Why is (([]===[])+/-/)[1] = 'a' and (1+{})[(1<<1)+1] = 'b' in javascript?

Question

Recently I came across an interesting website that illustrates a Javascript Obfuscator: http://bl.ocks.org/jasonsperske/5400283

For example, (([]===[])+/-/)[1] gives a and (1+{})[(1<<1)+1] gives b.

I have tried hard to understand the evaluation sequence of these obfuscated result but was in vain.

Taking (1+{})[(1<<1)+1] as an example, I understand that << is the bitwise shift operator and will return 2, so the expression becomes (1+{})[3]. But then I cannot understand what does it mean by 1+{} and [3].

Google isn't really helpful to this problem as search engines don't like the brackets or slashes very much, so in case there are duplicate questions I'm sorry about that.

The expression result is stringified, the indexes are used as charAt function for Strings. — Silviu Burcea, Aug 25 '14 at 08:09
Related: http://stackoverflow.com/questions/15978204/what-are-javascripts-builtin-strings — Qantas 94 Heavy, Aug 25 '14 at 09:17

Royi Namir · Accepted Answer · 2014-08-25T08:16:38.763

5

It's just obfuscation tricks.

for example :

[]===[] ===> false

and

([]===[])+/-/ ===> "false/-/" ( You could test it in the console by yourself)

So what is (([]===[])+/-/)[1] ? ( second char)

That's right :'a'

You may want to look at this also :

enter image description here

edited Aug 25 '14 at 08:16

answered Aug 25 '14 at 08:04

Royi Namir

144,742
138
468
792

1

But why `[]===[]` will give false? Aren't they identical null arrays? – Pingu Aug 25 '14 at 08:21
3

@Pingu You compare **references**. a new blank array has different address than another new blank array. – Royi Namir Aug 25 '14 at 08:22

xdazz · Answer 2 · 2014-08-25T08:11:31.327

1+{}'s result is a string "1[object Object]", (1+{})[3] is to get the char of index 3 which is b.

The first example:

[]===[] Comparing two different objects with ===, so the result is false, whose toString result is "false".

/-/ is a regex object, whose toString result is "/-/"

When you do false + /-/, which will concat using the result of .toString(), so the result will be "false/-/", and the second char is a.

score 3 · Answer 3 · answered Aug 25 '14 at 08:08

You could go step by step:

(([]===[]))

is simply false. Converted into a string "false/-/"and indexed by [1] gives you the a of the string "false".

The same goes for (1+{}) which results in the string "1[object Object]". And 1<<1+1 is another way of writing 3 so this results in "1[object Object]"[3], which is simply b.

Why is (([]===[])+/-/)[1] = 'a' and (1+{})[(1<<1)+1] = 'b' in javascript?

3 Answers3

Linked