René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Non-deterministic `?.()` miscompile drops short-circuit on captured variable in nested closure","articleBody":"With `controlFlowFlattening: true`, the obfuscator non-deterministically miscompiles optional-call expressions of the shape `captured?.(arg)` — where `captured` is an outer-scope variable referenced inside a nested closure. On some random seeds the `?.` short-circuit is dropped, and the obfuscated code calls `undefined` as a function, throwing `TypeError: \u003cX\u003e is not a function`. The bug reproduces on roughly 5% of obfuscation runs with identical input and identical options, on both `5.4.1` and `5.4.2`. Four other shapes of optional call exercised in the attached reproducer (object property, awaited, `this.member`, chained `?.`) never reproduce — only the captured-variable-in-nested-closure shape is affected.\n\n## Expected Behavior\nThe obfuscated output should preserve the runtime semantics of the input. For `fn?.(arg)`, that means evaluating to `undefined` when `fn` is `undefined` (the `?.` short-circuit), with no call performed.\n\n## Current Behavior\nOn some random seeds, the obfuscator rewrites `captured?.(arg)` — where `captured` is an outer-scope variable referenced inside a nested closure — in a way that drops the `?.` short-circuit and invokes the undefined value as a function. The obfuscated code throws `TypeError: \u003cobfuscated-name\u003e is not a function` at runtime instead of short-circuiting to `undefined`.\n\nThe miscompile is non-deterministic across runs with identical input and identical options because the obfuscator picks a fresh random seed per invocation. Only some seeds trigger it. Across 200 iterations on the attached reproducer, the failure rate is **10/200 (5.0%)** on both `5.4.1` and `5.4.2`.\n\nThe bug is narrowly shape-specific: across the same 200 iterations, four other optional-call shapes (`obj.handler?.()`, `await cb?.()`, `this.cb?.()`, chained `obj.inner?.handler?.()`) **never** reproduce. Only the captured-variable-in-nested-closure shape is affected.\n\n\n## Steps to Reproduce\n1. Save the file in [Minimal working example](#minimal-working-example-that-will-help-to-reproduce-issue) below as `standalone.mjs`.\n2. `npm install javascript-obfuscator`\n3. `node standalone.mjs 200`\n\nExpected output: all 200 iterations pass.\nActual output:\n\n```\n=== Summary over 200 iterations ===\nruns with any failure: 10/200 (5.0%)\n  shape1: 10/200 fail (5.0%) — example: THROW: _0x40002d is not a function\n  shape2: 0/200 fail (0.0%)\n  shape3: 0/200 fail (0.0%)\n  shape4: 0/200 fail (0.0%)\n  shape5: 0/200 fail (0.0%)\n```\n\nThe script prints the path to a tmp directory at the end; failing iterations' obfuscated bytes are kept there for inspection.\n\n## JavaScript Obfuscator Edition\n- [x] JavaScript Obfuscator Open Source\n- [ ] JavaScript Obfuscator Pro via API or [http://obfuscator.io](http://obfuscator.io)\n\n## Your Environment\n* Obfuscator version used: **5.4.2** (also reproduces identically on `5.4.1`)\n* Node version used: **23.x**\n* OS: macOS (darwin ARM64), but the bug is not platform-specific — the obfuscator is fed deterministic input bytes and produces non-deterministic output regardless of host.\n\n# Stack trace\nThe throw site as it appears in the obfuscated output of a failing iteration (function names are seed-dependent, but the shape is consistent):\n```\nTypeError: _0x40002d is not a function\n    at \u003canonymous\u003e (source.17.mjs:1:NNNN)    // inner closure body, where `captured?.(msg)` should have short-circuited\n    at main (harness.17.mjs:1:NNN)\n```\nNote: with `controlFlowFlattening: true` the surrounding call stack is flattened through dispatch-table dispatchers, so additional frames may appear depending on the seed. The throw itself is always at the optional-call site.\n\n## Minimal working example that will help to reproduce issue\nAlso available as a gist: \u003chttps://gist.github.com/Thorsten-Kd/5b2a0b33932dc7534f827bd6dd5b41c5\u003e\n`standalone.mjs` — self-contained, only depends on `javascript-obfuscator`:\n\n```js\nimport { spawnSync } from 'node:child_process';\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\n\nimport JavaScriptObfuscator from 'javascript-obfuscator';\n\nconst ITERATIONS = parseInt(process.argv[2] ?? '200', 10);\n\nconst OBFUSCATION_OPTIONS = {\n  compact: true,\n  controlFlowFlattening: true,\n  controlFlowFlatteningThreshold: 1.0,\n  deadCodeInjection: true,\n  deadCodeInjectionThreshold: 1.0,\n  identifierNamesGenerator: 'hexadecimal',\n  log: false,\n  numbersToExpressions: true,\n  selfDefending: false,\n  simplify: false,\n  splitStrings: true,\n  splitStringsChunkLength: 5,\n  stringArray: true,\n  stringArrayCallsTransformThreshold: 1.0,\n  stringArrayEncoding: ['base64'],\n  stringArrayIndexShift: true,\n  stringArrayRotate: true,\n  stringArrayShuffle: true,\n  stringArrayThreshold: 1,\n  stringArrayWrappersChainedCalls: true,\n  stringArrayWrappersCount: 5,\n  target: 'node',\n  unicodeEscapeSequence: true,\n};\n\nconst SOURCE = `\n// Shape 1: captured outer-scope variable called via \\`?.()\\` inside a\n// nested closure. This is the shape that reliably reproduces the bug.\nexport function shape1() {\n  const captured = undefined;\n  const wrap = (msg) =\u003e {\n    captured?.(msg);\n    return 'ok';\n  };\n  return wrap('payload');\n}\n\nexport function shape2() {\n  const obj = {};\n  obj.handler?.('arg');\n  return 'ok';\n}\n\nexport async function shape3() {\n  const cb = undefined;\n  await cb?.();\n  return 'ok';\n}\n\nexport class Foo { run() { this.cb?.('arg'); return 'ok'; } }\nexport function shape4Run() { return new Foo().run(); }\n\nexport function shape5() {\n  const obj = { inner: undefined };\n  obj.inner?.handler?.();\n  return 'ok';\n}\n\n// Padding so controlFlowFlattening has enough basic blocks to do\n// non-trivial rewiring. Tiny inputs sometimes don't trigger the\n// miscompile because the dispatch table CFF builds is too small.\nfunction noise(n) {\n  let acc = 0;\n  for (let i = 0; i \u003c n; i++) {\n    if (i % 2 === 0) acc += i;\n    else if (i % 3 === 0) acc -= i;\n    else acc ^= i;\n    if (acc \u003e 1000000) acc = 0;\n  }\n  return acc;\n}\nfunction processItems(items) {\n  const out = [];\n  for (const item of items) {\n    const tag = item.tag ?? 'untagged';\n    const value = item.value ?? 0;\n    if (tag === 'a') out.push(value * 2);\n    else if (tag === 'b') out.push(value + 10);\n    else out.push(value);\n  }\n  return out;\n}\nclass Store {\n  constructor() { this.data = new Map(); }\n  set(k, v) { this.data.set(k, v); }\n  get(k) { return this.data.get(k); }\n  has(k) { return this.data.has(k); }\n  *values() { for (const v of this.data.values()) yield v; }\n}\nexport function exercisePadding() {\n  noise(100);\n  processItems([{ tag: 'a', value: 1 }, { tag: 'b', value: 2 }, { value: 3 }]);\n  const s = new Store();\n  s.set('x', 1);\n  return s.has('x');\n}\n`;\n\nconst HARNESS_TEMPLATE = `\nimport { shape1, shape2, shape3, shape4Run, shape5, exercisePadding } from './SOURCE_PLACEHOLDER';\nasync function main() {\n  exercisePadding();\n  const results = { shape1: 'unset', shape2: 'unset', shape3: 'unset', shape4: 'unset', shape5: 'unset' };\n  try { results.shape1 = shape1(); } catch (e) { results.shape1 = 'THROW: ' + e.message; }\n  try { results.shape2 = shape2(); } catch (e) { results.shape2 = 'THROW: ' + e.message; }\n  try { results.shape3 = await shape3(); } catch (e) { results.shape3 = 'THROW: ' + e.message; }\n  try { results.shape4 = shape4Run(); } catch (e) { results.shape4 = 'THROW: ' + e.message; }\n  try { results.shape5 = shape5(); } catch (e) { results.shape5 = 'THROW: ' + e.message; }\n  console.log(JSON.stringify(results));\n}\nmain();\n`;\n\nconst tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'obf-repro-'));\nconsole.log(`workdir: ${tmpDir}`);\nconsole.log(`node: ${process.version}`);\n\nconst SHAPES = ['shape1', 'shape2', 'shape3', 'shape4', 'shape5'];\nconst failsByShape = Object.fromEntries(SHAPES.map((s) =\u003e [s, 0]));\nlet runsWithAnyFail = 0;\nconst examples = {};\n\nfor (let i = 1; i \u003c= ITERATIONS; i++) {\n  const obfPath = path.join(tmpDir, `source.${i}.mjs`);\n  const harnessPath = path.join(tmpDir, `harness.${i}.mjs`);\n  const obfuscated = JavaScriptObfuscator.obfuscate(SOURCE, OBFUSCATION_OPTIONS).getObfuscatedCode();\n  await fs.promises.writeFile(obfPath, obfuscated);\n  const harness = HARNESS_TEMPLATE.replace('SOURCE_PLACEHOLDER', `./source.${i}.mjs`);\n  await fs.promises.writeFile(harnessPath, harness);\n\n  const proc = spawnSync(process.execPath, [harnessPath], { encoding: 'utf-8', timeout: 10_000 });\n  let results;\n  try { results = JSON.parse(proc.stdout?.trim() ?? ''); }\n  catch {\n    runsWithAnyFail++;\n    console.log(`[${i}/${ITERATIONS}] FAIL (no JSON) stderr=${(proc.stderr ?? '').slice(0, 200)}`);\n    continue;\n  }\n  const failed = SHAPES.filter((s) =\u003e results[s] !== 'ok');\n  if (failed.length \u003e 0) {\n    runsWithAnyFail++;\n    for (const s of failed) {\n      failsByShape[s]++;\n      examples[s] ??= results[s];\n    }\n    console.log(`[${i}/${ITERATIONS}] FAIL ${failed.join(',')}`);\n  } else {\n    console.log(`[${i}/${ITERATIONS}] PASS`);\n    await fs.promises.unlink(obfPath);\n    await fs.promises.unlink(harnessPath);\n  }\n}\n\nconsole.log(`\\n=== Summary over ${ITERATIONS} iterations ===`);\nconsole.log(`runs with any failure: ${runsWithAnyFail}/${ITERATIONS} (${((runsWithAnyFail / ITERATIONS) * 100).toFixed(1)}%)`);\nfor (const s of SHAPES) {\n  const n = failsByShape[s];\n  console.log(`  ${s}: ${n}/${ITERATIONS} fail (${((n / ITERATIONS) * 100).toFixed(1)}%)${n \u003e 0 ? ` — example: ${examples[s].slice(0, 120)}` : ''}`);\n}\nconsole.log(`\\nbroken artifacts (if any) kept in: ${tmpDir}`);\n```\n\n## Suspected cause (speculation)\n\nTypeScript and modern JS engines lower `f?.(arg)` to a guarded call shape roughly equivalent to:\n\n```js\n(f === null || f === void 0) ? void 0 : f.call(undefined, arg)\n```\n\n`controlFlowFlattening` rewrites the ternary into a dispatch-table-keyed control flow graph. Under some random keyings, the dispatch branch corresponding to the `=== void 0` guard appears to collapse into the unguarded call — possibly during a dead-branch elimination pass that proves one arm \"unreachable\" using the wrong invariant. The fact that `simplify: false` does *not* prevent the miscompile rules out the simplify pass as the cause; the problem is in (or interacts with) `controlFlowFlattening` itself.\n","author":{"url":"https://github.com/Thorsten-Kd","@type":"Person","name":"Thorsten-Kd"},"datePublished":"2026-05-19T18:00:54.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/1408/javascript-obfuscator/issues/1408"}