Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ufuzz failure #5536

Closed
alexlamsl opened this issue Jul 1, 2022 · 0 comments · Fixed by #5537
Closed

ufuzz failure #5536

alexlamsl opened this issue Jul 1, 2022 · 0 comments · Fixed by #5537
Labels

Comments

@alexlamsl
Copy link
Collaborator

// original code
// (beautified)
var _calls_ = 10, a = 100, b = 10, c = 0;

function* f0(undefined, let_2) {
    {
        {
            var brake2 = 5;
            while ((c = c + 1) + function c_1() {}() && --brake2 > 0) {}
        }
        {
            var async_2 = function f1(let_2_2, yield_1 = typeof undefined_2 === "function", foo) {
                function f2(foo_2) {
                    function f3(bar, {}) {
                    }
                    var await_2 = f3(-3, "", (c = 1 + c, void ("undefined" || {}) / ((-2 != "foo") / delete "c")));
                    function f4(c_1, await_2) {
                    }
                    var Infinity = f4();
                    function f5(...foo_2) {
                    }
                    var b_1 = f5(24..toString(), this, (c = 1 + c, "a" / -5 << (38..toString() >= -3) ^ void "c" === (-2 | -3)));
                }
                function* f6() {
                    var foo_2 = (c = 1 + c, -3 + "b" << ({} << 2) === (foo && (foo.get &= ([ , 0 ].length === 2 || 24..toString()) * (false < 3))));
                    {
                        var brake7 = 5;
                        while ((c = 1 + c, (3 - -1, -5 * []) === (4 < true ^ Infinity << 22)) && --brake7 > 0) {
                            c = 1 + c, ([ , 0 ].length === 2) - "" << ("function" << undefined) && (c = c + 1, 
                            38..toString() === ([ , 0 ].length === 2));
                        }
                    }
                }
                var a = f6(a, 24..toString()).next();
                function f7(foo, let_2) {
                    {
                    }
                    switch (c = 1 + c, (22 ^ "") * (Infinity > 0) <= (2 !== 2 === (Infinity != -5))) {
                      case c = 1 + c, void ((NaN || "function") * (22 ^ 3)):
                        ;
                        break;

                      case c = 1 + c, (true == {}) + (23..toString() || "foo") !== ("foo" != -1) > (1 === NaN):
                        ;

                      case c = 1 + c, (foo = 2 >> /[a2][^e]+$/ >> (0 ^ 22)) === ((24..toString() || "bar") === ("c" === -5)):
                        ;
                        break;

                      default:
                        ;
                    }
                }
                var b = f7(a++ + (typeof b_1 == "function"));
                function f8(let_2_2_2) {
                    {
                        var expr11 = [ (c = 1 + c, let_2_2 && (let_2_2.b = (3 > null, 
                        "number" == null) <= ((-3 === null) < (/[a2][^e]+$/ > 3)))), (c = 1 + c, 
                        delete 3 - (25 || {}) > (-0 <= 5) + (Infinity !== 5)), (c = 1 + c, 
                        (/[a2][^e]+$/ - false && 0 & -4) ^ (-5 !== "foo" ^ +0)), (c = 1 + c, 
                        (("number" == "foo") >= (let_2 += "foo" ^ true)) - ((3, 
                        25) >> (2 >>> -0))) ];
                        L12100: for (var key11 of expr11) {
                            c = 1 + c;
                            var await_1 = expr11[key11];
                            c = 1 + c, (await_1 >>= (25 ^ true) != [] << "foo") >> (undefined && (undefined[[ (c = 1 + c, 
                            (25 < NaN || true * false) ^ ((yield_1 && (yield_1[c = 1 + c, 
                            0 / NaN >> (-2 >= "number") >>> ((c = c + 1, "") > undefined >>> "a")] -= 25 === -3)) ^ 22 <= 0)) ].next] = ([ , 0 ][1] + 23..toString()) * (-1 == "c")));
                        }
                    }
                    return;
                }
                var foo_1 = f8("bar");
            }(a++ + (([ [ NaN_1, , a_2_2 ], b_1, a_2 ], arguments_2, b_2 = 4) => {
                (c = c + 1) + (NaN_1 && NaN_1[typeof undefined_2 !== "string"]);
            })([ [ a++ + ((false - -0) / (22 === this) == (undefined = NaN <= "bar" ^ "foo" / -2)), --b + ((c = c + 1) + (typeof f2 == "function" && --_calls_ >= 0 && f2()) || a || 3).toString(), 24..toString() ], undefined ]), "c");
        }
        c = c + 1;
        return typeof b_2;
    }
    c = c + 1;
}

var a = f0(--b + (("c" & 22) == (5 == 4)) * ({} < 25 && this & 5), a++, --b + b--).next().value;

console.log(null, a, b, c, Infinity, NaN, undefined);
// uglified code
// (beautified)
var n = 10, t = 100, e = 10, i = 0, t = function* f0(undefined, let_2) {
    for (var o, f = 5; (i += 1) + void 0 && 0 < --f; ) {}
    return function f1(let_2_2, yield_1 = 0, foo) {
        (function* f6() {
            i = 1 + i, foo && (foo.get &= !0 * (2 === [ , 0 ].length || "24"));
            for (var o = 5; i = 1 + i, 0 < --o; ) {
                i = 1 + i, (2 === [ , 0 ].length) - "" << 0 && (i += 1);
            }
        })().next(), function f7(foo, let_2) {
            i = 1 + (i = 1 + (i = 1 + (i = 1 + i)));
        }(), function f8(let_2_2_2) {
            var o;
            for (o of [ (i = 1 + i, let_2_2 && (let_2_2.b = !0)), !1, 1, (i = 1 + (i = 1 + (i = 1 + i)), 
            ((let_2 += 1) <= !1) - 6) ]) {
                i = 1 + i, i = 1 + i;
            }
        }();
    }(t++ + (([ [ [ o ] ], , b_2 = 0 ] = [ [ [ t++ + (0 / (22 === this) == 0), --e + ((i += 1) + ("function" == typeof f2 && 0 <= --n && f2()) || t || 3).toString(), "24" ], 0 ] ]), 
    i += 1, void (o && o["string" != typeof undefined_2])), "c"), i += 1, typeof b_2;
}(--e, t++, (--e, e--)).next().value;

console.log(null, t, e, i, Infinity, NaN, void 0);
original result:
null undefined 6 34 Infinity NaN undefined

uglified result:
null number 6 34 Infinity NaN undefined
// reduced test case (output will differ)

// (beautified)
function* f0() {
    (([], b_2 = 0) => {})([]);
    return b_2;
}

f0().next();
// output: ReferenceError: b_2 is not defined
// minify: 
// options: {
//   "compress": {
//     "hoist_vars": true,
//     "keep_infinity": true,
//     "passes": 1000000,
//     "unsafe": true
//   },
//   "keep_fargs": true,
//   "keep_fnames": true,
//   "toplevel": true,
//   "output": {
//     "v8": true
//   },
//   "validate": true
// }
minify(options):
{
  "compress": {
    "hoist_vars": true,
    "keep_infinity": true,
    "passes": 1000000,
    "unsafe": true
  },
  "keep_fargs": true,
  "keep_fnames": true,
  "toplevel": true,
  "output": {
    "v8": true
  }
}

Suspicious compress options:
  inline
  unused

Suspicious options:
  keep_fargs
@alexlamsl alexlamsl added the bug label Jul 1, 2022
alexlamsl added a commit to alexlamsl/UglifyJS that referenced this issue Jul 1, 2022
alexlamsl added a commit to alexlamsl/UglifyJS that referenced this issue Jul 1, 2022
alexlamsl added a commit that referenced this issue Jul 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant