Bad output generated by 3.4.9.

[blvd20]

Bug report

Uglify version (3.4.9)

JavaScript input (The source is from protobufjs. )

function utf8_write(string, buffer, offset) {
  var start = offset,
    c1, // character 1
    c2; // character 2
  for (var i = 0; i < string.length; ++i) {
    c1 = string.charCodeAt(i);
    if (c1 < 128) {
      buffer[offset++] = c1;
    } else if (c1 < 2048) {
      buffer[offset++] = c1 >> 6 | 192;
      buffer[offset++] = c1 & 63 | 128;
    } else if ((c1 & 0xFC00) === 0xD800 && ((c2 = string.charCodeAt(i + 1)) & 0xFC00) === 0xDC00) {
      c1 = 0x10000 + ((c1 & 0x03FF) << 10) + (c2 & 0x03FF);
      ++i;
      buffer[offset++] = c1 >> 18 | 240;
      buffer[offset++] = c1 >> 12 & 63 | 128;
      buffer[offset++] = c1 >> 6 & 63 | 128;
      buffer[offset++] = c1 & 63 | 128;
    } else {
      buffer[offset++] = c1 >> 12 | 224;
      buffer[offset++] = c1 >> 6 & 63 | 128;
      buffer[offset++] = c1 & 63 | 128;
    }
  }
  return offset - start;
};

JavaScript output

function utf8_write(r, t, e) {
  for (var n, o, a = e, c = 0; c < r.length; ++c)
    n = r.charCodeAt(c),
      t[e++] = n < 128 ? n : (t[e++] = n < 2048 ? n >> 6 | 192 : (55296 == (64512 & n) && 56320 == (64512 & (o = r.charCodeAt(c + 1))) ? (n = 65536 + ((1023 & n) << 10) + (1023 & o),
        ++c,
        t[e++] = n >> 18 | 240,
        t[e++] = n >> 12 & 63 | 128) : t[e++] = n >> 12 | 224,
        n >> 6 & 63 | 128),
        63 & n | 128);
  return e - a
}

The first e++ is wrong.
The output generated by 3.4.8 is fine.

function utf8_write(r, t, e) {
  for (var n, o, a = e, c = 0; c < r.length; ++c)
    (n = r.charCodeAt(c)) < 128 ? t[e++] = n : (n < 2048 ? t[e++] = n >> 6 | 192 : (55296 == (64512 & n) && 56320 == (64512 & (o = r.charCodeAt(c + 1))) ? (n = 65536 + ((1023 & n) << 10) + (1023 & o),
      ++c,
      t[e++] = n >> 18 | 240,
      t[e++] = n >> 12 & 63 | 128) : t[e++] = n >> 12 | 224,
      t[e++] = n >> 6 & 63 | 128),
      t[e++] = 63 & n | 128);
  return e - a
}

[kzc]

With the following lines appended to the input in the top post:

var arr = [];
var size = utf8_write("¯\\_(ツ)_/¯", arr, 0);
console.log(size, JSON.stringify(arr));

Expected:

$ cat input.js | node
13 '[194,175,92,95,40,227,131,132,41,95,47,194,175]'

Actual:

$ uglify-js -V
uglify-js 3.4.9

$ cat input.js | uglify-js -c | node
13 '[175,194,92,95,40,132,131,227,41,95,47,175,194]'

Workaround:

$ cat input.js | uglify-js -c conditionals=0 | node
13 '[194,175,92,95,40,227,131,132,41,95,47,194,175]'

[blvd20]

How about remove this version from NPM ?

[lukeapage]

Is this the same bug? or should I open a new issue?

A problem with lodash slice when called with no length argument to clone an array

function slice(array, start, end) {
  var length = array == null ? 0 : array.length;
  if (!length) {
    return [];
  }
  if (end && typeof end != 'number' && isIterateeCall(array, start, end)) {
    start = 0;
    end = length;
  }
  else {
    start = start == null ? 0 : toInteger(start);
    end = end === undefined ? length : toInteger(end);
  }
  return baseSlice(array, start, end);
}

becomes

                function slice(t, e, n) {
                    var r = null == t ? 0 : t.length;
                    return r ? Ie(t, e, n = n && "number" != typeof n && Vn(t, e, n) ? (e = 0,
                    r) : (e = null == e ? 0 : Wi(e),
                    n === ea ? r : Wi(n))) : []
                }

Now, if e = undefined, then the assignment is moved to inside the parameters, but after the e param

e.g. uglify assumes

function a(b, c) { console.log(b, c); } var d = undefined, e = 1; a(d, e = d = 2);

answers

2
2

but it doesn't - it answers

undefined
2

[fabiosantoscode]

It looks like this error does not affect the terser fork.

[kzc]

conditionals bug introduced in 2bdaca1, ce7e220.

[pedrofurtado]

#3278

[neelance]

Edit: See #3278 (comment) and following.

[blvd20]

@mishoo Are you still maintaining this project? Seems this version causing problems all the time since your last release.