Bug: redefining `NaN` in `finally` (?)

[pvdz]

• Bug report or feature request?
  Bug. Found by fuzzer. Clearly.
  Potentially an ES6 scope issue.

• uglify-js version (uglifyjs -V)
  Git master, just pulled before submitting.

This one was a little odd because I couldn't repro it from the originally constructed source, but I could from its own minified output. Eh, whatever. I don't really know what's actually going on here but removing any piece of the remaining code makes the bug disappear. Renaming the var does too.

var a = 0;
var i = 5;
do {
  try {
  } finally {
    var NaN = --a;
  }
} while (NaN && --i > 0)
console.log(a);

$ bin/uglifyjs s.js -c
var a=0,i=5;do{try{}finally{var NaN=--a}}while(NaN&&--i>0);console.log(a);

$ node s.js && bin/uglifyjs s.js -c | node
-5
-1

[alexlamsl]

This one, well, it's weird because, erm, even without uglify-js:

$ node test.js
-5

$ cat test.js | node
-1

[pvdz]

Haha. Okay, well played. A Heisenbug?

[alexlamsl]

Not very Heisenburg-like if it's readily reproducible. The headache for me is that this happens on Node.js 0.10, 0.12, 4, 6 and even chakracore. So this is not an issue with the JavaScript engine.

[alexlamsl]

May be the scoping for evaluation of file versus stdin is different for the node executable?

[pvdz]

Okay true.

May be the scoping for evaluation of file versus stdin is different for the node executable?

A module thing? REPL (or whatever) vs file could be a thing, sure. Although I'm not aware of any reason in the context of the actual source here.

I'll consult the twitters and see if anybody has an answer.

[alexlamsl]

Or may be file a bug with https://github.com/nodejs/node/issues ?

[pvdz]

Confirmed. It's a module system artifact. nodejs/node#12052 (comment)

[alexlamsl]

Cool. So we just make sure to be careful when we fuzz uglify-js then. 😏