Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ufuzz failure #5892

Closed
alexlamsl opened this issue Jul 25, 2024 · 0 comments · Fixed by #5893
Closed

ufuzz failure #5892

alexlamsl opened this issue Jul 25, 2024 · 0 comments · Fixed by #5893
Labels

Comments

@alexlamsl
Copy link
Collaborator

// original code
// (beautified)
var _calls_ = 10, a = 100, b = 10, c = 0;

function f0(b_2, b_1, a_1) {
    try {
        try {
            {
                var brake3 = 5;
                do {
                    for (var brake4 = 5; b_1 && typeof b_1.value == "function" && --_calls_ >= 0 && b_1.value(false, -4) && brake4 > 0; --brake4) {}
                } while (a++ + (typeof f1 == "function" && --_calls_ >= 0 && f1()) && --brake3 > 0);
            }
        } catch (yield_2) {} finally {
            {
                var expr6 = --b + /[abc4]/g.exec((a++ + ({
                    get then() {
                        c = 1 + c, (Number(0xdeadn << 16n | 0xbeefn) !== 23..toString()) / (5 == -1) | (false != 0) / (c = c + 1, 
                        "a");
                        return c = 1 + c, "undefined" * NaN & this >= ([ , 0 ].length === 2) & (a_1 && (a_1.a = (c = c + 1, 
                        2) ^ 22 > -0));
                    }
                }.b || a || 3).toString() || b || 5).toString());
                L26173: for (var key6 in expr6) {
                    c = 1 + c;
                    var a_2 = expr6[key6];
                    {
                        c = c + 1;
                    }
                }
            }
            for (var brake11 = 5; (c = c + 1) + (b_1 && typeof b_1.length == "function" && --_calls_ >= 0 && (/[abc4]/.test((((c = c + 1) + (false in [ (c = 1 + c, 
            3 <= ([ , 0 ].length === 2) && /[a2][^e]+$/ <= -0, (this ^ {}) < ("object" >= "bar")), (c = 1 + c, 
            ([] + "foo", false !== {}) || (c = c + 1, 1 > 1)) ]) || 3).toString()[a++ + b_1?.a] || b || 5).toString()), 
            b_1.length)(a_1 && a_1.value, "c")) && brake11 > 0; --brake11) {
                c = c + 1;
            }
        }
    } finally {
        L26174: {
            {
                var brake14 = 5;
                L26175: do {
                    L26176: {}
                } while (a++ + b-- && --brake14 > 0);
            }
            for (var brake16 = 5; (c = c + 1) + a_1 && brake16 > 0; --brake16) {
                if (b_1 && typeof b_1.NaN == "function" && --_calls_ >= 0 && b_1.NaN(typeof b_1 == "function" && --_calls_ >= 0 && b_1(), 1)) {
                    switch ([]) {
                      case (a++ + /[abc4]/.test(((c = 1 + c, ("object" ?? 38..toString()) <= "c" - 1 <= (-4 >>> true && 22 >= Infinity)) || b || 5).toString()) || 1).toString()[typeof f1 == "function" && --_calls_ >= 0 && f1()]:
                      case b_2 && typeof b_2.next == "function" && --_calls_ >= 0 && b_2.next(1, ..."" + b_2, 4):
                        break;

                      case 0 === 1 ? a : b:
                        switch (c = 1 + c, (c = c + 1, Infinity | NaN) ^ (-4 + -5 ^ true !== 25)) {
                          case c = 1 + c, ("foo" ^ 38..toString()) <= ("number" < 24..toString()) >= (NaN && -2) * ("number" | 2):
                            ;
                            break;

                          case c = 1 + c, (b_2 && (b_2.then += 5 != "function")) - (!0o644n >= 25) === (a_1 && (a_1.null += (-3 || "a") + this / true)):
                            ;
                            break;

                          case c = 1 + c, (b_1 += +3 > "number" * []) | (22 & "number") >>> 0 - "foo":
                            ;
                            break;

                          case c = 1 + c, (25 ^ 22 | -0 >>> "") < ((4 & 1) != (25 !== "c")):
                            ;
                            break;
                        }
                        break;

                      case --b + (b_1 && b_1.done):
                        L26177: {
                        }
                        {
                        }
                        break;
                    }
                } else {
                    return;
                }
            }
            switch (--b + ++a) {
              case a++ + (b = a):
                break;

              case a++ + (25 in {
                    null: a_1,
                    foo: b++,
                    ["bar"]: -0 in [],
                    static: typeof f1 == "function" && --_calls_ >= 0 && f1((c = 1 + c, 
                    +("" << ([ , 0 ].length === 2) === 0 << "c")))
                }):
                --a;
                c = c + 1;
                return (c = c + 1) + (b += a);
                break;

              case (c = c + 1) + ((true & 1) === ("object" | 1) != +(a_1 += Infinity === 1)):
                {
                    var brake27 = 5;
                    do {
                        try {
                            {
                                var expr29 = (c = 1 + c, (23..toString() ^ 3) >> (-1 <= 23..toString()) !== ([] > -5 ^ (-3 ^ "bar")));
                                for (var [ key29 ] in expr29) {
                                    c = 1 + c;
                                    var arguments_2 = expr29[key29];
                                    c = 1 + c, (true, {}) !== -4 - /[a2][^e]+$/ !== (Infinity >> [] !== "a" >= 0);
                                }
                            }
                        } finally {
                            c = 1 + c, (a_1 = "bar" !== 24..toString()) <= [] - 22 || (b_1 = (38..toString() ^ -3) != (c = c + 1, 
                            /[a2][^e]+$/));
                        }
                    } while ((c = c + 1) + a_1 && --brake27 > 0);
                }
                (c = c + 1) + ++a;
                break;

              case --b + (a_1 = ((c = c + 1) + false || a || 3).toString()):
                {
                    var brake33 = 5;
                    while ((c = c + 1) + (0 in {
                        get: (c = 1 + c, +((23..toString() != false) > /[a2][^e]+$/ / "")),
                        undefined: (c = 1 + c, (-0 | [ , 0 ][1]) / (-1 ^ -2), ("foo" === "function") + ("bar" <= true)),
                        undefined: (c = 1 + c, ("function" ^ "object") / (b_1 && (b_1.undefined = -1 ?? false)) | ("a" < 4 || (0 || "b")))
                    }) && --brake33 > 0) {
                        b_1 = (c = 1 + c, "undefined" >> -2 == ([ , 0 ].length === 2 && undefined) & (a_1 && (a_1[c = 1 + c, 
                        (c = c + 1, "c") > (/[a2][^e]+$/ <= -1) ^ ("b" > "object") - (a_1 && (a_1[c = 1 + c, 
                        b_1 &= (a_1 && (a_1.static = "number" == null)) + (null ^ []) === (0 * -3 !== (a_1 += "b" == -0))] = null + "undefined"))] = -5 ^ [ , 0 ][1])) << ("number" !== "bar"));
                    }
                }
                break;
            }
            {
                if (--b + ((b_2 && ({
                    "": b_2.set
                } = {
                    "": null % "b"
                })) ^ 3 != {}) / (([ , 0 ].length === 2) << 24..toString() & "bar" >>> Infinity)) {
                    c = c + 1;
                }
                switch (--b + (a++ + void ((a_1 += null ^ "foo" ^ -4 >= NaN) | ("object" + 4) / (25 !== NaN)) ? --b + ((c = 1 + c, 
                ((b_2 && (b_2[c = 1 + c, ((undefined ?? "c") ^ [] >= 38..toString()) - ([] >> undefined, 
                null === undefined)] **= "c" >>> -3)) <= (0 !== 23..toString())) << ((a_1 && (a_1[c = 1 + c, 
                (2 << "object" | "bar" <= false) >> ("b" && -2) / ("number" ^ "")] = -0 + 22)) < "bar" - "object")) || 1).toString()[c = 1 + c, 
                (b_1 = -0 || 23..toString()) >> ("foo" << {}) <= (NaN - ([ , 0 ].length === 2) | delete "object")] : [ ..."" + b_1, (c = 1 + c, 
                (c = c + 1, 25 * -4) + ((25 | null) === ("function" || 24..toString()))) ])) {
                  case (c = c + 1) + ({} << 38..toString() >>> ("b" > this) ^ ("b" >= "b") % (null <= 38..toString())):
                    {
                        var brake39 = 5;
                        while ((c = 1 + c, a_1 && (a_1.c = (c = c + 1, "foo" > 1) === (22 || -0 || 38..toString() > "undefined"))) && --brake39 > 0) {
                            c = 1 + c, ("function" == 3 === (23..toString() === 23..toString())) - ((a_1 && (a_1[c = 1 + c, 
                            (({} != 38..toString()) > (a_1 && (a_1.then = 5 <= -2))) << ("undefined" >> {}) - ("a", 
                            -1)] = "a" * "bar")) + (true >>> 5));
                        }
                    }

                  case (((c = 1 + c, (b_2 && (b_2.var |= ("object" / -2, undefined ?? Infinity))) / ((b_2 = "undefined" === []) >>> (a_1 && (a_1[c = 1 + c, 
                    (+!0o644n >= (38..toString() ?? {})) + (a_1 && (a_1[(c = c + 1) + (b_1 && typeof b_1.null == "function" && --_calls_ >= 0 && b_1.null())] = (2 >>> 2, 
                    5 | this)))] = 5 <= 23..toString())))) ? (c = 1 + c, (b_1 && (b_1.Infinity = (this ?? -4) != ("b" && [ , 0 ].length === 2))) >> -1 % 1 % ("number" & [])) : (c = 1 + c, 
                    (b_1 && (b_1.async **= (/[a2][^e]+$/ ^ -1) % (-1 << /[a2][^e]+$/))) != -0 - "b" << (b_1 >>>= "bar" + -5))) || a || 3).toString():
                    {
                        var expr41 = (c = 1 + c, void (a_1 &= -4 ^ "foo") ^ -0 <= Infinity === [ , 0 ][1] - false);
                        for (var key41 in expr41) {
                            c = 1 + c, (key41 && (key41.get = ("function" - "", 
                            "a" != undefined))) - ((22 ^ this) >> ([ , 0 ].length === 2 == 1));
                        }
                    }
                    ;
                    var bar_1 = (c = 1 + c, (23..toString() * 24..toString() & "a" / null) > (c = c + 1, 
                    -5 ^ "c")), foo_2 = (c = 1 + c, c = c + 1, b_2 && (b_2.set += (38..toString() ^ 5) + (b_2 && (b_2.set = Infinity < "c"))));

                  default:
                    {
                    }
                    L26178: for (var brake46 = 5; (c = 1 + c, (bar_1 && (bar_1[--b + !function() {
                    }()] %= -4 >>> ([ , 0 ].length === 2) ^ (foo_2 = [ , 0 ][1] >>> null))) > (!25 != 25 * {})) && brake46 > 0; --brake46) {
                        c = 1 + c, ("a" - "object" < (c = c + 1, -0)) % (b_2 && (b_2[a++ + a_1] = (5 ^ "foo") != (bar_1 && (bar_1.var += [] == NaN))));
                    }

                  case [ (c = 1 + c, (-3 != ([ , 0 ].length === 2) | (Infinity ?? undefined)) & (b_1 && (b_1.a += (b_1 && (b_1.next = (5, 
                    3))) ^ false < 38..toString()))) ].get:
                    {
                        var brake48 = 5;
                        do {
                            c = 1 + c, Infinity > 24..toString() < [] << this === (-3 >= null) >>> (-5 === -4);
                        } while ((c = 1 + c, (c = c + 1, 24..toString() | 38..toString()) * ((true, 
                        3) << 24..toString() * 2)) && --brake48 > 0);
                    }
                    break;
                }
            }
        }
        (c = c + 1) + (a_1 && typeof a_1.undefined == "function" && --_calls_ >= 0 && a_1.undefined``);
    }
}

var c_2 = f0({});

console.log(null, a, b, c, Infinity, NaN, undefined);
// uglified code
// (beautified)
var s, u = 100, h = s = 10, g = 0;

(function f0(b_2, b_1, a_1) {
    var _, a, n, t, e, b, i, f, o, c, r;
    try {
        try {
            _ = 5;
            do {
                for (a = 5; b_1 && "function" == typeof b_1.value && 0 <= --s && b_1.value(!1, -4) && 0 < a; --a) {}
            } while (u++ + ("function" == typeof f1 && 0 <= --s && f1()) && 0 < --_);
        } catch (_) {} finally {
            for (n in --h + /[abc4]/g.exec((u++ + ({
                get then() {
                    return g = 1 + g, g = 1 + (g += 1), NaN & (2 === [ , 0 ].length) <= this & (a_1 && (a_1.a = !0 ^ (g += 1, 
                    2)));
                }
            }.b || u || 3).toString() || h || 5).toString())) {
                g = 1 + g, g += 1;
            }
            for (t = 5; (g += 1) + (b_1 && "function" == typeof b_1.length && 0 <= --s && ((("" + ((g += 1) + (!1 in [ (this ^ {}) < !0, (g = 1 + (g = 1 + g), 
            !0) ]) || 3))[u++ + b_1?.a] || h || 5).toString(), b_1.length)(a_1 && a_1.value, "c")) && 0 < t; --t) {
                g += 1;
            }
        }
    } finally {
        for (e = 5; u++ + h-- && 0 < --e; ) {}
        for (b = 5; (g += 1) + a_1 && 0 < b; --b) {
            if (!(b_1 && "function" == typeof b_1.NaN && 0 <= --s && b_1.NaN("function" == typeof b_1 && 0 <= --s && b_1(), 1))) {
                return;
            }
            switch ([]) {
              case ("" + (u++ + /[abc4]/.test((g = 1 + g, "" + !0)) || 1))["function" == typeof f1 && 0 <= --s && f1()]:
              case b_2 && "function" == typeof b_2.next && 0 <= --s && b_2.next(1, ..."" + b_2, 4):
                break;

              case h:
                switch (g = 1 + g, -10) {
                  case g = 1 + (g = 1 + (g += 1)), (b_2 && (b_2.then += !0)) - (25 <= !0o644n) === (a_1 && (a_1.null += this / !0 - 3)):
                  case g = 1 + g, 0 | (b_1 += !1):
                    break;

                  case g = 1 + g, !1:
                }
                break;

              case --h + (b_1 && b_1.done):
            }
        }
        switch (--h + ++u) {
          case u++ + (h = u):
            break;

          case u++ + (25 in {
                null: a_1,
                foo: h++,
                bar: -0 in [],
                static: "function" == typeof f1 && 0 <= --s && f1((g = 1 + g, +("" << (2 === [ , 0 ].length) == 0)))
            }):
            return g = g + 1 + 1, h += --u;

          case (g += 1) + (1 != +(a_1 += !1)):
            i = 5;
            do {
                try {
                    for (var [ l ] in g = 1 + g, !0) {
                        g = 1 + g, g = 1 + g;
                    }
                } finally {
                    g = 1 + g, a_1 = !0, b_1 = -37 != (g += 1, /[a2][^e]+$/);
                }
            } while ((g += 1) + a_1 && 0 < --i);
            g += 1, ++u;
            break;

          case --h + (a_1 = ((g += 1) + !1 || u || 3).toString()):
            for (f = 5; (g += 1) + (0 in {
                get: 0,
                undefined: 0,
                undefined: (g = 1 + (g = 1 + (g = 1 + g)), 0 / (b_1 && (b_1.undefined = -1)) | "b")
            }) && 0 < --f; ) {
                g = 1 + g, b_1 = 0 == (2 === [ , 0 ].length && void 0) & (a_1 && (a_1[g = 1 + g, 
                g += 1, !1 ^ !1 - (a_1 && (a_1[g = 1 + g, b_1 &= (a_1 && (a_1.static = !1)) + 0 === (-0 !== (a_1 += !1))] = "nullundefined"))] = -5)) << !0;
            }
        }
        switch (--h + (!0 ^ (b_2 && ({
            "": b_2.set
        } = {
            "": NaN
        }))) / ((2 === [ , 0 ].length) << "24" & 0) && (g += 1), --h + (u++ + void (a_1 += 0) ? --h + (g = 1 + g, 
        ("" + (((b_2 && (b_2[g = 1 + g, 0] **= 0)) <= !0) << ((a_1 && (a_1[g = 1 + g, 
        2] = 22)) < NaN) || 1))[g = 1 + g, (b_1 = "23") >> 0 <= (NaN - (2 === [ , 0 ].length) | !0)]) : [ ..."" + b_1, (g = 1 + g, 
        g += 1, -100) ])) {
          case (g += 1) + (0 >>> (this < "b") ^ 0):
            for (;g = 1 + g, a_1 && (a_1.c = 22 === (g += 1, !1)); ) {
                g = 1 + g, a_1 && (a_1[g = 1 + g, ((a_1 && (a_1.then = !1)) < !0) << 1] = NaN);
            }

          case g = 1 + g, (((b_2 && (b_2.var |= Infinity)) / ((b_2 = !1) >>> (a_1 && (a_1[g = 1 + g, 
            ("38" <= +!0o644n) + (a_1 && (a_1[(g += 1) + (b_1 && "function" == typeof b_1.null && 0 <= --s && b_1.null())] = 5 | this))] = !0))) ? (g = 1 + g, 
            (b_1 && (b_1.Infinity = (this ?? -4) != (2 === [ , 0 ].length))) >> NaN) : (g = 1 + g, 
            (b_1 && (b_1.async **= -0)) != NaN << (b_1 >>>= "bar-5"))) || u || 3).toString():
            for (o in g = 1 + g, a_1 &= -4, 0) {
                g = 1 + g, o && (o.get = !0);
            }
            g = 1 + g, g = 1 + (g += 1), g += 1, b_2 && (b_2.set += 35 + (b_2 && (b_2.set = !1)));

          default:
            for (c = 5; g = 1 + g, !0 < ((!0)[--h + !0] %= -4 >>> (2 === [ , 0 ].length) ^ 0) && 0 < c; --c) {
                g = 1 + g, g += 1, b_2 && (b_2[u++ + a_1] = 5 != ((!0).var += !1));
            }

          case [ (g = 1 + g, (-3 != (2 === [ , 0 ].length) | Infinity) & (b_1 && (b_1.a += !0 ^ (b_1 && (b_1.next = 3))))) ].get:
            for (r = 5; g = 1 + (g = 1 + g), g += 1, 0 < --r; ) {}
        }
        g += 1, a_1 && "function" == typeof a_1.undefined && 0 <= --s && a_1.undefined``;
    }
})({}), console.log(null, u, h, g, Infinity, NaN, void 0);
original result:
null 115 111 30 Infinity NaN undefined

uglified result:
null 115 110 30 Infinity NaN undefined
// reduced test case (output will differ)

// (beautified)
switch (0) {
  case 1:
    var bar_1 = 0;

  default:
    bar_1[0];
}
// output: TypeError: Cannot read properties of undefined (reading '0')
// minify: 
// options: {
//   "compress": {
//     "hoist_vars": true,
//     "keep_infinity": true,
//     "passes": 1000000,
//     "unsafe": true
//   },
//   "keep_fargs": true,
//   "keep_fnames": true,
//   "module": false,
//   "toplevel": true,
//   "output": {
//     "v8": true
//   },
//   "validate": true
// }
minify(options):
{
  "compress": {
    "hoist_vars": true,
    "keep_infinity": true,
    "passes": 1000000,
    "unsafe": true
  },
  "keep_fargs": true,
  "keep_fnames": true,
  "module": false,
  "toplevel": true,
  "output": {
    "v8": true
  }
}

Suspicious compress options:
  evaluate
  passes
  reduce_vars
  unsafe
  unused
@alexlamsl alexlamsl added the bug label Jul 25, 2024
alexlamsl added a commit to alexlamsl/UglifyJS that referenced this issue Jul 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant