/work/UglifyJS/UglifyJS/test/sandbox.js:266:12)
    at Object.exports.run_code (/home/runner/work/UglifyJS/UglifyJS/test/sandbox.js:39:16)
    at run_code (/home/runner/work/UglifyJS/UglifyJS/test/ufuzz/index.js:2115:20)
    at /home/runner/work/UglifyJS/UglifyJS/test/ufuzz/index.js:2562:29
    at Array.forEach (<anonymous>)
// reduced test case (output will differ)

// (beautified)
function f0(NaN_2) {
    try {
        var a_2 = undefined_1;
    } catch (foo) {
        return new function() {
            var NaN = foo;
            var expr66 = typeof 0;
            for (var key66 in expr66) {
                const foo = key66;
                return a_2;
            }
        }();
    } finally {
        const foo = 0;
    }
    var brake69;
}

f0();
// output: 
// minify: ReferenceError: Cannot access 't' before initialization
// options: {
//   "compress": false,
//   "output": {
//     "v8": true
//   },
//   "validate": true
// }
minify(options):
{
  "compress": false,
  "output": {
    "v8": true
  }
}
@alexlamsl alexlamsl added the bug label Jul 28, 2022
alexlamsl added a commit to alexlamsl/UglifyJS that referenced this issue Jul 28, 2022
alexlamsl added a commit that referenced this issue Jul 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant