cfsolve 0.1.1 → 0.1.2

data/vendor/cfsolve/src/stage2/audit_globals.rs

@@ -0,0 +1,310 @@
+//! Pairs iframe globals by their definitions, independently of randomized identifiers.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use anyhow::Result;
+use serde::{Deserialize, Serialize};
+use swc_core::ecma::ast::{AssignExpr, AssignTarget, Expr, Lit, MemberExpr, SimpleAssignTarget};
+use swc_core::ecma::visit::{Visit, VisitWith};
+use url::Url;
+
+use super::vocabulary;
+use crate::challenge::installed::Installed;
+use crate::challenge::program::PreparedSession;
+use crate::js::ast;
+use crate::script::Source;
+
+/// A bag of syntax and browser API features. Local variable names, statement order, numeric
+/// constants, and session names do not participate in matching.
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct Signature {
+    kind: String,
+    features: BTreeMap<String, usize>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    value: Option<String>,
+}
+
+/// Signatures of the iframe's session-named globals, by name.
+#[derive(Default)]
+pub struct Globals(pub BTreeMap<String, Signature>);
+
+impl Globals {
+    /// Signatures of the hex-named globals the initial VM program installs.
+    pub(crate) fn installed(installed: &Installed) -> Self {
+        let mut globals = Self::default();
+        for (name, value) in &installed.audit {
+            if !vocabulary::is_hex_name(name) {
+                continue;
+            }
+            let role = installed.audit_roles.get(name).map(String::as_str);
+            let feature = match role {
+                Some(role) => format!("role:{role}"),
+                None if vocabulary::is_hex_name(value) => "session-name".into(),
+                None => format!("value:{value}"),
+            };
+            let signature = Signature {
+                kind: "installed".into(),
+                features: BTreeMap::from([(feature, 1)]),
+                // Native function strings use each engine's whitespace and formatting.
+                // Preserve the captured classification instead of imposing Chromium's.
+                value: (!matches!(role, Some("clock-delta" | "native-array")))
+                    .then(|| value.clone()),
+            };
+            globals.0.insert(name.clone(), signature);
+        }
+        globals
+    }
+
+    /// Recovers both script definitions and globals installed by the initial VM program.
+    pub fn capture(source: &Source) -> Result<Self> {
+        let prepared =
+            PreparedSession::try_new(source, &Url::parse("https://challenges.cloudflare.com/")?)?;
+        let mut globals = Self::installed(&prepared.program().installed);
+        globals.0.extend(Self::recover(source).0);
+        Ok(globals)
+    }
+
+    /// Signatures of the hex-named globals the iframe script assigns on `window` or an alias.
+    pub(crate) fn recover(source: &Source) -> Self {
+        let mut aliases = Aliases(BTreeSet::from(["window".to_owned()]));
+        source.parsed().script.visit_with(&mut aliases);
+        let mut definitions = Definitions {
+            aliases: aliases.0,
+            globals: Self::default(),
+        };
+        source.parsed().script.visit_with(&mut definitions);
+        definitions.globals
+    }
+
+    /// Accepts only a unique best candidate in both directions. Ambiguous definitions are
+    /// omitted rather than assigning an unrelated global the recorded value.
+    pub fn mapping(&self, recorded: &BTreeMap<String, Signature>) -> BTreeMap<String, String> {
+        let mut scores = Vec::new();
+        for (old, signature) in recorded {
+            for (new, candidate) in &self.0 {
+                let score = signature.similarity(candidate);
+                if score >= 0.9 {
+                    scores.push((old, new, score));
+                }
+            }
+        }
+        scores
+            .iter()
+            .filter(|(old, new, score)| {
+                !scores.iter().any(|(other_old, other_new, other_score)| {
+                    (other_old == old && other_new != new || other_new == new && other_old != old)
+                        && other_score >= score
+                })
+            })
+            .map(|(old, new, _)| ((*old).clone(), (*new).clone()))
+            .collect()
+    }
+}
+
+impl Signature {
+    /// A global's initial audit value when recovered from VM initialization.
+    #[must_use]
+    pub fn audit_value(&self) -> Option<&str> {
+        self.value.as_deref()
+    }
+
+    /// The startup timer's measured delta varies between otherwise equivalent sessions.
+    #[must_use]
+    pub fn is_elapsed_time(&self) -> bool {
+        self.features.contains_key("role:clock-delta")
+    }
+
+    fn similarity(&self, other: &Self) -> f64 {
+        if self.kind != other.kind {
+            return 0.0;
+        }
+        let mut intersection = 0;
+        let mut union = 0;
+        for key in self
+            .features
+            .keys()
+            .chain(other.features.keys())
+            .collect::<BTreeSet<_>>()
+        {
+            let a = self.features.get(key).copied().unwrap_or_default();
+            let b = other.features.get(key).copied().unwrap_or_default();
+            intersection += a.min(b);
+            union += a.max(b);
+        }
+        let structural = intersection as f64 / union.max(1) as f64;
+        let anchors = |signature: &Self| {
+            signature
+                .features
+                .keys()
+                .filter(|key| key.starts_with("property:") || key.starts_with("string:"))
+                .cloned()
+                .collect::<BTreeSet<_>>()
+        };
+        let own_anchors = anchors(self);
+        if self.kind == "function" && own_anchors.len() >= 2 && own_anchors == anchors(other) {
+            // Deobfuscation can duplicate reads and move local declarations while preserving
+            // the APIs and fixed strings that identify the helper.
+            structural.max(0.9 + 0.1 * structural)
+        } else {
+            structural
+        }
+    }
+
+    fn feature(&mut self, feature: String) {
+        *self.features.entry(feature).or_default() += 1;
+    }
+}
+
+struct Aliases(BTreeSet<String>);
+
+impl Visit for Aliases {
+    fn visit_member_expr(&mut self, member: &MemberExpr) {
+        if ast::member_str(&member.prop) == Some("_cf_chl_opt")
+            && let Expr::Ident(alias) = member.obj.unwrap_parens()
+        {
+            self.0.insert(alias.sym.to_string());
+        }
+        member.visit_children_with(self);
+    }
+}
+
+struct Definitions {
+    aliases: BTreeSet<String>,
+    globals: Globals,
+}
+
+impl Visit for Definitions {
+    fn visit_assign_expr(&mut self, assignment: &AssignExpr) {
+        if let AssignTarget::Simple(SimpleAssignTarget::Member(member)) = &assignment.left
+            && let Expr::Ident(alias) = member.obj.unwrap_parens()
+            && self.aliases.contains(alias.sym.as_ref())
+            && let Some(name) = ast::member_str(&member.prop)
+            && vocabulary::is_hex_name(name)
+        {
+            let signature = self.globals.0.entry(name.to_owned()).or_default();
+            if signature.kind.is_empty() {
+                signature.kind = match assignment.right.unwrap_parens() {
+                    Expr::Fn(_) | Expr::Arrow(_) => "function",
+                    Expr::Object(_) => "object",
+                    Expr::Array(_) => "array",
+                    _ => "value",
+                }
+                .into();
+            }
+            assignment.right.visit_with(signature);
+        }
+        assignment.visit_children_with(self);
+    }
+}
+
+impl Visit for Signature {
+    fn visit_expr(&mut self, expression: &Expr) {
+        let feature = match expression {
+            Expr::Bin(value) => format!("binary:{:?}", value.op),
+            Expr::Unary(value) => format!("unary:{:?}", value.op),
+            Expr::Call(_) => "call".into(),
+            Expr::New(_) => "new".into(),
+            Expr::Cond(_) => "conditional".into(),
+            Expr::Fn(_) | Expr::Arrow(_) => "function".into(),
+            Expr::Array(_) => "array".into(),
+            Expr::Object(_) => "object".into(),
+            Expr::Assign(value) => format!("assign:{:?}", value.op),
+            Expr::Lit(Lit::Bool(value)) => format!("bool:{}", value.value),
+            _ => "expression".into(),
+        };
+        self.feature(feature);
+        if let Some(text) = ast::static_str(expression)
+            && !vocabulary::is_hex_name(text)
+            && text.len() <= 64
+            && text
+                .chars()
+                .all(|character| character.is_ascii_alphabetic() || " ._-/".contains(character))
+        {
+            self.feature(format!("string:{text}"));
+        }
+        expression.visit_children_with(self);
+    }
+
+    fn visit_member_expr(&mut self, member: &MemberExpr) {
+        let randomized = |name: &str| {
+            vocabulary::is_hex_name(name)
+                || name.strip_prefix("_0x").is_some_and(|suffix| {
+                    !suffix.is_empty() && suffix.bytes().all(|byte| byte.is_ascii_hexdigit())
+                })
+        };
+        if let Some(name) = ast::member_str(&member.prop)
+            && !randomized(name)
+        {
+            self.feature(format!("property:{name}"));
+        }
+        member.visit_children_with(self);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn globals(script: &str) -> Globals {
+        Globals::recover(&Source::try_new(script).unwrap())
+    }
+
+    #[test]
+    fn pairs_definitions_across_aliases_and_local_names() {
+        let old = globals(
+            r#"
+            var x = window; x._cf_chl_opt;
+            window._111111111111111111111111 = function(a) { return a.createHTML(); };
+            x._222222222222222222222222 = function(b) { return b.createScript(); };
+        "#,
+        );
+        let new = globals(
+            r#"
+            var y = window; y._cf_chl_opt;
+            y._aaaaaaaaaaaaaaaaaaaaaaaa = function(c) { return c.createScript(); };
+            window._bbbbbbbbbbbbbbbbbbbbbbbb = function(d) { return d.createHTML(); };
+        "#,
+        );
+        let mapping = new.mapping(&old.0);
+        assert_eq!(mapping.len(), 2);
+        assert_eq!(
+            mapping["_111111111111111111111111"],
+            "_bbbbbbbbbbbbbbbbbbbbbbbb"
+        );
+        assert_eq!(
+            mapping["_222222222222222222222222"],
+            "_aaaaaaaaaaaaaaaaaaaaaaaa"
+        );
+    }
+
+    #[test]
+    fn ambiguous_or_different_definitions_are_omitted() {
+        let old = globals("window._111111111111111111111111 = function(a) { return a; };");
+        let duplicates = globals(
+            r#"
+            window._aaaaaaaaaaaaaaaaaaaaaaaa = function(b) { return b; };
+            window._bbbbbbbbbbbbbbbbbbbbbbbb = function(c) { return c; };
+        "#,
+        );
+        assert!(duplicates.mapping(&old.0).is_empty());
+        let different = globals("window._aaaaaaaaaaaaaaaaaaaaaaaa = { value: true };");
+        assert!(different.mapping(&old.0).is_empty());
+    }
+
+    #[test]
+    fn injected_operator_helpers_do_not_change_api_identity() {
+        let old = globals(
+            "window._111111111111111111111111 = \
+             function(a) { return a.getOwnPropertyNames().concat(a.keys()); };",
+        );
+        let new = globals(
+            "window._aaaaaaaaaaaaaaaaaaaaaaaa = function(b) { \
+             var h = {_0xabc: function(x) { return x; }}; h._0xabc(b); \
+             return b.getOwnPropertyNames().concat(b.keys()); };",
+        );
+        assert_eq!(
+            new.mapping(&old.0)["_111111111111111111111111"],
+            "_aaaaaaaaaaaaaaaaaaaaaaaa"
+        );
+    }
+}

data/vendor/cfsolve/src/stage2/benchmark.rs

@@ -163,15 +163,11 @@ pub(crate) fn recognize(probe: &ProbeView<'_>) -> Option<Fields> {
             });
         }
     }
-    let source = strings
+    // Programs that decode strings in place also hold the source as a descriptor.
+    let parsed = strings
         .iter()
-        .find(|text| text.contains("WebAssembly.instantiate"))?;
-    let parsed = ast::parse_javascript("benchmark worker", source)
-        .or_else(|_| {
-            let decoded = listing::decode_string(source, "")?;
-            ast::parse_javascript("benchmark worker", &decoded)
-        })
-        .ok()?;
+        .filter(|text| text.contains("WebAssembly.instantiate"))
+        .find_map(|source| ast::parse_javascript("benchmark worker", source).ok())?;
     let mut worker = Worker::default();
     parsed.script.visit_with(&mut worker);
     // Only the kernels the recorded speeds measure are supported. Field names are recovered
@@ -204,6 +200,7 @@ pub(crate) fn recognize(probe: &ProbeView<'_>) -> Option<Fields> {
         .find(|items| items.len() == order.len() && *items != order)?;
     // The worker's source begins `var plan={<order>:[...],<iterations>:[...],`,
     // and the record takes the same two names.
+    // Hex names start with `_`.
     let identifier = |text: &str| {
         !text.is_empty()
             && text

data/vendor/cfsolve/src/stage2/call_stack.rs

@@ -153,14 +153,23 @@ pub struct MethodCall {
     pub arity: usize,
 }
 
-/// Call path to `new Error()` in the stack probe. The listener enters the probe function, which
-/// calls a closure that constructs the error.
+/// Call path to `new Error()` in the stack probe. The probe function calls a closure that
+/// constructs the error.
 #[derive(Clone, Copy, Debug, Deserialize, Serialize)]
 pub struct ProbeCalls {
     /// The opcode that constructs `new Error()`.
     pub construct: u8,
-    /// How many parameters the probe function declares.
-    pub arity: usize,
+}
+
+/// The callback that last resumed the VM before the stack probe, whose listener is the probe's
+/// outermost frame. Chrome and Safari captures show both; a Worker message is more common.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Resumption {
+    /// A timer, whose callback receives no arguments. V8 leaves its listener anonymous.
+    Timer,
+    /// A Worker's message event, which passes the event. V8 names the listener by its
+    /// receiver, `Worker.<anonymous>`.
+    WorkerMessage,
 }
 
 /// Recovers callback frames for a VM function with `arity` parameters and error-construction
@@ -179,15 +188,24 @@ pub fn recover(source: &str, cases: &CaseOpcodes, construct: u8, arity: usize) -
     })
 }
 
-/// Recovers frames for the stack probe. The VM executes closures in its dispatch loop without
-/// JavaScript calls, so frames stop at the listener that entered the probe. V8 retains only the
-/// innermost ten frames.
-pub fn recover_probe(source: &str, cases: &CaseOpcodes, calls: ProbeCalls) -> Result<Geometry> {
+/// Recovers frames for the stack probe, run after `resumed`. The VM executes closures in its
+/// dispatch loop without JavaScript calls, so frames stop at the listener that resumed it. V8
+/// retains only the innermost ten frames.
+pub fn recover_probe(
+    source: &str,
+    cases: &CaseOpcodes,
+    calls: ProbeCalls,
+    resumed: Resumption,
+) -> Result<Geometry> {
     geometry(source, cases, |machine| {
         // The probe registers an exception handler, so its instructions dispatch from the
         // guarded loop.
         let mut chain = machine.construction(calls.construct, true)?;
-        chain.frames.extend(machine.listener(calls.arity, "")?);
+        let (arity, name) = match resumed {
+            Resumption::Timer => (0, ""),
+            Resumption::WorkerMessage => (1, "Worker.<anonymous>"),
+        };
+        chain.frames.extend(machine.listener(arity, name)?);
         chain.frames.truncate(V8_STACK_LIMIT);
         Ok(chain)
     })
@@ -648,6 +666,8 @@ struct Script {
     /// Array slots containing `Reflect.construct`, indexed by array and slot.
     construct_slots: Vec<(Id, usize)>,
     applies: Vec<Id>,
+    /// Array slots containing `Reflect.apply`, indexed by array and slot.
+    apply_slots: Vec<(Id, usize)>,
     appliers: Appliers,
 }
 
@@ -816,6 +836,7 @@ impl Script {
             constructs: Vec::new(),
             construct_slots: Vec::new(),
             applies: Vec::new(),
+            apply_slots: Vec::new(),
             appliers,
         };
         program.visit_with(&mut script);
@@ -858,9 +879,13 @@ impl Script {
             .target(call)
             .ok()?;
         // Compare bindings so a nested function with the same name as a native apply
-        // alias cannot be mistaken for that alias.
-        let callee = target.callee.as_ref()?;
-        if self.function(callee).is_ok() && !self.applies.iter().any(|alias| alias == callee) {
+        // alias cannot be mistaken for that alias. Some builds keep the alias in an array slot.
+        let native = match (&target.callee, &target.slot) {
+            (Some(callee), _) => self.function(callee).is_err() || self.applies.contains(callee),
+            (None, Some(slot)) => self.apply_slots.contains(slot),
+            (None, None) => false,
+        };
+        if !native {
             return None;
         }
         let [first, second, ..] = handed(call, &target)?[..] else {
@@ -888,13 +913,16 @@ impl Visit for Script {
                 (Some(name), Some("apply")) => self.applies.push(name.to_id()),
                 _ => {}
             }
-            if method == Some("construct")
-                && let AssignTarget::Simple(SimpleAssignTarget::Member(slot)) = &assign.left
+            if let AssignTarget::Simple(SimpleAssignTarget::Member(slot)) = &assign.left
                 && let Some(array) = slot.obj.as_ident()
                 && let Some(index) = slot.prop.as_computed()
                 && let Some(index) = self.appliers.number(&index.expr).and_then(ast::array_index)
             {
-                self.construct_slots.push((array.to_id(), index));
+                match method {
+                    Some("construct") => self.construct_slots.push((array.to_id(), index)),
+                    Some("apply") => self.apply_slots.push((array.to_id(), index)),
+                    _ => {}
+                }
             }
         }
         assign.visit_children_with(self);
@@ -1355,7 +1383,11 @@ impl<'script> Scope<'script> {
         let constructor = name.starts_with(char::is_uppercase);
         let mut scope = Self {
             appliers,
-            prefix: constructor.then(|| format!("{name}.")).unwrap_or_default(),
+            prefix: if constructor {
+                format!("{name}.")
+            } else {
+                String::new()
+            },
             forwarders: Forwarders::default(),
             assigned: HashMap::new(),
             aliases: HashMap::new(),
@@ -1857,6 +1889,30 @@ mod tests {
         assert!(script.method_forwarder(&binding(&script, "S")).is_none());
     }
 
+    /// Checks method forwarders that call a `Reflect.apply` alias kept in an array slot, directly
+    /// or through a selector helper. Other slots are not apply aliases.
+    #[test]
+    fn method_forwarders_may_apply_through_an_array_slot() {
+        let source = "var G=[];G[2]=Reflect.apply;G[3]=function(){};\
+            function W(s,f,a,b,c){switch(s^1){case 0:return f(a,b,c)}}\
+            function D(f,r,a){return(0,G[2])(f,r,[a])}\
+            function H(f,r,a,b){return W(1,G[2],f,r,[a,b])}\
+            function O(f,r,a){return(0,G[3])(f,r,[a])}";
+        let (script, _) = script(source);
+        let cases: [(&str, &[&str]); 2] = [("D", &["D"]), ("H", &["W", "H"])];
+        for (forwarder, expected) in cases {
+            let frames = script
+                .method_forwarder(&binding(&script, forwarder))
+                .expect("`G[2]` holds `Reflect.apply`, so the call is a method forwarder");
+            let names: Vec<&str> = frames.iter().map(|call| call.name.v8.as_str()).collect();
+            assert_eq!(names, expected, "frames of forwarder {forwarder}");
+        }
+        assert!(
+            script.method_forwarder(&binding(&script, "O")).is_none(),
+            "`G[3]` holds a plain function, not `Reflect.apply`"
+        );
+    }
+
     #[test]
     fn same_named_functions_resolve_to_the_called_binding() {
         let (script, _) = script(

data/vendor/cfsolve/src/stage2/interaction/native.rs

@@ -140,7 +140,7 @@ pub(crate) fn measure(
         "bubbles":true, "button":0, "buttons":0, "cancelable":true,
         "clientX":client_x, "clientY":client_y, "composed":true, "ctrlKey":false,
         "defaultPrevented":false, "detail":1, "eventPhase":2, "height":1,
-        "isPrimary":is_primary, "isTrusted":true, "layerX":(client_x-x).round(), "layerY":(client_y-y).round(),
+        "isPrimary":is_primary, "isTrusted":true, "layerX":(client_x-x).floor(), "layerY":(client_y-y).floor(),
     }));
     event.extend(object(json!({
         "movementX":0, "movementY":0, "metaKey":false,
@@ -250,6 +250,7 @@ mod tests {
         assert_eq!(event["screenX"], 101.0);
         assert_eq!(event["screenY"], 145.0);
         assert_eq!(event["offsetY"], 12.0);
+        assert_eq!(event["layerY"], 11.0);
         assert_eq!(raw["sources"]["derived"]["relative_y"], 11.0);
         assert_eq!(event["timeStamp"], 123.0);
         assert_eq!(raw["sources"]["element"]["clientWidth"], 168.0);

data/vendor/cfsolve/src/stage2/interaction/plan.rs

@@ -98,9 +98,6 @@ impl Plan {
 
 /// Analyzes a returned checkbox program's listing.
 pub fn recover(listing: &Listing) -> Result<Plan> {
-    let mut normalized = listing.clone();
-    crate::listing::normalize::constants(&mut normalized);
-    let listing = &normalized;
     ensure!(
         listing.failures.is_empty(),
         "checkbox program has undecoded instructions"

data/vendor/cfsolve/src/stage2/payload/recover.rs

@@ -180,7 +180,8 @@ pub(in crate::stage2) struct Recovered<'listing> {
 }
 
 /// Recovers the payload and any checkbox record. Tries unique header names as record-counter
-/// candidates. Uses `program` to identify errors.
+/// candidates, then, for programs whose header holds no names, the fields published objects
+/// start at zero. Uses `program` to identify errors.
 pub(in crate::stage2) fn recover_unique<'listing>(
     index: &Index<'listing>,
     program: &str,
@@ -191,23 +192,18 @@ pub(in crate::stage2) fn recover_unique<'listing>(
     let scan = scan(index, pool);
     let mut layouts = Vec::new();
     let mut failure = None;
-    let mut counters: BTreeSet<&String> = index.header().values().collect();
-    counters.extend(
-        index
-            .stores()
-            .iter()
-            .filter(|store| {
-                matches!(
-                    index.dereference(store.pc, &store.value),
-                    Some((_, Term::Binary(BinaryOp::Add, _, _)))
-                )
-            })
-            .map(|store| &store.key),
-    );
-    for counter in counters {
-        match scan.layout(counter) {
-            Ok(layout) => layouts.push((counter.clone(), layout)),
-            Err(error) => failure = Some(error),
+    for candidates in [
+        index.header().values().cloned().collect(),
+        scan.zeroed_fields(),
+    ] {
+        for counter in candidates {
+            match scan.layout(&counter) {
+                Ok(layout) => layouts.push((counter, layout)),
+                Err(error) => failure = Some(error),
+            }
+        }
+        if !layouts.is_empty() {
+            break;
         }
     }
     ensure!(layouts.len() <= 1, "ambiguous {program} payload counter");
@@ -243,6 +239,35 @@ pub(in crate::stage2) struct RecordLiteral {
 pub(in crate::stage2) struct Scan(Vec<FunctionWrites>);
 
 impl Scan {
+    /// Fields a published object starts at zero that the program also writes to the payload as
+    /// a computed value, as it does when it increments the record counter. Other zeroed fields,
+    /// such as the probe count, are published as literals.
+    fn zeroed_fields(&self) -> Vec<String> {
+        let incremented = |field: &str| {
+            let mut payload_writes = self.0.iter().flat_map(FunctionWrites::payload_writes);
+            payload_writes.any(|write| {
+                write.key == field
+                    && !matches!(write.value, Written::Expression(Expression::Literal { .. }))
+            })
+        };
+        let mut fields: Vec<String> = Vec::new();
+        for function in &self.0 {
+            let Some(publication) = function.published else {
+                continue;
+            };
+            for write in &function.writes {
+                if write.is_zero()
+                    && write.target == WriteTarget::Object(publication.object)
+                    && !fields.contains(&write.key)
+                    && incremented(&write.key)
+                {
+                    fields.push(write.key.clone());
+                }
+            }
+        }
+        fields
+    }
+
     /// Recovers field sources for the second payload. Identifies the replacement template as the
     /// object published to the payload cell with its record `counter` initialized to zero.
     pub(in crate::stage2) fn layout(&self, counter: &str) -> Result<Layout> {
@@ -256,11 +281,9 @@ impl Scan {
                 .filter(|write| write.target == WriteTarget::Object(publication.object))
                 .collect();
             fields.len() > 20
-                && fields.iter().any(|write| {
-                    write.key == counter
-                        && matches!(&write.value, Written::Expression(Expression::Literal { value })
-                            if value.as_f64() == Some(0.0))
-                })
+                && fields
+                    .iter()
+                    .any(|write| write.key == counter && write.is_zero())
         };
         let templates = functions
             .iter()
@@ -453,6 +476,14 @@ struct Write {
     value: Written,
 }
 
+impl Write {
+    /// Whether the write stores a literal zero, as for the record counter in the template.
+    fn is_zero(&self) -> bool {
+        matches!(&self.value, Written::Expression(Expression::Literal { value })
+            if value.as_f64() == Some(0.0))
+    }
+}
+
 #[derive(Clone, Copy, PartialEq)]
 enum WriteTarget {
     /// A new object, identified by where it was created.