ecma-evaluator 2.0.10 → 2.1.1

package/dist/esm/index.mjs

@@ -35,6 +35,7 @@ var mutableMethods = [
     "Array.prototype.sort",
     "Array.prototype.fill",
     "Array.prototype.copyWithin",
+    "Object.create",
     "Object.defineProperty",
     "Object.defineProperties",
     "Object.preventExtensions",
@@ -234,7 +235,7 @@ var blockedGlobalBuiltIns = [
     "Intl",
     "Deno"
 ];
-function Evaluator_array_like_to_array(arr, len) {
+function regExpSafety_array_like_to_array(arr, len) {
     if (null == len || len > arr.length) len = arr.length;
     for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
     return arr2;
@@ -242,6 +243,516 @@ function Evaluator_array_like_to_array(arr, len) {
 function _array_with_holes(arr) {
     if (Array.isArray(arr)) return arr;
 }
+function _iterable_to_array_limit(arr, i) {
+    var _i = null == arr ? null : "undefined" != typeof Symbol && arr[Symbol.iterator] || arr["@@iterator"];
+    if (null == _i) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && null != _i["return"]) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _sliced_to_array(arr, i) {
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || regExpSafety_unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
+}
+function regExpSafety_unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if ("string" == typeof o) return regExpSafety_array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if ("Object" === n && o.constructor) n = o.constructor.name;
+    if ("Map" === n || "Set" === n) return Array.from(n);
+    if ("Arguments" === n || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return regExpSafety_array_like_to_array(o, minLen);
+}
+function isUnsafeRegExpPattern(pattern) {
+    var pos = 0;
+    var depth = 0;
+    var MAX_DEPTH = 1000;
+    function parseAlternation() {
+        var start = pos;
+        var branches = [
+            parseSequence()
+        ];
+        while("|" === pattern[pos]){
+            pos++;
+            branches.push(parseSequence());
+        }
+        if (1 === branches.length) return branches[0];
+        return {
+            type: "alt",
+            branches: branches,
+            start: start,
+            end: pos
+        };
+    }
+    function parseSequence() {
+        var start = pos;
+        var terms = [];
+        while(pos < pattern.length && "|" !== pattern[pos] && ")" !== pattern[pos])terms.push(parseTerm());
+        return {
+            type: "seq",
+            terms: terms,
+            start: start,
+            end: pos
+        };
+    }
+    function parseTerm() {
+        var atom = parseAtom();
+        var quantifier = parseQuantifier();
+        if (quantifier) return {
+            type: "quant",
+            min: quantifier.min,
+            max: quantifier.max,
+            body: atom,
+            start: atom.start,
+            end: pos
+        };
+        return atom;
+    }
+    function parseQuantifier() {
+        var ch = pattern[pos];
+        if ("*" === ch) {
+            pos++;
+            return {
+                min: 0,
+                max: 1 / 0
+            };
+        }
+        if ("+" === ch) {
+            pos++;
+            return {
+                min: 1,
+                max: 1 / 0
+            };
+        }
+        if ("?" === ch) {
+            pos++;
+            return {
+                min: 0,
+                max: 1
+            };
+        }
+        if ("{" === ch) {
+            var match = /^\{(\d+)(,(\d*))?\}/.exec(pattern.slice(pos));
+            if (match) {
+                pos += match[0].length;
+                var min = Number(match[1]);
+                var max;
+                max = void 0 === match[2] ? min : "" === match[3] ? 1 / 0 : Number(match[3]);
+                return {
+                    min: min,
+                    max: max
+                };
+            }
+        }
+        return null;
+    }
+    function parseAtom() {
+        var start = pos;
+        var ch = pattern[pos];
+        if ("(" === ch) {
+            pos++;
+            var zeroWidth = false;
+            if ("?" === pattern[pos]) {
+                var rest = pattern.slice(pos);
+                if (rest.startsWith("?:")) pos += 2;
+                else if (rest.startsWith("?=") || rest.startsWith("?!")) {
+                    pos += 2;
+                    zeroWidth = true;
+                } else if (rest.startsWith("?<=") || rest.startsWith("?<!")) {
+                    pos += 3;
+                    zeroWidth = true;
+                } else if (rest.startsWith("?<")) {
+                    var named = /^\?<[A-Za-z_$][\w$]*>/.exec(rest);
+                    pos += named ? named[0].length : 2;
+                } else pos += 1;
+            }
+            depth++;
+            if (depth > MAX_DEPTH) throw new RangeError("regexp nesting too deep");
+            var body = parseAlternation();
+            depth--;
+            if (")" === pattern[pos]) pos++;
+            return {
+                type: "group",
+                body: body,
+                zeroWidth: zeroWidth,
+                start: start,
+                end: pos
+            };
+        }
+        if ("[" === ch) {
+            pos++;
+            if ("^" === pattern[pos]) pos++;
+            if ("]" === pattern[pos]) pos++;
+            while(pos < pattern.length && "]" !== pattern[pos]){
+                if ("\\" === pattern[pos]) pos++;
+                pos++;
+            }
+            pos++;
+            return {
+                type: "char",
+                zeroWidth: false,
+                start: start,
+                end: pos
+            };
+        }
+        if ("\\" === ch) {
+            pos += 2;
+            var escaped = pattern[start + 1];
+            return {
+                type: "char",
+                zeroWidth: "b" === escaped || "B" === escaped,
+                start: start,
+                end: pos
+            };
+        }
+        pos++;
+        return {
+            type: "char",
+            zeroWidth: "^" === ch || "$" === ch,
+            start: start,
+            end: pos
+        };
+    }
+    var raw = function(node) {
+        return pattern.slice(node.start, node.end);
+    };
+    var ANY = Symbol("any");
+    var DIGITS = new Set("0123456789".split(""));
+    var WORD = new Set("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_".split(""));
+    var SPACES = new Set([
+        " ",
+        "\t",
+        "\n",
+        "\r",
+        "\f",
+        "\v",
+        "\u00a0",
+        "\ufeff",
+        "\u2028",
+        "\u2029"
+    ]);
+    function escapeSet(esc) {
+        switch(esc){
+            case "d":
+                return DIGITS;
+            case "w":
+                return WORD;
+            case "s":
+                return SPACES;
+            case "n":
+                return new Set([
+                    "\n"
+                ]);
+            case "t":
+                return new Set([
+                    "\t"
+                ]);
+            case "r":
+                return new Set([
+                    "\r"
+                ]);
+            case "f":
+                return new Set([
+                    "\f"
+                ]);
+            case "v":
+                return new Set([
+                    "\v"
+                ]);
+            case "0":
+                return new Set([
+                    "\0"
+                ]);
+            default:
+                if (/[0-9A-Za-z]/.test(esc)) return ANY;
+                return new Set([
+                    esc
+                ]);
+        }
+    }
+    function classSet(text) {
+        var inner = text.slice(1, -1);
+        if (inner.startsWith("^")) return ANY;
+        var set = new Set();
+        for(var i = 0; i < inner.length; i++){
+            var ch = inner[i];
+            if ("\\" === ch) {
+                var esc = inner[++i];
+                var expanded = escapeSet(esc);
+                if (expanded === ANY) return ANY;
+                var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
+                try {
+                    for(var _iterator = expanded[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                        var c = _step.value;
+                        set.add(c);
+                    }
+                } catch (err) {
+                    _didIteratorError = true;
+                    _iteratorError = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
+                    } finally{
+                        if (_didIteratorError) throw _iteratorError;
+                    }
+                }
+                continue;
+            }
+            if ("-" === inner[i + 1] && void 0 !== inner[i + 2] && "]" !== inner[i + 2]) {
+                var end = inner[i + 2];
+                var startCode = ch.codePointAt(0);
+                var endCode = end.codePointAt(0);
+                if (endCode - startCode > 1024) return ANY;
+                for(var code = startCode; code <= endCode; code++)set.add(String.fromCodePoint(code));
+                i += 2;
+                continue;
+            }
+            set.add(ch);
+        }
+        return set;
+    }
+    function firstCharSet(node) {
+        switch(node.type){
+            case "char":
+                var text = raw(node);
+                if (node.zeroWidth || text.startsWith("^") || text.startsWith("$")) return new Set();
+                if ("." === text) return ANY;
+                if (text.startsWith("[")) return classSet(text);
+                if (text.startsWith("\\")) {
+                    var esc = text.slice(1);
+                    if (1 === esc.length) return escapeSet(esc);
+                    return ANY;
+                }
+                return new Set([
+                    text[0]
+                ]);
+            case "quant":
+                return 0 === node.min ? ANY : firstCharSet(node.body);
+            case "group":
+                return node.zeroWidth ? ANY : firstCharSet(node.body);
+            case "alt":
+                var union = new Set();
+                var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
+                try {
+                    for(var _iterator = node.branches[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                        var branch = _step.value;
+                        var set = firstCharSet(branch);
+                        if (set === ANY) return ANY;
+                        var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = void 0;
+                        try {
+                            for(var _iterator1 = set[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                                var ch = _step1.value;
+                                union.add(ch);
+                            }
+                        } catch (err) {
+                            _didIteratorError1 = true;
+                            _iteratorError1 = err;
+                        } finally{
+                            try {
+                                if (!_iteratorNormalCompletion1 && null != _iterator1.return) _iterator1.return();
+                            } finally{
+                                if (_didIteratorError1) throw _iteratorError1;
+                            }
+                        }
+                    }
+                } catch (err) {
+                    _didIteratorError = true;
+                    _iteratorError = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
+                    } finally{
+                        if (_didIteratorError) throw _iteratorError;
+                    }
+                }
+                return union;
+            case "seq":
+                var _iteratorNormalCompletion2 = true, _didIteratorError2 = false, _iteratorError2 = void 0;
+                try {
+                    for(var _iterator2 = node.terms[Symbol.iterator](), _step2; !(_iteratorNormalCompletion2 = (_step2 = _iterator2.next()).done); _iteratorNormalCompletion2 = true){
+                        var term = _step2.value;
+                        var set1 = firstCharSet(term);
+                        if (set1 === ANY) return ANY;
+                        if (set1.size > 0) return set1;
+                    }
+                } catch (err) {
+                    _didIteratorError2 = true;
+                    _iteratorError2 = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion2 && null != _iterator2.return) _iterator2.return();
+                    } finally{
+                        if (_didIteratorError2) throw _iteratorError2;
+                    }
+                }
+                return new Set();
+            default:
+                return ANY;
+        }
+    }
+    function setsIntersect(a, b) {
+        if (a === ANY || b === ANY) return true;
+        if (0 === a.size || 0 === b.size) return false;
+        var _ref = _sliced_to_array(a.size <= b.size ? [
+            a,
+            b
+        ] : [
+            b,
+            a
+        ], 2), small = _ref[0], large = _ref[1];
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
+        try {
+            for(var _iterator = small[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var ch = _step.value;
+                if (large.has(ch)) return true;
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
+            } finally{
+                if (_didIteratorError) throw _iteratorError;
+            }
+        }
+        return false;
+    }
+    function consumableCharSet(quantNode) {
+        return firstCharSet(quantNode.body);
+    }
+    function trailingQuantifier(node) {
+        switch(node.type){
+            case "quant":
+                return node.max === 1 / 0 ? node : null;
+            case "group":
+                return node.zeroWidth ? null : trailingQuantifier(node.body);
+            case "seq":
+                for(var i = node.terms.length - 1; i >= 0; i--){
+                    var quantifier = trailingQuantifier(node.terms[i]);
+                    if (quantifier) return quantifier;
+                    var set = firstCharSet(node.terms[i]);
+                    if (set === ANY || set.size > 0) break;
+                }
+                return null;
+            default:
+                return null;
+        }
+    }
+    function leadingQuantifier(node) {
+        switch(node.type){
+            case "quant":
+                return node.max === 1 / 0 ? node : null;
+            case "group":
+                return node.zeroWidth ? null : leadingQuantifier(node.body);
+            case "seq":
+                var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
+                try {
+                    for(var _iterator = node.terms[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                        var term = _step.value;
+                        var quantifier = leadingQuantifier(term);
+                        if (quantifier) return quantifier;
+                        var set = firstCharSet(term);
+                        if (set === ANY || set.size > 0) return null;
+                    }
+                } catch (err) {
+                    _didIteratorError = true;
+                    _iteratorError = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
+                    } finally{
+                        if (_didIteratorError) throw _iteratorError;
+                    }
+                }
+                return null;
+            default:
+                return null;
+        }
+    }
+    function hasAdjacentOverlappingQuantifiers(seqNode) {
+        var terms = seqNode.terms;
+        for(var i = 0; i + 1 < terms.length; i++){
+            var left = trailingQuantifier(terms[i]);
+            var right = leadingQuantifier(terms[i + 1]);
+            if (left && right && setsIntersect(consumableCharSet(left), consumableCharSet(right))) return true;
+        }
+        return false;
+    }
+    function containsUnboundedQuantifier(node) {
+        switch(node.type){
+            case "quant":
+                if (node.max === 1 / 0) return true;
+                return containsUnboundedQuantifier(node.body);
+            case "group":
+                return containsUnboundedQuantifier(node.body);
+            case "alt":
+                return node.branches.some(containsUnboundedQuantifier);
+            case "seq":
+                return node.terms.some(containsUnboundedQuantifier);
+            default:
+                return false;
+        }
+    }
+    function alternationOverlaps(node) {
+        if ("alt" !== node.type) return false;
+        var texts = node.branches.map(raw).sort();
+        for(var i = 0; i + 1 < texts.length; i++)if ("" === texts[i] || texts[i + 1].startsWith(texts[i])) return true;
+        var sets = node.branches.map(firstCharSet);
+        for(var i1 = 0; i1 < sets.length; i1++)for(var j = i1 + 1; j < sets.length; j++)if (setsIntersect(sets[i1], sets[j])) return true;
+        return false;
+    }
+    function isCatastrophic(node) {
+        switch(node.type){
+            case "quant":
+                if (node.max === 1 / 0) {
+                    var inner = "group" === node.body.type ? node.body.body : node.body;
+                    if (containsUnboundedQuantifier(inner)) return true;
+                    if ("alt" === inner.type && alternationOverlaps(inner)) return true;
+                }
+                return isCatastrophic(node.body);
+            case "group":
+                return isCatastrophic(node.body);
+            case "alt":
+                return node.branches.some(isCatastrophic);
+            case "seq":
+                return hasAdjacentOverlappingQuantifiers(node) || node.terms.some(isCatastrophic);
+            default:
+                return false;
+        }
+    }
+    try {
+        return isCatastrophic(parseAlternation());
+    } catch (e) {
+        return false;
+    }
+}
+function Evaluator_array_like_to_array(arr, len) {
+    if (null == len || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function Evaluator_array_with_holes(arr) {
+    if (Array.isArray(arr)) return arr;
+}
 function Evaluator_array_without_holes(arr) {
     if (Array.isArray(arr)) return Evaluator_array_like_to_array(arr);
 }
@@ -282,7 +793,7 @@ function _instanceof(left, right) {
 function Evaluator_iterable_to_array(iter) {
     if ("undefined" != typeof Symbol && null != iter[Symbol.iterator] || null != iter["@@iterator"]) return Array.from(iter);
 }
-function _non_iterable_rest() {
+function Evaluator_non_iterable_rest() {
     throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function Evaluator_non_iterable_spread() {
@@ -296,7 +807,7 @@ function _set_prototype_of(o, p) {
     return _set_prototype_of(o, p);
 }
 function _to_array(arr) {
-    return _array_with_holes(arr) || Evaluator_iterable_to_array(arr) || Evaluator_unsupported_iterable_to_array(arr) || _non_iterable_rest();
+    return Evaluator_array_with_holes(arr) || Evaluator_iterable_to_array(arr) || Evaluator_unsupported_iterable_to_array(arr) || Evaluator_non_iterable_rest();
 }
 function Evaluator_to_consumable_array(arr) {
     return Evaluator_array_without_holes(arr) || Evaluator_iterable_to_array(arr) || Evaluator_unsupported_iterable_to_array(arr) || Evaluator_non_iterable_spread();
@@ -338,6 +849,18 @@ var MAX_STRING_LENGTH = 100000;
 var MAX_DATA_NODES = 100000;
 var MAX_BIGINT_EXPONENT = 256n;
 var MAX_BIGINT_BITS = 65536;
+var DEFAULT_MAX_DEPTH = 1000;
+var MAX_CONFIGURABLE_DEPTH = 2000;
+var MAX_REGEXP_SOURCE_LENGTH = 1000;
+var MAX_REGEXP_FLAGS_LENGTH = 32;
+var NON_SANDBOX_GLOBALS = new Set([
+    "WeakRef",
+    "FinalizationRegistry",
+    "Iterator",
+    "SharedArrayBuffer",
+    "escape",
+    "unescape"
+]);
 var TYPED_ARRAY_CONSTRUCTORS = new Set([
     Int8Array,
     Uint8Array,
@@ -346,6 +869,7 @@ var TYPED_ARRAY_CONSTRUCTORS = new Set([
     Uint16Array,
     Int32Array,
     Uint32Array,
+    "function" == typeof Float16Array ? Float16Array : null,
     Float32Array,
     Float64Array,
     "function" == typeof BigInt64Array ? BigInt64Array : null,
@@ -353,6 +877,89 @@ var TYPED_ARRAY_CONSTRUCTORS = new Set([
 ].filter(function(constructor) {
     return "function" == typeof constructor;
 }));
+function isTypedArrayConstructor(value) {
+    return TYPED_ARRAY_CONSTRUCTORS.has(value) || "function" == typeof value && "number" == typeof value.BYTES_PER_ELEMENT;
+}
+var TYPED_ARRAY_MUTATORS = function() {
+    var map = new Map();
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
+    try {
+        for(var _iterator = TYPED_ARRAY_CONSTRUCTORS[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var constructor = _step.value;
+            for(var _i = 0, _iter = [
+                "set",
+                "fill",
+                "reverse",
+                "sort",
+                "copyWithin"
+            ]; _i < _iter.length; _i++){
+                var name = _iter[_i];
+                var method = constructor.prototype[name];
+                if ("function" == typeof method && !map.has(method)) map.set(method, name);
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
+        } finally{
+            if (_didIteratorError) throw _iteratorError;
+        }
+    }
+    return map;
+}();
+var REGEXP_SYMBOL_METHODS = new Set([
+    Symbol.match,
+    Symbol.matchAll,
+    Symbol.replace,
+    Symbol.search,
+    Symbol.split
+].map(function(symbol) {
+    return RegExp.prototype[symbol];
+}).filter(function(method) {
+    return "function" == typeof method;
+}));
+var REGEXP_INVOCATION_KIND = function() {
+    var map = new Map();
+    for(var _i = 0, _iter = [
+        String.prototype.match,
+        String.prototype.matchAll,
+        String.prototype.search
+    ]; _i < _iter.length; _i++){
+        var method = _iter[_i];
+        map.set(method, "stringPattern");
+    }
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
+    try {
+        for(var _iterator = [
+            RegExp.prototype.test,
+            RegExp.prototype.exec
+        ].concat(Evaluator_to_consumable_array(REGEXP_SYMBOL_METHODS))[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var method1 = _step.value;
+            map.set(method1, "receiverPattern");
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
+        } finally{
+            if (_didIteratorError) throw _iteratorError;
+        }
+    }
+    for(var _i1 = 0, _iter1 = [
+        String.prototype.replace,
+        String.prototype.replaceAll,
+        String.prototype.split
+    ]; _i1 < _iter1.length; _i1++){
+        var method2 = _iter1[_i1];
+        map.set(method2, "regexArgument");
+    }
+    return map;
+}();
 var NO_OBJECT = Symbol("no-object");
 var renderErrorMessage = function(template) {
     var context = arguments.length > 1 && void 0 !== arguments[1] ? arguments[1] : {};
@@ -360,6 +967,26 @@ var renderErrorMessage = function(template) {
         return String(context[key]);
     });
 };
+var SAFE_REGEXP_PATTERNS = new Set();
+var MAX_SAFE_REGEXP_PATTERNS = 1000;
+function assertSafeRegExpPattern(pattern) {
+    if ("string" != typeof pattern || SAFE_REGEXP_PATTERNS.has(pattern)) return;
+    if (isUnsafeRegExpPattern(pattern)) throw new RangeError("RegExp pattern may cause catastrophic backtracking and is not allowed");
+    if (SAFE_REGEXP_PATTERNS.size >= MAX_SAFE_REGEXP_PATTERNS) SAFE_REGEXP_PATTERNS.delete(SAFE_REGEXP_PATTERNS.values().next().value);
+    SAFE_REGEXP_PATTERNS.add(pattern);
+}
+function assertSafeRegExpInvocation(func, target, args) {
+    var kind = REGEXP_INVOCATION_KIND.get(func);
+    if (void 0 === kind) return;
+    if ("stringPattern" === kind) {
+        var pattern = args[0];
+        if ("string" == typeof pattern) assertSafeRegExpPattern(pattern);
+        else if (_instanceof(pattern, RegExp)) assertSafeRegExpPattern(pattern.source);
+        return;
+    }
+    var regexp = "receiverPattern" === kind ? target : args[0];
+    if (_instanceof(regexp, RegExp)) assertSafeRegExpPattern(regexp.source);
+}
 function validateLimit(value, name, defaultValue, maximum) {
     if (void 0 === value) return defaultValue;
     if (!Number.isSafeInteger(value) || value < 1 || value > maximum) throw new RangeError("".concat(name, " must be an integer between 1 and ").concat(maximum));
@@ -376,7 +1003,59 @@ function countLiteralMatches(value, search, all) {
     }
     return count;
 }
+function countRegExpMatches(value, regexp, all) {
+    var flags = regexp.flags.includes("g") ? regexp.flags : regexp.flags + "g";
+    var re = new RegExp(regexp.source, flags);
+    var count = 0;
+    var match;
+    while(null !== (match = re.exec(value))){
+        count++;
+        if (!all || count > MAX_STRING_LENGTH) break;
+        if (re.lastIndex === match.index) re.lastIndex++;
+    }
+    return count;
+}
+var PARSE_CACHE = new Map();
+var MAX_PARSE_CACHE_ENTRIES = 1000;
+var MAX_PARSE_CACHE_CHARS = 200000;
+var parseCacheChars = 0;
+function parseExpression(expression) {
+    var cached = PARSE_CACHE.get(expression);
+    if (void 0 !== cached) return cached;
+    var ast;
+    try {
+        ast = external_acorn_parse(expression, {
+            ecmaVersion: "latest"
+        });
+    } catch (error) {
+        if (_instanceof(error, RangeError) && /call stack/i.test(error.message)) throw new SyntaxError("Expression nesting is too deep to parse");
+        throw error;
+    }
+    if (expression.length <= MAX_PARSE_CACHE_CHARS) {
+        while(PARSE_CACHE.size >= MAX_PARSE_CACHE_ENTRIES || parseCacheChars + expression.length > MAX_PARSE_CACHE_CHARS){
+            var oldestKey = PARSE_CACHE.keys().next().value;
+            if (void 0 === oldestKey) break;
+            parseCacheChars -= oldestKey.length;
+            PARSE_CACHE.delete(oldestKey);
+        }
+        PARSE_CACHE.set(expression, ast);
+        parseCacheChars += expression.length;
+    }
+    return ast;
+}
 function assertBoundedData(value, label) {
+    var valueType = void 0 === value ? "undefined" : _type_of(value);
+    if ("string" === valueType) {
+        if (value.length > MAX_STRING_LENGTH) throw new RangeError("".concat(label, " contains a string that exceeds the maximum length"));
+        return {
+            dataSize: value.length + 8,
+            dataNodes: 1
+        };
+    }
+    if (null === value || "undefined" === valueType || "number" === valueType || "boolean" === valueType || "bigint" === valueType) return {
+        dataSize: 8,
+        dataNodes: 1
+    };
     var pending = [
         value
     ];
@@ -446,85 +1125,157 @@ function assertBoundedData(value, label) {
         dataNodes: dataNodes
     };
 }
-var BINARY_OPERATION_MAP = {
-    "+": function(a, b) {
-        return a + b;
-    },
-    "-": function(a, b) {
-        return a - b;
-    },
-    "*": function(a, b) {
-        return a * b;
-    },
-    "**": function(a, b) {
-        return Math.pow(a, b);
-    },
-    "==": function(a, b) {
-        return a == b;
-    },
-    "===": function(a, b) {
-        return a === b;
-    },
-    "!=": function(a, b) {
-        return a != b;
-    },
-    "!==": function(a, b) {
-        return a !== b;
-    },
-    ">": function(a, b) {
-        return a > b;
-    },
-    ">=": function(a, b) {
-        return a >= b;
-    },
-    "<": function(a, b) {
-        return a < b;
-    },
-    "<=": function(a, b) {
-        return a <= b;
-    },
-    "%": function(a, b) {
-        return a % b;
-    },
-    "/": function(a, b) {
-        return a / b;
-    },
-    "|": function(a, b) {
-        return a | b;
-    },
-    "&": function(a, b) {
-        return a & b;
-    },
-    "^": function(a, b) {
-        return a ^ b;
-    },
-    "<<": function(a, b) {
-        return a << b;
-    },
-    ">>": function(a, b) {
-        return a >> b;
-    },
-    ">>>": function(a, b) {
-        return a >>> b;
-    },
-    in: function(a, b) {
-        return a in b;
-    },
-    instanceof: function(a, b) {
-        return _instanceof(a, b);
-    }
-};
+var BINARY_OPERATION_MAP = new Map([
+    [
+        "+",
+        function(a, b) {
+            return a + b;
+        }
+    ],
+    [
+        "-",
+        function(a, b) {
+            return a - b;
+        }
+    ],
+    [
+        "*",
+        function(a, b) {
+            return a * b;
+        }
+    ],
+    [
+        "**",
+        function(a, b) {
+            return Math.pow(a, b);
+        }
+    ],
+    [
+        "==",
+        function(a, b) {
+            return a == b;
+        }
+    ],
+    [
+        "===",
+        function(a, b) {
+            return a === b;
+        }
+    ],
+    [
+        "!=",
+        function(a, b) {
+            return a != b;
+        }
+    ],
+    [
+        "!==",
+        function(a, b) {
+            return a !== b;
+        }
+    ],
+    [
+        ">",
+        function(a, b) {
+            return a > b;
+        }
+    ],
+    [
+        ">=",
+        function(a, b) {
+            return a >= b;
+        }
+    ],
+    [
+        "<",
+        function(a, b) {
+            return a < b;
+        }
+    ],
+    [
+        "<=",
+        function(a, b) {
+            return a <= b;
+        }
+    ],
+    [
+        "%",
+        function(a, b) {
+            return a % b;
+        }
+    ],
+    [
+        "/",
+        function(a, b) {
+            return a / b;
+        }
+    ],
+    [
+        "|",
+        function(a, b) {
+            return a | b;
+        }
+    ],
+    [
+        "&",
+        function(a, b) {
+            return a & b;
+        }
+    ],
+    [
+        "^",
+        function(a, b) {
+            return a ^ b;
+        }
+    ],
+    [
+        "<<",
+        function(a, b) {
+            return a << b;
+        }
+    ],
+    [
+        ">>",
+        function(a, b) {
+            return a >> b;
+        }
+    ],
+    [
+        ">>>",
+        function(a, b) {
+            return a >>> b;
+        }
+    ],
+    [
+        "in",
+        function(a, b) {
+            return a in b;
+        }
+    ],
+    [
+        "instanceof",
+        function(a, b) {
+            return _instanceof(a, b);
+        }
+    ]
+]);
 function createGlobalScope() {
     var scope = Object.create(null);
     var builtin = globals.builtin;
-    for(var key in builtin)if (!blockedGlobalBuiltIns.includes(key)) {
-        var isWritable = builtin[key];
-        Object.defineProperty(scope, key, {
-            value: globalThis[key],
-            writable: isWritable,
-            enumerable: false,
-            configurable: false
-        });
+    for(var key in builtin){
+        if (!blockedGlobalBuiltIns.includes(key)) {
+            if (!NON_SANDBOX_GLOBALS.has(key)) {
+                if (Object.hasOwn(globalThis, key)) {
+                    var isWritable = builtin[key];
+                    Object.defineProperty(scope, key, {
+                        value: globalThis[key],
+                        writable: isWritable,
+                        enumerable: false,
+                        configurable: false
+                    });
+                }
+            }
+        }
     }
     Object.defineProperty(scope, "globalThis", {
         value: scope,
@@ -534,6 +1285,12 @@ function createGlobalScope() {
     });
     return scope;
 }
+var GLOBAL_SCOPE = null;
+function getGlobalScope() {
+    if (null === GLOBAL_SCOPE) GLOBAL_SCOPE = createGlobalScope();
+    return GLOBAL_SCOPE;
+}
+var EMPTY_CONTEXT = Object.freeze(Object.create(null));
 var getBlockedMethods = function() {
     var BLOCKED_METHODS = null;
     return function() {
@@ -584,24 +1341,39 @@ var getBlockedMethods = function() {
 var Evaluator_Evaluator = /*#__PURE__*/ function() {
     "use strict";
     function Evaluator() {
-        var variables = arguments.length > 0 && void 0 !== arguments[0] ? arguments[0] : Object.create(null), options = arguments.length > 1 ? arguments[1] : void 0;
+        var variables = arguments.length > 0 && void 0 !== arguments[0] ? arguments[0] : EMPTY_CONTEXT, options = arguments.length > 1 ? arguments[1] : void 0;
         _class_call_check(this, Evaluator);
         this.maxInputLength = validateLimit(null == options ? void 0 : options.maxInputLength, "maxInputLength", DEFAULT_MAX_INPUT_LENGTH, MAX_CONFIGURABLE_INPUT_LENGTH);
         this.maxEvaluationSteps = validateLimit(null == options ? void 0 : options.maxEvaluationSteps, "maxEvaluationSteps", DEFAULT_MAX_EVALUATION_STEPS, MAX_CONFIGURABLE_EVALUATION_STEPS);
-        assertBoundedData(variables, "Evaluation context");
-        var clonedVariables = structuredClone(variables);
+        this.maxDepth = validateLimit(null == options ? void 0 : options.maxDepth, "maxDepth", DEFAULT_MAX_DEPTH, MAX_CONFIGURABLE_DEPTH);
+        var clonedVariables = EMPTY_CONTEXT;
+        if (variables !== EMPTY_CONTEXT) {
+            assertBoundedData(variables, "Evaluation context");
+            clonedVariables = structuredClone(variables);
+        }
         this.scopes = [
             clonedVariables,
-            createGlobalScope()
+            getGlobalScope()
         ].filter(function(scope) {
             return null != scope;
         });
         this.source = void 0;
+        this.evaluating = false;
         this.remainingEvaluationSteps = 0;
         this.remainingDataSize = MAX_BUFFER_BYTES;
         this.remainingDataNodes = MAX_DATA_NODES;
+        this.evaluationDepth = 0;
     }
     _create_class(Evaluator, [
+        {
+            key: "resetBudget",
+            value: function() {
+                this.remainingEvaluationSteps = this.maxEvaluationSteps;
+                this.remainingDataSize = MAX_BUFFER_BYTES;
+                this.remainingDataNodes = MAX_DATA_NODES;
+                this.evaluationDepth = 0;
+            }
+        },
         {
             key: "evaluate",
             value: function(expression) {
@@ -610,15 +1382,13 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                     this.maxInputLength
                 ]));
                 this.source = expression;
-                this.remainingEvaluationSteps = this.maxEvaluationSteps;
-                this.remainingDataSize = MAX_BUFFER_BYTES;
-                this.remainingDataNodes = MAX_DATA_NODES;
-                var ast = external_acorn_parse(expression, {
-                    ecmaVersion: "latest"
-                });
+                this.resetBudget();
+                var ast = parseExpression(expression);
+                this.evaluating = true;
                 try {
                     return this.execute(ast.body);
                 } finally{
+                    this.evaluating = false;
                     this.source = void 0;
                 }
             }
@@ -626,11 +1396,7 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
         {
             key: "execute",
             value: function(body) {
-                if (0 === this.remainingEvaluationSteps) {
-                    this.remainingEvaluationSteps = this.maxEvaluationSteps;
-                    this.remainingDataSize = MAX_BUFFER_BYTES;
-                    this.remainingDataNodes = MAX_DATA_NODES;
-                }
+                if (!this.evaluating) this.resetBudget();
                 var result;
                 var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
                 try {
@@ -655,6 +1421,8 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 if (_instanceof(result, Promise)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
                     "Returning promises from expressions"
                 ]));
+                var resultType = void 0 === result ? "undefined" : _type_of(result);
+                if (null === result || "string" === resultType || "number" === resultType || "boolean" === resultType || "undefined" === resultType || "bigint" === resultType) return result;
                 try {
                     return structuredClone(result);
                 } catch (error) {
@@ -671,69 +1439,79 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 var _this = this;
                 this.remainingEvaluationSteps--;
                 if (this.remainingEvaluationSteps < 0) throw new RangeError("Evaluation step limit exceeded");
-                switch(node.type){
-                    case "ExpressionStatement":
-                        return this.visit(node.expression);
-                    case "BinaryExpression":
-                        return this.handleBinaryExpression(node);
-                    case "LogicalExpression":
-                        return this.handleLogicalExpression(node);
-                    case "UnaryExpression":
-                        return this.handleUnaryExpression(node);
-                    case "Identifier":
-                        return this.handleIdentifier(node);
-                    case "Literal":
-                        return node.value;
-                    case "MemberExpression":
-                        return this.handleMemberExpression(node);
-                    case "ArrayExpression":
-                        return this.handleArrayExpression(node);
-                    case "SpreadElement":
-                        return this.handleSpreadElement(node);
-                    case "ObjectExpression":
-                        return this.handleObjectExpression(node);
-                    case "FunctionExpression":
-                        throw new SyntaxError(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
-                            "Function expression"
-                        ]));
-                    case "ArrowFunctionExpression":
-                        return this.handleArrowFunctionExpression(node);
-                    case "CallExpression":
-                        return this.handleCallExpression(node);
-                    case "ConditionalExpression":
-                        return this.visit(node.test) ? this.visit(node.consequent) : this.visit(node.alternate);
-                    case "NewExpression":
-                        if ("Identifier" !== node.callee.type) throw new Error("Unsupported callee type '".concat(node.callee.type, "' in new expression"));
-                        if ("Function" === node.callee.name) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
-                            "new Function() constructor"
-                        ]));
-                        if ("Promise" === node.callee.name) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
-                            "Promise constructor"
-                        ]));
-                        var Constructor = this.visit(node.callee);
-                        var args = node.arguments.length ? node.arguments.map(function(arg) {
-                            return _this.visit(arg);
-                        }) : [];
-                        this.assertBoundedConstruction(Constructor, args);
-                        return _construct(Constructor, Evaluator_to_consumable_array(args));
-                    case "ChainExpression":
-                        return this.visit(node.expression);
-                    case "TemplateLiteral":
-                        return this.handleTemplateLiteral(node);
-                    case "ThisExpression":
-                        throw new SyntaxError(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
-                            "'this' expression"
-                        ]));
-                    case "WithStatement":
-                        throw new SyntaxError(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
-                            "'with' statement"
-                        ]));
-                    default:
-                        var content = this.source.slice(node.start, node.end);
-                        if (content.length > 20) content = content.slice(0, 17) + "...";
-                        throw new SyntaxError("'".concat(content, "'") + " " + renderErrorMessage(ERROR_MESSAGES.IS_INVALID_SYNTAX, [
-                            content
-                        ]));
+                this.evaluationDepth++;
+                if (this.evaluationDepth > this.maxDepth) {
+                    this.evaluationDepth--;
+                    throw new RangeError("Maximum evaluation depth exceeded");
+                }
+                try {
+                    switch(node.type){
+                        case "ExpressionStatement":
+                            return this.visit(node.expression);
+                        case "BinaryExpression":
+                            return this.handleBinaryExpression(node);
+                        case "LogicalExpression":
+                            return this.handleLogicalExpression(node);
+                        case "UnaryExpression":
+                            return this.handleUnaryExpression(node);
+                        case "Identifier":
+                            return this.handleIdentifier(node);
+                        case "Literal":
+                            if (node.regex) assertSafeRegExpPattern(node.regex.pattern);
+                            return node.value;
+                        case "MemberExpression":
+                            return this.handleMemberExpression(node);
+                        case "ArrayExpression":
+                            return this.handleArrayExpression(node);
+                        case "SpreadElement":
+                            return this.handleSpreadElement(node);
+                        case "ObjectExpression":
+                            return this.handleObjectExpression(node);
+                        case "FunctionExpression":
+                            throw new SyntaxError(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                                "Function expression"
+                            ]));
+                        case "ArrowFunctionExpression":
+                            return this.handleArrowFunctionExpression(node);
+                        case "CallExpression":
+                            return this.handleCallExpression(node);
+                        case "ConditionalExpression":
+                            return this.visit(node.test) ? this.visit(node.consequent) : this.visit(node.alternate);
+                        case "NewExpression":
+                            if ("Identifier" !== node.callee.type) throw new Error("Unsupported callee type '".concat(node.callee.type, "' in new expression"));
+                            if ("Function" === node.callee.name) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                                "new Function() constructor"
+                            ]));
+                            if ("Promise" === node.callee.name) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                                "Promise constructor"
+                            ]));
+                            var Constructor = this.visit(node.callee);
+                            var args = node.arguments.length ? node.arguments.map(function(arg) {
+                                return _this.visit(arg);
+                            }) : [];
+                            this.assertBoundedConstruction(Constructor, args);
+                            return _construct(Constructor, Evaluator_to_consumable_array(args));
+                        case "ChainExpression":
+                            return this.visit(node.expression);
+                        case "TemplateLiteral":
+                            return this.handleTemplateLiteral(node);
+                        case "ThisExpression":
+                            throw new SyntaxError(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                                "'this' expression"
+                            ]));
+                        case "WithStatement":
+                            throw new SyntaxError(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                                "'with' statement"
+                            ]));
+                        default:
+                            var content = this.source.slice(node.start, node.end);
+                            if (content.length > 20) content = content.slice(0, 17) + "...";
+                            throw new SyntaxError("'".concat(content, "'") + " " + renderErrorMessage(ERROR_MESSAGES.IS_INVALID_SYNTAX, [
+                                content
+                            ]));
+                    }
+                } finally{
+                    this.evaluationDepth--;
                 }
             }
         },
@@ -752,14 +1530,24 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                     var rightBits = right.toString(2).length;
                     if ("**" === op && leftBits * Number(right) > MAX_BIGINT_BITS || "<<" === op && right > BigInt(MAX_BIGINT_BITS) || "<<" === op && right >= 0n && leftBits + Number(right) > MAX_BIGINT_BITS || "*" === op && leftBits + rightBits > MAX_BIGINT_BITS || ("+" === op || "-" === op) && Math.max(leftBits, rightBits) + 1 > MAX_BIGINT_BITS) throw new RangeError("BigInt result exceeds the maximum allowed size");
                 }
-                if (BINARY_OPERATION_MAP.hasOwnProperty(op)) return BINARY_OPERATION_MAP[op](left, right);
+                var apply = BINARY_OPERATION_MAP.get(op);
+                if (void 0 !== apply) return apply(left, right);
                 throw new SyntaxError("Unsupported operator: ".concat(node.operator));
             }
         },
+        {
+            key: "assertBoundedRegExp",
+            value: function(args) {
+                if ("string" == typeof args[0] && args[0].length > MAX_REGEXP_SOURCE_LENGTH) throw new RangeError("RegExp source exceeds the maximum allowed length");
+                if ("string" == typeof args[1] && args[1].length > MAX_REGEXP_FLAGS_LENGTH) throw new RangeError("RegExp flags exceed the maximum allowed length");
+                assertSafeRegExpPattern(args[0]);
+            }
+        },
         {
             key: "assertBoundedConstruction",
             value: function(Constructor, args) {
                 var _args_;
+                if (Constructor === RegExp) this.assertBoundedRegExp(args);
                 var size = args[0];
                 if (Constructor === Array && 1 === args.length && "number" == typeof size && size > MAX_ARRAY_LENGTH) throw new RangeError("Array length exceeds the maximum allowed length");
                 if (Constructor === ArrayBuffer && (size > MAX_BUFFER_BYTES || (null == (_args_ = args[1]) ? void 0 : _args_.maxByteLength) > MAX_BUFFER_BYTES)) throw new RangeError("ArrayBuffer size exceeds the maximum allowed size");
@@ -769,7 +1557,7 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                     var collectionSize = "string" == typeof size || Array.isArray(size) ? size.length : null != (_size_size = null == size ? void 0 : size.size) ? _size_size : null == size ? void 0 : size.length;
                     if ("number" == typeof collectionSize && collectionSize > MAX_ARRAY_LENGTH) throw new RangeError("Collection source exceeds the maximum allowed size");
                 }
-                if (TYPED_ARRAY_CONSTRUCTORS.has(Constructor)) {
+                if (isTypedArrayConstructor(Constructor)) {
                     var byteLength;
                     if (_instanceof(size, ArrayBuffer)) {
                         var _args_1;
@@ -833,21 +1621,10 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
             key: "handleIdentifier",
             value: function(node) {
                 var name = node.name;
-                var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
-                try {
-                    for(var _iterator = this.scopes[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                        var scope = _step.value;
-                        if (Object.hasOwn(scope, name)) return scope[name];
-                    }
-                } catch (err) {
-                    _didIteratorError = true;
-                    _iteratorError = err;
-                } finally{
-                    try {
-                        if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
-                    } finally{
-                        if (_didIteratorError) throw _iteratorError;
-                    }
+                var scopes = this.scopes;
+                for(var i = 0; i < scopes.length; i++){
+                    var scope = scopes[i];
+                    if (Object.hasOwn(scope, name)) return scope[name];
                 }
                 throw new ReferenceError(renderErrorMessage(ERROR_MESSAGES.IS_NOT_DEFINED, [
                     name
@@ -864,9 +1641,6 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 if ("stack" === property && _instanceof(object, Error)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
                     "Accessing error stack"
                 ]));
-                if (null != object && object[property] === (null == object ? void 0 : object.__proto__)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
-                    "Accessing prototype properties"
-                ]));
                 if (null == object) {
                     if (node.optional) return;
                     throw new TypeError(renderErrorMessage(ERROR_MESSAGES.CAN_NOT_READ_PROPERTY, [
@@ -878,6 +1652,10 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 if (result === Function || result === Function.prototype) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
                     "Function constructor"
                 ]));
+                var prototype = object.__proto__;
+                if (void 0 !== prototype && result === prototype) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                    "Accessing prototype properties"
+                ]));
                 return result;
             }
         },
@@ -886,7 +1664,7 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
             value: function(node) {
                 var result = [];
                 for(var i = 0; i < node.elements.length; i++){
-                    var element = node.elements.at(i);
+                    var element = node.elements[i];
                     if (null === element) {
                         result.length++;
                         continue;
@@ -957,6 +1735,24 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
             key: "handleArrowFunctionExpression",
             value: function(node) {
                 var _this = this;
+                var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = void 0;
+                try {
+                    for(var _iterator = node.params[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                        var param = _step.value;
+                        if ("Identifier" !== param.type) throw new SyntaxError(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                            "Destructuring, default, and rest parameters"
+                        ]));
+                    }
+                } catch (err) {
+                    _didIteratorError = true;
+                    _iteratorError = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion && null != _iterator.return) _iterator.return();
+                    } finally{
+                        if (_didIteratorError) throw _iteratorError;
+                    }
+                }
                 return function() {
                     for(var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++)args[_key] = arguments[_key];
                     var newScope = {};
@@ -997,20 +1793,21 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                 if (func === Function) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
                     "Function constructor"
                 ]));
-                if (func === Error.prepareStackTrace) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                if ("function" == typeof func && func === Error.prepareStackTrace) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
                     "Error.prepareStackTrace"
                 ]));
-                if (getBlockedMethods().has(func)) {
-                    var path = getBlockedMethods().get(func);
-                    throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
-                        path
-                    ]));
-                }
+                var blockedPath = getBlockedMethods().get(func);
+                if (void 0 !== blockedPath) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                    blockedPath
+                ]));
+                if (TYPED_ARRAY_MUTATORS.has(func)) throw new Error(renderErrorMessage(ERROR_MESSAGES.IS_NOT_ALLOWED, [
+                    "TypedArray.prototype.".concat(TYPED_ARRAY_MUTATORS.get(func))
+                ]));
                 var args = function() {
                     if (0 === node.arguments.length) return [];
                     var result = [];
                     for(var i = 0; i < node.arguments.length; i++){
-                        var element = node.arguments.at(i);
+                        var element = node.arguments[i];
                         var value = _this.visit(element);
                         if ("SpreadElement" === element.type) {
                             var _result;
@@ -1035,19 +1832,27 @@ var Evaluator_Evaluator = /*#__PURE__*/ function() {
                         if (resultLength > MAX_STRING_LENGTH) throw new RangeError("String result exceeds the maximum allowed length");
                     }
                     if (String.prototype.replace && func === String.prototype.replace || String.prototype.replaceAll && func === String.prototype.replaceAll) {
-                        if ("string" == typeof args[0]) {
-                            if ("function" == typeof args[1] || "string" == typeof args[1] && RegExp("\\$(?:[$&'`])", "u").test(args[1])) throw new Error("Only literal string replacements are allowed");
-                            if (target.length * Math.max(1, args[0].length) > 10000000) throw new RangeError("String operation exceeds the maximum work limit");
-                            var matchCount = countLiteralMatches(target, args[0], func === String.prototype.replaceAll);
-                            if (target.length + matchCount * String(args[1]).length > MAX_STRING_LENGTH) throw new RangeError("String result exceeds the maximum allowed length");
-                        }
+                        var all = func === String.prototype.replaceAll;
+                        var search = args[0];
+                        var replacement = args[1];
+                        if ("function" == typeof replacement) throw new Error("Only literal string replacements are allowed");
+                        if ("string" == typeof replacement && RegExp("\\$(?:[$&'`])", "u").test(replacement)) throw new Error("Only literal string replacements are allowed");
+                        var matchCount;
+                        if ("string" == typeof search) {
+                            if (target.length * Math.max(1, search.length) > 10000000) throw new RangeError("String operation exceeds the maximum work limit");
+                            matchCount = countLiteralMatches(target, search, all);
+                        } else matchCount = _instanceof(search, RegExp) ? countRegExpMatches(target, search, all || search.flags.includes("g")) : 0;
+                        if (target.length + matchCount * String(replacement).length > MAX_STRING_LENGTH) throw new RangeError("String result exceeds the maximum allowed length");
                     }
                     if (func === String.prototype.split) {
                         if ("" === args[0] && target.length > MAX_ARRAY_LENGTH) throw new RangeError("Split result exceeds the maximum allowed length");
                         if ("string" == typeof args[0] && "" !== args[0] && countLiteralMatches(target, args[0], true) >= MAX_ARRAY_LENGTH) throw new RangeError("Split result exceeds the maximum allowed length");
+                        if (_instanceof(args[0], RegExp) && countRegExpMatches(target, args[0], true) >= MAX_ARRAY_LENGTH) throw new RangeError("Split result exceeds the maximum allowed length");
                     }
                 }
-                if ((target === Array || TYPED_ARRAY_CONSTRUCTORS.has(target)) && func === target.from) {
+                if (func === RegExp) this.assertBoundedRegExp(args);
+                assertSafeRegExpInvocation(func, target, args);
+                if ((target === Array || isTypedArrayConstructor(target)) && func === target.from) {
                     var source = args[0];
                     var _source_size;
                     var size = "string" == typeof source || Array.isArray(source) ? source.length : null != (_source_size = null == source ? void 0 : source.size) ? _source_size : null == source ? void 0 : source.length;
@@ -1097,7 +1902,7 @@ function getNodeString(node) {
             return node.raw;
         case "ArrayExpression":
             return "[".concat(node.elements.map(function(child) {
-                return getNodeString(child);
+                return null === child ? "" : getNodeString(child);
             }).join(","), "]");
         case "ObjectExpression":
             if (0 === node.properties.length) return "{}";
@@ -1170,6 +1975,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                 var buffer = "";
                 var exprStartPos = 0;
                 var pos = 0;
+                var prevExprChar = "";
                 while(pos < length){
                     var char = template[pos];
                     var nextChar = template[pos + 1];
@@ -1187,6 +1993,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                                 }
                                 state = "EXPR";
                                 exprStartPos = pos;
+                                prevExprChar = "";
                                 pos += this.startLen;
                                 continue;
                             }
@@ -1196,6 +2003,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                             if ("'" === char) state = "STRING_SQ";
                             else if ('"' === char) state = "STRING_DQ";
                             else if ("`" === char) state = "TEMPLATE";
+                            else if ("/" === char && this._isRegexPosition(prevExprChar)) state = "REGEX";
                             else if ("\\" === char) state = "'" === nextChar ? "ESCAPE_SQ" : '"' === nextChar ? "ESCAPE_DQ" : "`" === nextChar ? "ESCAPE_TEMPLATE" : "ESCAPE_EXPR";
                             else if (this._isMatch(pos, template, this.exprEnd)) {
                                 var exprValue = this.preserveWhitespace ? buffer : buffer.trim();
@@ -1212,6 +2020,7 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                                 pos += this.endLen;
                                 continue;
                             }
+                            if (!RegExp("\\s", "u").test(char)) prevExprChar = char;
                             buffer += char;
                             break;
                         case "STRING_SQ":
@@ -1229,6 +2038,17 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                             else if ("`" === char) state = "EXPR";
                             buffer += char;
                             break;
+                        case "REGEX":
+                            if ("\\" === char) state = "ESCAPE_REGEX";
+                            else if ("[" === char) state = "REGEX_CLASS";
+                            else if ("/" === char) state = "EXPR";
+                            buffer += char;
+                            break;
+                        case "REGEX_CLASS":
+                            if ("\\" === char) state = "ESCAPE_REGEX";
+                            else if ("]" === char) state = "REGEX";
+                            buffer += char;
+                            break;
                         case "ESCAPE_SQ":
                             buffer += char;
                             state = "STRING_SQ";
@@ -1241,6 +2061,10 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                             buffer += char;
                             state = "TEMPLATE";
                             break;
+                        case "ESCAPE_REGEX":
+                            buffer += char;
+                            state = "REGEX";
+                            break;
                         case "ESCAPE_EXPR":
                             buffer += char;
                             state = "EXPR";
@@ -1266,6 +2090,12 @@ var TemplateParser_TemplateParser = /*#__PURE__*/ function() {
                 return tokens;
             }
         },
+        {
+            key: "_isRegexPosition",
+            value: function(prev) {
+                return "" === prev || "(,=:[!&|?{};+-*%^~<>".includes(prev);
+            }
+        },
         {
             key: "_isMatch",
             value: function(pos, template, sequence) {