terser 5.13.1 → 5.14.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## v5.14.2
+
+ - Security fix for RegExps that should not be evaluated (regexp DDOS)
+ - Source maps improvements (#1211)
+ - Performance improvements in long property access evaluation (#1213)
+
+## v5.14.1
+ - keep_numbers option added to TypeScript defs (#1208)
+ - Fixed parsing of nested template strings (#1204)
+
+## v5.14.0
+ - Switched to @jridgewell/source-map for sourcemap generation (#1190, #1181)
+ - Fixed source maps with non-terminated segments (#1106)
+ - Enabled typescript types to be imported from the package (#1194)
+ - Extra DOM props have been added (#1191)
+ - Delete the AST while generating code, as a means to save RAM
+
 ## v5.13.1
  - Removed self-assignments (`varname=varname`) (closes #1081)
  - Separated inlining code (for inlining things into references, or removing IIFEs)
@@ -195,6 +212,13 @@ Hotfix release, fixes package.json "engines" syntax
  - Module is now distributed as a dual package - You can `import` and `require()` too.
  - Inline improvements were made
 
+
+-----
+
+## v4.8.1 (backport)
+
+ - Security fix for RegExps that should not be evaluated (regexp DDOS)
+
 ## v4.8.0
 
  - Support for numeric separators (`million = 1_000_000`) was added.

package/dist/bundle.min.js

@@ -1,12 +1,8 @@
 (function (global, factory) {
-typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('source-map')) :
-typeof define === 'function' && define.amd ? define(['exports', 'source-map'], factory) :
+typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('@jridgewell/source-map')) :
+typeof define === 'function' && define.amd ? define(['exports', '@jridgewell/source-map'], factory) :
 (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.Terser = {}, global.sourceMap));
-}(this, (function (exports, MOZ_SourceMap) { 'use strict';
-
-function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
-
-var MOZ_SourceMap__default = /*#__PURE__*/_interopDefaultLegacy(MOZ_SourceMap);
+}(this, (function (exports, sourceMap) { 'use strict';
 
 /***********************************************************************
 
@@ -257,7 +253,15 @@ function regexp_source_fix(source) {
         return (escaped ? "" : "\\") + lineTerminatorEscape[match];
     });
 }
-const all_flags = "gimuy";
+
+// Subset of regexps that is not going to cause regexp based DDOS
+// https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
+const re_safe_regexp = /^[\\/|\0\s\w^$.[\]()]*$/;
+
+/** Check if the regexp is safe for Terser to create without risking a RegExp DOS */
+const regexp_is_safe = (source) => re_safe_regexp.test(source);
+
+const all_flags = "dgimsuy";
 function sort_regexp_flags(flags) {
     const existing_flags = new Set(flags.split(""));
     let out = "";
@@ -327,7 +331,7 @@ function set_annotation(node, annotation) {
  ***********************************************************************/
 
 var LATEST_RAW = "";  // Only used for numbers and template strings
-var LATEST_TEMPLATE_END = true;
+var TEMPLATE_RAWS = new Map();  // Raw template strings
 
 var KEYWORDS = "break case catch class const continue debugger default delete do else export extends finally for function if in instanceof let new return switch throw try typeof var void while with";
 var KEYWORDS_ATOM = "false null true";
@@ -858,8 +862,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
                 next(true, true);
                 S.brace_counter++;
                 tok = token(begin ? "template_head" : "template_substitution", content);
-                LATEST_RAW = raw;
-                LATEST_TEMPLATE_END = false;
+                TEMPLATE_RAWS.set(tok, raw);
+                tok.template_end = false;
                 return tok;
             }
 
@@ -875,8 +879,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
         }
         S.template_braces.pop();
         tok = token(begin ? "template_head" : "template_substitution", content);
-        LATEST_RAW = raw;
-        LATEST_TEMPLATE_END = true;
+        TEMPLATE_RAWS.set(tok, raw);
+        tok.template_end = true;
         return tok;
     });
 
@@ -2532,19 +2536,19 @@ function parse($TEXT, options) {
 
         segments.push(new AST_TemplateSegment({
             start: S.token,
-            raw: LATEST_RAW,
+            raw: TEMPLATE_RAWS.get(S.token),
             value: S.token.value,
             end: S.token
         }));
 
-        while (!LATEST_TEMPLATE_END) {
+        while (!S.token.template_end) {
             next();
             handle_regexp();
             segments.push(expression(true));
 
             segments.push(new AST_TemplateSegment({
                 start: S.token,
-                raw: LATEST_RAW,
+                raw: TEMPLATE_RAWS.get(S.token),
                 value: S.token.value,
                 end: S.token
             }));
@@ -3507,6 +3511,7 @@ function parse($TEXT, options) {
         } else {
             toplevel = new AST_Toplevel({ start: start, body: body, end: end });
         }
+        TEMPLATE_RAWS = new Map();
         return toplevel;
     })();
 
@@ -3600,6 +3605,7 @@ const set_tok_flag = (tok, flag, truth) => {
 const TOK_FLAG_NLB          = 0b0001;
 const TOK_FLAG_QUOTE_SINGLE = 0b0010;
 const TOK_FLAG_QUOTE_EXISTS = 0b0100;
+const TOK_FLAG_TEMPLATE_END = 0b1000;
 
 class AST_Token {
     constructor(type, value, line, col, pos, nlb, comments_before, comments_after, file) {
@@ -3635,6 +3641,14 @@ class AST_Token {
         set_tok_flag(this, TOK_FLAG_QUOTE_SINGLE, quote_type === "'");
         set_tok_flag(this, TOK_FLAG_QUOTE_EXISTS, !!quote_type);
     }
+
+    get template_end() {
+        return has_tok_flag(this, TOK_FLAG_TEMPLATE_END);
+    }
+
+    set template_end(new_template_end) {
+        set_tok_flag(this, TOK_FLAG_TEMPLATE_END, new_template_end);
+    }
 }
 
 var AST_Node = DEFNODE("Node", "start end", function AST_Node(props) {
@@ -4059,11 +4073,10 @@ var AST_With = DEFNODE("With", "expression", function AST_With(props) {
 
 var AST_Scope = DEFNODE(
     "Scope",
-    "variables functions uses_with uses_eval parent_scope enclosed cname",
+    "variables uses_with uses_eval parent_scope enclosed cname",
     function AST_Scope(props) {
         if (props) {
             this.variables = props.variables;
-            this.functions = props.functions;
             this.uses_with = props.uses_with;
             this.uses_eval = props.uses_eval;
             this.parent_scope = props.parent_scope;
@@ -4119,7 +4132,6 @@ var AST_Toplevel = DEFNODE("Toplevel", "globals", function AST_Toplevel(props) {
     if (props) {
         this.globals = props.globals;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -4201,7 +4213,6 @@ var AST_Lambda = DEFNODE(
             this.is_generator = props.is_generator;
             this.async = props.async;
             this.variables = props.variables;
-            this.functions = props.functions;
             this.uses_with = props.uses_with;
             this.uses_eval = props.uses_eval;
             this.parent_scope = props.parent_scope;
@@ -4281,7 +4292,6 @@ var AST_Accessor = DEFNODE("Accessor", null, function AST_Accessor(props) {
         this.is_generator = props.is_generator;
         this.async = props.async;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -4306,7 +4316,6 @@ var AST_Function = DEFNODE("Function", null, function AST_Function(props) {
         this.is_generator = props.is_generator;
         this.async = props.async;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -4331,7 +4340,6 @@ var AST_Arrow = DEFNODE("Arrow", null, function AST_Arrow(props) {
         this.is_generator = props.is_generator;
         this.async = props.async;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -4356,7 +4364,6 @@ var AST_Defun = DEFNODE("Defun", null, function AST_Defun(props) {
         this.is_generator = props.is_generator;
         this.async = props.async;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -5668,7 +5675,6 @@ var AST_Class = DEFNODE("Class", "name extends properties", function AST_Class(p
         this.extends = props.extends;
         this.properties = props.properties;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -5762,7 +5768,6 @@ var AST_DefClass = DEFNODE("DefClass", null, function AST_DefClass(props) {
         this.extends = props.extends;
         this.properties = props.properties;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -5785,7 +5790,6 @@ var AST_ClassExpression = DEFNODE("ClassExpression", null, function AST_ClassExp
         this.extends = props.extends;
         this.properties = props.properties;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -8644,6 +8648,8 @@ function OutputStream(options) {
         width                : 80,
         wrap_iife            : false,
         wrap_func_args       : true,
+
+        _destroy_ast         : false
     }, true);
 
     if (options.shorthand === undefined)
@@ -9193,6 +9199,18 @@ function OutputStream(options) {
         if (OUTPUT.length() > insert) newline_insert = insert;
     }
 
+    /**
+     * When output.option("_destroy_ast") is enabled, destroy the function.
+     * Call this after printing it.
+     */
+    const gc_scope =
+      options["_destroy_ast"]
+        ? function gc_scope(scope) {
+            scope.body.length = 0;
+            scope.argnames.length = 0;
+        }
+        : noop;
+
     var stack = [];
     return {
         get             : get,
@@ -9239,6 +9257,7 @@ function OutputStream(options) {
         with_square     : with_square,
         add_mapping     : add_mapping,
         option          : function(opt) { return options[opt]; },
+        gc_scope,
         printed_comments: printed_comments,
         prepend_comments: readonly ? noop : prepend_comments,
         append_comments : readonly || comment_filter === return_false ? noop : append_comments,
@@ -9629,12 +9648,14 @@ function OutputStream(options) {
         output.with_indent(output.next_indent(), function() {
             output.append_comments(self, true);
         });
+        output.add_mapping(self.end);
         output.print("}");
     }
     function print_braced(self, output, allow_directives) {
         if (self.body.length > 0) {
             output.with_block(function() {
                 display_body(self.body, false, output, allow_directives);
+                output.add_mapping(self.end);
             });
         } else print_braced_empty(self, output);
     }
@@ -9755,6 +9776,7 @@ function OutputStream(options) {
     });
     DEFPRINT(AST_Lambda, function(self, output) {
         self._do_print(output);
+        output.gc_scope(self);
     });
 
     DEFPRINT(AST_PrefixedTemplateString, function(self, output) {
@@ -9834,6 +9856,7 @@ function OutputStream(options) {
             print_braced(self, output);
         }
         if (needs_parens) { output.print(")"); }
+        output.gc_scope(self);
     });
 
     /* -----[ exits ]----- */
@@ -13838,7 +13861,7 @@ def_eval(AST_BigInt, return_this);
 
 def_eval(AST_RegExp, function (compressor) {
     let evaluated = compressor.evaluated_regexps.get(this.value);
-    if (evaluated === undefined) {
+    if (evaluated === undefined && regexp_is_safe(this.value.source)) {
         try {
             const { source, flags } = this.value;
             evaluated = new RegExp(source, flags);
@@ -14051,7 +14074,7 @@ const regexp_flags = new Set([
 ]);
 
 def_eval(AST_PropAccess, function (compressor, depth) {
-    const obj = this.expression._eval(compressor, depth);
+    let obj = this.expression._eval(compressor, depth + 1);
     if (obj === nullish || (this.optional && obj == null)) return nullish;
     if (compressor.option("unsafe")) {
         var key = this.property;
@@ -14061,7 +14084,6 @@ def_eval(AST_PropAccess, function (compressor, depth) {
                 return this;
         }
         var exp = this.expression;
-        var val;
         if (is_undeclared_ref(exp)) {
 
             var aa;
@@ -14078,29 +14100,29 @@ def_eval(AST_PropAccess, function (compressor, depth) {
             }
             if (!is_pure_native_value(exp.name, key))
                 return this;
-            val = global_objs[exp.name];
+            obj = global_objs[exp.name];
         } else {
-            val = exp._eval(compressor, depth + 1);
-            if (val instanceof RegExp) {
+            if (obj instanceof RegExp) {
                 if (key == "source") {
-                    return regexp_source_fix(val.source);
+                    return regexp_source_fix(obj.source);
                 } else if (key == "flags" || regexp_flags.has(key)) {
-                    return val[key];
+                    return obj[key];
                 }
             }
-            if (!val || val === exp || !HOP(val, key))
+            if (!obj || obj === exp || !HOP(obj, key))
                 return this;
-            if (typeof val == "function")
+
+            if (typeof obj == "function")
                 switch (key) {
                     case "name":
-                        return val.node.name ? val.node.name.name : "";
+                        return obj.node.name ? obj.node.name.name : "";
                     case "length":
-                        return val.node.length_property();
+                        return obj.node.length_property();
                     default:
                         return this;
                 }
         }
-        return val[key];
+        return obj[key];
     }
     return this;
 });
@@ -18979,6 +19001,7 @@ def_optimize(AST_Call, function(self, compressor) {
                     params.push(value);
                     return arg !== value;
                 })
+                && regexp_is_safe(params[0])
             ) {
                 let [ source, flags ] = params;
                 source = regexp_source_fix(new RegExp(source).source);
@@ -20638,6 +20661,12 @@ def_optimize(AST_Dot, function(self, compressor) {
         const sub = self.flatten_object(self.property, compressor);
         if (sub) return sub.optimize(compressor);
     }
+
+    if (self.expression instanceof AST_PropAccess
+        && parent instanceof AST_PropAccess) {
+        return self;
+    }
+
     let ev = self.evaluate(compressor);
     if (ev !== self) {
         ev = make_node_from_constant(ev, self).optimize(compressor);
@@ -21021,40 +21050,56 @@ def_optimize(AST_Destructuring, function(self, compressor) {
 
  ***********************************************************************/
 
-// a small wrapper around fitzgen's source-map library
+// a small wrapper around source-map and @jridgewell/source-map
 async function SourceMap(options) {
     options = defaults(options, {
         file : null,
         root : null,
         orig : null,
-
-        orig_line_diff : 0,
-        dest_line_diff : 0,
+        files: {},
     });
 
     var orig_map;
-    var generator = new MOZ_SourceMap__default['default'].SourceMapGenerator({
+    var generator = new sourceMap.SourceMapGenerator({
         file       : options.file,
         sourceRoot : options.root
     });
 
+    let sourcesContent = {__proto__: null};
+    let files = options.files;
+    for (var name in files) if (HOP(files, name)) {
+        sourcesContent[name] = files[name];
+    }
     if (options.orig) {
-        orig_map = await new MOZ_SourceMap__default['default'].SourceMapConsumer(options.orig);
-        orig_map.sources.forEach(function(source) {
-            var sourceContent = orig_map.sourceContentFor(source, true);
-            if (sourceContent) {
-                generator.setSourceContent(source, sourceContent);
-            }
-        });
+        // We support both @jridgewell/source-map (which has a sync
+        // SourceMapConsumer) and source-map (which has an async
+        // SourceMapConsumer).
+        orig_map = await new sourceMap.SourceMapConsumer(options.orig);
+        if (orig_map.sourcesContent) {
+            orig_map.sources.forEach(function(source, i) {
+                var content = orig_map.sourcesContent[i];
+                if (content) {
+                    sourcesContent[source] = content;
+                }
+            });
+        }
     }
 
     function add(source, gen_line, gen_col, orig_line, orig_col, name) {
+        let generatedPos = { line: gen_line, column: gen_col };
+
         if (orig_map) {
             var info = orig_map.originalPositionFor({
                 line: orig_line,
                 column: orig_col
             });
             if (info.source === null) {
+                generator.addMapping({
+                    generated: generatedPos,
+                    original: null,
+                    source: null,
+                    name: null
+                });
                 return;
             }
             source = info.source;
@@ -21063,22 +21108,42 @@ async function SourceMap(options) {
             name = info.name || name;
         }
         generator.addMapping({
-            generated : { line: gen_line + options.dest_line_diff, column: gen_col },
-            original  : { line: orig_line + options.orig_line_diff, column: orig_col },
+            generated : generatedPos,
+            original  : { line: orig_line, column: orig_col },
             source    : source,
             name      : name
         });
+        generator.setSourceContent(source, sourcesContent[source]);
+    }
+
+    function clean(map) {
+        const allNull = map.sourcesContent && map.sourcesContent.every(c => c == null);
+        if (allNull) delete map.sourcesContent;
+        if (map.file === undefined) delete map.file;
+        if (map.sourceRoot === undefined) delete map.sourceRoot;
+        return map;
+    }
+
+    function getDecoded() {
+        if (!generator.toDecodedMap) return null;
+        return clean(generator.toDecodedMap());
+    }
+
+    function getEncoded() {
+        return clean(generator.toJSON());
+    }
+
+    function destroy() {
+        // @jridgewell/source-map's SourceMapConsumer does not need to be
+        // manually freed.
+        if (orig_map && orig_map.destroy) orig_map.destroy();
     }
 
     return {
-        add        : add,
-        get        : function() { return generator; },
-        toString   : function() { return generator.toString(); },
-        destroy    : function () {
-            if (orig_map && orig_map.destroy) {
-                orig_map.destroy();
-            }
-        }
+        add,
+        getDecoded,
+        getEncoded,
+        destroy,
     };
 }
 
@@ -21404,6 +21469,7 @@ var domprops = [
     "COMMENT_NODE",
     "COMPARE_REF_TO_TEXTURE",
     "COMPILE_STATUS",
+    "COMPLETION_STATUS_KHR",
     "COMPRESSED_RGBA_S3TC_DXT1_EXT",
     "COMPRESSED_RGBA_S3TC_DXT3_EXT",
     "COMPRESSED_RGBA_S3TC_DXT5_EXT",
@@ -29379,6 +29445,8 @@ async function minify(files, options, _fs_module) {
             url: null,
         }, true);
     }
+
+    // -- Parse phase --
     if (timings) timings.parse = Date.now();
     var toplevel;
     if (files instanceof AST_Toplevel) {
@@ -29422,12 +29490,16 @@ async function minify(files, options, _fs_module) {
         toplevel = toplevel.wrap_enclose(options.enclose);
     }
     if (timings) timings.rename = Date.now();
+
+    // -- Compress phase --
     if (timings) timings.compress = Date.now();
     if (options.compress) {
         toplevel = new Compressor(options.compress, {
             mangle_options: options.mangle
         }).compress(toplevel);
     }
+
+    // -- Mangle phase --
     if (timings) timings.scope = Date.now();
     if (options.mangle) toplevel.figure_out_scope(options.mangle);
     if (timings) timings.mangle = Date.now();
@@ -29440,6 +29512,8 @@ async function minify(files, options, _fs_module) {
     if (options.mangle && options.mangle.properties) {
         toplevel = mangle_properties(toplevel, options.mangle.properties);
     }
+
+    // Format phase
     if (timings) timings.format = Date.now();
     var result = {};
     if (options.format.ast) {
@@ -29449,19 +29523,34 @@ async function minify(files, options, _fs_module) {
         result.ast = toplevel.to_mozilla_ast();
     }
     if (!HOP(options.format, "code") || options.format.code) {
+        if (!options.format.ast) {
+            // Destroy stuff to save RAM. (unless the deprecated `ast` option is on)
+            options.format._destroy_ast = true;
+
+            walk(toplevel, node => {
+                if (node instanceof AST_Scope) {
+                    node.variables = undefined;
+                    node.enclosed = undefined;
+                    node.parent_scope = undefined;
+                }
+                if (node.block_scope) {
+                    node.block_scope.variables = undefined;
+                    node.block_scope.enclosed = undefined;
+                    node.parent_scope = undefined;
+                }
+            });
+        }
+
         if (options.sourceMap) {
+            if (options.sourceMap.includeSources && files instanceof AST_Toplevel) {
+                throw new Error("original source content unavailable");
+            }
             options.format.source_map = await SourceMap({
                 file: options.sourceMap.filename,
                 orig: options.sourceMap.content,
-                root: options.sourceMap.root
+                root: options.sourceMap.root,
+                files: options.sourceMap.includeSources ? files : null,
             });
-            if (options.sourceMap.includeSources) {
-                if (files instanceof AST_Toplevel) {
-                    throw new Error("original source content unavailable");
-                } else for (var name in files) if (HOP(files, name)) {
-                    options.format.source_map.get().setSourceContent(name, files[name]);
-                }
-            }
         }
         delete options.format.ast;
         delete options.format.code;
@@ -29470,11 +29559,21 @@ async function minify(files, options, _fs_module) {
         toplevel.print(stream);
         result.code = stream.get();
         if (options.sourceMap) {
-            if(options.sourceMap.asObject) {
-                result.map = options.format.source_map.get().toJSON();
-            } else {
-                result.map = options.format.source_map.toString();
-            }
+            Object.defineProperty(result, "map", {
+                configurable: true,
+                enumerable: true,
+                get() {
+                    const map = options.format.source_map.getEncoded();
+                    return (result.map = options.sourceMap.asObject ? map : JSON.stringify(map));
+                },
+                set(value) {
+                    Object.defineProperty(result, "map", {
+                        value,
+                        writable: true,
+                    });
+                }
+            });
+            result.decoded_map = options.format.source_map.getDecoded();
             if (options.sourceMap.url == "inline") {
                 var sourceMap = typeof result.map === "object" ? JSON.stringify(result.map) : result.map;
                 result.code += "\n//# sourceMappingURL=data:application/json;charset=utf-8;base64," + to_base64(sourceMap);

package/lib/ast.js

@@ -93,6 +93,7 @@ const set_tok_flag = (tok, flag, truth) => {
 const TOK_FLAG_NLB          = 0b0001;
 const TOK_FLAG_QUOTE_SINGLE = 0b0010;
 const TOK_FLAG_QUOTE_EXISTS = 0b0100;
+const TOK_FLAG_TEMPLATE_END = 0b1000;
 
 class AST_Token {
     constructor(type, value, line, col, pos, nlb, comments_before, comments_after, file) {
@@ -128,6 +129,14 @@ class AST_Token {
         set_tok_flag(this, TOK_FLAG_QUOTE_SINGLE, quote_type === "'");
         set_tok_flag(this, TOK_FLAG_QUOTE_EXISTS, !!quote_type);
     }
+
+    get template_end() {
+        return has_tok_flag(this, TOK_FLAG_TEMPLATE_END);
+    }
+
+    set template_end(new_template_end) {
+        set_tok_flag(this, TOK_FLAG_TEMPLATE_END, new_template_end);
+    }
 }
 
 var AST_Node = DEFNODE("Node", "start end", function AST_Node(props) {
@@ -552,11 +561,10 @@ var AST_With = DEFNODE("With", "expression", function AST_With(props) {
 
 var AST_Scope = DEFNODE(
     "Scope",
-    "variables functions uses_with uses_eval parent_scope enclosed cname",
+    "variables uses_with uses_eval parent_scope enclosed cname",
     function AST_Scope(props) {
         if (props) {
             this.variables = props.variables;
-            this.functions = props.functions;
             this.uses_with = props.uses_with;
             this.uses_eval = props.uses_eval;
             this.parent_scope = props.parent_scope;
@@ -612,7 +620,6 @@ var AST_Toplevel = DEFNODE("Toplevel", "globals", function AST_Toplevel(props) {
     if (props) {
         this.globals = props.globals;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -694,7 +701,6 @@ var AST_Lambda = DEFNODE(
             this.is_generator = props.is_generator;
             this.async = props.async;
             this.variables = props.variables;
-            this.functions = props.functions;
             this.uses_with = props.uses_with;
             this.uses_eval = props.uses_eval;
             this.parent_scope = props.parent_scope;
@@ -774,7 +780,6 @@ var AST_Accessor = DEFNODE("Accessor", null, function AST_Accessor(props) {
         this.is_generator = props.is_generator;
         this.async = props.async;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -799,7 +804,6 @@ var AST_Function = DEFNODE("Function", null, function AST_Function(props) {
         this.is_generator = props.is_generator;
         this.async = props.async;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -824,7 +828,6 @@ var AST_Arrow = DEFNODE("Arrow", null, function AST_Arrow(props) {
         this.is_generator = props.is_generator;
         this.async = props.async;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -849,7 +852,6 @@ var AST_Defun = DEFNODE("Defun", null, function AST_Defun(props) {
         this.is_generator = props.is_generator;
         this.async = props.async;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -2161,7 +2163,6 @@ var AST_Class = DEFNODE("Class", "name extends properties", function AST_Class(p
         this.extends = props.extends;
         this.properties = props.properties;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -2255,7 +2256,6 @@ var AST_DefClass = DEFNODE("DefClass", null, function AST_DefClass(props) {
         this.extends = props.extends;
         this.properties = props.properties;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;
@@ -2278,7 +2278,6 @@ var AST_ClassExpression = DEFNODE("ClassExpression", null, function AST_ClassExp
         this.extends = props.extends;
         this.properties = props.properties;
         this.variables = props.variables;
-        this.functions = props.functions;
         this.uses_with = props.uses_with;
         this.uses_eval = props.uses_eval;
         this.parent_scope = props.parent_scope;

package/lib/compress/evaluate.js

@@ -46,7 +46,8 @@ import {
     makePredicate,
     return_this,
     string_template,
-    regexp_source_fix
+    regexp_source_fix,
+    regexp_is_safe,
 } from "../utils/index.js";
 import {
     AST_Array,
@@ -129,7 +130,7 @@ def_eval(AST_BigInt, return_this);
 
 def_eval(AST_RegExp, function (compressor) {
     let evaluated = compressor.evaluated_regexps.get(this.value);
-    if (evaluated === undefined) {
+    if (evaluated === undefined && regexp_is_safe(this.value.source)) {
         try {
             const { source, flags } = this.value;
             evaluated = new RegExp(source, flags);
@@ -342,7 +343,7 @@ const regexp_flags = new Set([
 ]);
 
 def_eval(AST_PropAccess, function (compressor, depth) {
-    const obj = this.expression._eval(compressor, depth);
+    let obj = this.expression._eval(compressor, depth + 1);
     if (obj === nullish || (this.optional && obj == null)) return nullish;
     if (compressor.option("unsafe")) {
         var key = this.property;
@@ -352,7 +353,6 @@ def_eval(AST_PropAccess, function (compressor, depth) {
                 return this;
         }
         var exp = this.expression;
-        var val;
         if (is_undeclared_ref(exp)) {
 
             var aa;
@@ -369,29 +369,29 @@ def_eval(AST_PropAccess, function (compressor, depth) {
             }
             if (!is_pure_native_value(exp.name, key))
                 return this;
-            val = global_objs[exp.name];
+            obj = global_objs[exp.name];
         } else {
-            val = exp._eval(compressor, depth + 1);
-            if (val instanceof RegExp) {
+            if (obj instanceof RegExp) {
                 if (key == "source") {
-                    return regexp_source_fix(val.source);
+                    return regexp_source_fix(obj.source);
                 } else if (key == "flags" || regexp_flags.has(key)) {
-                    return val[key];
+                    return obj[key];
                 }
             }
-            if (!val || val === exp || !HOP(val, key))
+            if (!obj || obj === exp || !HOP(obj, key))
                 return this;
-            if (typeof val == "function")
+
+            if (typeof obj == "function")
                 switch (key) {
                     case "name":
-                        return val.node.name ? val.node.name.name : "";
+                        return obj.node.name ? obj.node.name.name : "";
                     case "length":
-                        return val.node.length_property();
+                        return obj.node.length_property();
                     default:
                         return this;
                 }
         }
-        return val[key];
+        return obj[key];
     }
     return this;
 });

package/lib/compress/index.js

@@ -158,6 +158,7 @@ import {
     return_true,
     regexp_source_fix,
     has_annotation,
+    regexp_is_safe,
 } from "../utils/index.js";
 import { first_in_statement } from "../utils/first_in_statement.js";
 import { equivalent_to } from "../equivalent-to.js";
@@ -2140,6 +2141,7 @@ def_optimize(AST_Call, function(self, compressor) {
                     params.push(value);
                     return arg !== value;
                 })
+                && regexp_is_safe(params[0])
             ) {
                 let [ source, flags ] = params;
                 source = regexp_source_fix(new RegExp(source).source);
@@ -3799,6 +3801,12 @@ def_optimize(AST_Dot, function(self, compressor) {
         const sub = self.flatten_object(self.property, compressor);
         if (sub) return sub.optimize(compressor);
     }
+
+    if (self.expression instanceof AST_PropAccess
+        && parent instanceof AST_PropAccess) {
+        return self;
+    }
+
     let ev = self.evaluate(compressor);
     if (ev !== self) {
         ev = make_node_from_constant(ev, self).optimize(compressor);

package/lib/minify.js

@@ -7,7 +7,7 @@ import {
     map_to_object,
     HOP,
 } from "./utils/index.js";
-import { AST_Toplevel, AST_Node } from "./ast.js";
+import { AST_Toplevel, AST_Node, walk, AST_Scope } from "./ast.js";
 import { parse } from "./parse.js";
 import { OutputStream } from "./output.js";
 import { Compressor } from "./compress/index.js";
@@ -194,6 +194,8 @@ async function minify(files, options, _fs_module) {
             url: null,
         }, true);
     }
+
+    // -- Parse phase --
     if (timings) timings.parse = Date.now();
     var toplevel;
     if (files instanceof AST_Toplevel) {
@@ -243,12 +245,16 @@ async function minify(files, options, _fs_module) {
         toplevel.figure_out_scope(options.mangle);
         toplevel.expand_names(options.mangle);
     }
+
+    // -- Compress phase --
     if (timings) timings.compress = Date.now();
     if (options.compress) {
         toplevel = new Compressor(options.compress, {
             mangle_options: options.mangle
         }).compress(toplevel);
     }
+
+    // -- Mangle phase --
     if (timings) timings.scope = Date.now();
     if (options.mangle) toplevel.figure_out_scope(options.mangle);
     if (timings) timings.mangle = Date.now();
@@ -261,6 +267,8 @@ async function minify(files, options, _fs_module) {
     if (options.mangle && options.mangle.properties) {
         toplevel = mangle_properties(toplevel, options.mangle.properties);
     }
+
+    // Format phase
     if (timings) timings.format = Date.now();
     var result = {};
     if (options.format.ast) {
@@ -270,19 +278,34 @@ async function minify(files, options, _fs_module) {
         result.ast = toplevel.to_mozilla_ast();
     }
     if (!HOP(options.format, "code") || options.format.code) {
+        if (!options.format.ast) {
+            // Destroy stuff to save RAM. (unless the deprecated `ast` option is on)
+            options.format._destroy_ast = true;
+
+            walk(toplevel, node => {
+                if (node instanceof AST_Scope) {
+                    node.variables = undefined;
+                    node.enclosed = undefined;
+                    node.parent_scope = undefined;
+                }
+                if (node.block_scope) {
+                    node.block_scope.variables = undefined;
+                    node.block_scope.enclosed = undefined;
+                    node.parent_scope = undefined;
+                }
+            });
+        }
+
         if (options.sourceMap) {
+            if (options.sourceMap.includeSources && files instanceof AST_Toplevel) {
+                throw new Error("original source content unavailable");
+            }
             options.format.source_map = await SourceMap({
                 file: options.sourceMap.filename,
                 orig: options.sourceMap.content,
-                root: options.sourceMap.root
+                root: options.sourceMap.root,
+                files: options.sourceMap.includeSources ? files : null,
             });
-            if (options.sourceMap.includeSources) {
-                if (files instanceof AST_Toplevel) {
-                    throw new Error("original source content unavailable");
-                } else for (var name in files) if (HOP(files, name)) {
-                    options.format.source_map.get().setSourceContent(name, files[name]);
-                }
-            }
         }
         delete options.format.ast;
         delete options.format.code;
@@ -291,11 +314,21 @@ async function minify(files, options, _fs_module) {
         toplevel.print(stream);
         result.code = stream.get();
         if (options.sourceMap) {
-            if(options.sourceMap.asObject) {
-                result.map = options.format.source_map.get().toJSON();
-            } else {
-                result.map = options.format.source_map.toString();
-            }
+            Object.defineProperty(result, "map", {
+                configurable: true,
+                enumerable: true,
+                get() {
+                    const map = options.format.source_map.getEncoded();
+                    return (result.map = options.sourceMap.asObject ? map : JSON.stringify(map));
+                },
+                set(value) {
+                    Object.defineProperty(result, "map", {
+                        value,
+                        writable: true,
+                    });
+                }
+            });
+            result.decoded_map = options.format.source_map.getDecoded();
             if (options.sourceMap.url == "inline") {
                 var sourceMap = typeof result.map === "object" ? JSON.stringify(result.map) : result.map;
                 result.code += "\n//# sourceMappingURL=data:application/json;charset=utf-8;base64," + to_base64(sourceMap);

package/lib/output.js

@@ -247,6 +247,8 @@ function OutputStream(options) {
         width                : 80,
         wrap_iife            : false,
         wrap_func_args       : true,
+
+        _destroy_ast         : false
     }, true);
 
     if (options.shorthand === undefined)
@@ -796,6 +798,18 @@ function OutputStream(options) {
         if (OUTPUT.length() > insert) newline_insert = insert;
     }
 
+    /**
+     * When output.option("_destroy_ast") is enabled, destroy the function.
+     * Call this after printing it.
+     */
+    const gc_scope =
+      options["_destroy_ast"]
+        ? function gc_scope(scope) {
+            scope.body.length = 0;
+            scope.argnames.length = 0;
+        }
+        : noop;
+
     var stack = [];
     return {
         get             : get,
@@ -842,6 +856,7 @@ function OutputStream(options) {
         with_square     : with_square,
         add_mapping     : add_mapping,
         option          : function(opt) { return options[opt]; },
+        gc_scope,
         printed_comments: printed_comments,
         prepend_comments: readonly ? noop : prepend_comments,
         append_comments : readonly || comment_filter === return_false ? noop : append_comments,
@@ -1232,12 +1247,14 @@ function OutputStream(options) {
         output.with_indent(output.next_indent(), function() {
             output.append_comments(self, true);
         });
+        output.add_mapping(self.end);
         output.print("}");
     }
     function print_braced(self, output, allow_directives) {
         if (self.body.length > 0) {
             output.with_block(function() {
                 display_body(self.body, false, output, allow_directives);
+                output.add_mapping(self.end);
             });
         } else print_braced_empty(self, output);
     }
@@ -1358,6 +1375,7 @@ function OutputStream(options) {
     });
     DEFPRINT(AST_Lambda, function(self, output) {
         self._do_print(output);
+        output.gc_scope(self);
     });
 
     DEFPRINT(AST_PrefixedTemplateString, function(self, output) {
@@ -1437,6 +1455,7 @@ function OutputStream(options) {
             print_braced(self, output);
         }
         if (needs_parens) { output.print(")"); }
+        output.gc_scope(self);
     });
 
     /* -----[ exits ]----- */

package/lib/parse.js

@@ -162,7 +162,7 @@ import {
 } from "./ast.js";
 
 var LATEST_RAW = "";  // Only used for numbers and template strings
-var LATEST_TEMPLATE_END = true;
+var TEMPLATE_RAWS = new Map();  // Raw template strings
 
 var KEYWORDS = "break case catch class const continue debugger default delete do else export extends finally for function if in instanceof let new return switch throw try typeof var void while with";
 var KEYWORDS_ATOM = "false null true";
@@ -693,8 +693,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
                 next(true, true);
                 S.brace_counter++;
                 tok = token(begin ? "template_head" : "template_substitution", content);
-                LATEST_RAW = raw;
-                LATEST_TEMPLATE_END = false;
+                TEMPLATE_RAWS.set(tok, raw);
+                tok.template_end = false;
                 return tok;
             }
 
@@ -710,8 +710,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
         }
         S.template_braces.pop();
         tok = token(begin ? "template_head" : "template_substitution", content);
-        LATEST_RAW = raw;
-        LATEST_TEMPLATE_END = true;
+        TEMPLATE_RAWS.set(tok, raw);
+        tok.template_end = true;
         return tok;
     });
 
@@ -2367,19 +2367,19 @@ function parse($TEXT, options) {
 
         segments.push(new AST_TemplateSegment({
             start: S.token,
-            raw: LATEST_RAW,
+            raw: TEMPLATE_RAWS.get(S.token),
             value: S.token.value,
             end: S.token
         }));
 
-        while (!LATEST_TEMPLATE_END) {
+        while (!S.token.template_end) {
             next();
             handle_regexp();
             segments.push(expression(true));
 
             segments.push(new AST_TemplateSegment({
                 start: S.token,
-                raw: LATEST_RAW,
+                raw: TEMPLATE_RAWS.get(S.token),
                 value: S.token.value,
                 end: S.token
             }));
@@ -3342,6 +3342,7 @@ function parse($TEXT, options) {
         } else {
             toplevel = new AST_Toplevel({ start: start, body: body, end: end });
         }
+        TEMPLATE_RAWS = new Map();
         return toplevel;
     })();
 

package/lib/sourcemap.js

@@ -43,45 +43,59 @@
 
 "use strict";
 
-import MOZ_SourceMap from "source-map";
-import {
-    defaults,
-} from "./utils/index.js";
+import {SourceMapConsumer, SourceMapGenerator} from "@jridgewell/source-map";
+import {defaults, HOP} from "./utils/index.js";
 
-// a small wrapper around fitzgen's source-map library
+// a small wrapper around source-map and @jridgewell/source-map
 async function SourceMap(options) {
     options = defaults(options, {
         file : null,
         root : null,
         orig : null,
-
-        orig_line_diff : 0,
-        dest_line_diff : 0,
+        files: {},
     });
 
     var orig_map;
-    var generator = new MOZ_SourceMap.SourceMapGenerator({
+    var generator = new SourceMapGenerator({
         file       : options.file,
         sourceRoot : options.root
     });
 
+    let sourcesContent = {__proto__: null};
+    let files = options.files;
+    for (var name in files) if (HOP(files, name)) {
+        sourcesContent[name] = files[name];
+    }
     if (options.orig) {
-        orig_map = await new MOZ_SourceMap.SourceMapConsumer(options.orig);
-        orig_map.sources.forEach(function(source) {
-            var sourceContent = orig_map.sourceContentFor(source, true);
-            if (sourceContent) {
-                generator.setSourceContent(source, sourceContent);
-            }
-        });
+        // We support both @jridgewell/source-map (which has a sync
+        // SourceMapConsumer) and source-map (which has an async
+        // SourceMapConsumer).
+        orig_map = await new SourceMapConsumer(options.orig);
+        if (orig_map.sourcesContent) {
+            orig_map.sources.forEach(function(source, i) {
+                var content = orig_map.sourcesContent[i];
+                if (content) {
+                    sourcesContent[source] = content;
+                }
+            });
+        }
     }
 
     function add(source, gen_line, gen_col, orig_line, orig_col, name) {
+        let generatedPos = { line: gen_line, column: gen_col };
+
         if (orig_map) {
             var info = orig_map.originalPositionFor({
                 line: orig_line,
                 column: orig_col
             });
             if (info.source === null) {
+                generator.addMapping({
+                    generated: generatedPos,
+                    original: null,
+                    source: null,
+                    name: null
+                });
                 return;
             }
             source = info.source;
@@ -90,22 +104,42 @@ async function SourceMap(options) {
             name = info.name || name;
         }
         generator.addMapping({
-            generated : { line: gen_line + options.dest_line_diff, column: gen_col },
-            original  : { line: orig_line + options.orig_line_diff, column: orig_col },
+            generated : generatedPos,
+            original  : { line: orig_line, column: orig_col },
             source    : source,
             name      : name
         });
+        generator.setSourceContent(source, sourcesContent[source]);
+    }
+
+    function clean(map) {
+        const allNull = map.sourcesContent && map.sourcesContent.every(c => c == null);
+        if (allNull) delete map.sourcesContent;
+        if (map.file === undefined) delete map.file;
+        if (map.sourceRoot === undefined) delete map.sourceRoot;
+        return map;
+    }
+
+    function getDecoded() {
+        if (!generator.toDecodedMap) return null;
+        return clean(generator.toDecodedMap());
+    }
+
+    function getEncoded() {
+        return clean(generator.toJSON());
+    }
+
+    function destroy() {
+        // @jridgewell/source-map's SourceMapConsumer does not need to be
+        // manually freed.
+        if (orig_map && orig_map.destroy) orig_map.destroy();
     }
 
     return {
-        add        : add,
-        get        : function() { return generator; },
-        toString   : function() { return generator.toString(); },
-        destroy    : function () {
-            if (orig_map && orig_map.destroy) {
-                orig_map.destroy();
-            }
-        }
+        add,
+        getDecoded,
+        getEncoded,
+        destroy,
     };
 }
 

package/lib/utils/index.js

@@ -249,7 +249,15 @@ function regexp_source_fix(source) {
         return (escaped ? "" : "\\") + lineTerminatorEscape[match];
     });
 }
-const all_flags = "gimuy";
+
+// Subset of regexps that is not going to cause regexp based DDOS
+// https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
+const re_safe_regexp = /^[\\/|\0\s\w^$.[\]()]*$/;
+
+/** Check if the regexp is safe for Terser to create without risking a RegExp DOS */
+export const regexp_is_safe = (source) => re_safe_regexp.test(source);
+
+const all_flags = "dgimsuy";
 function sort_regexp_flags(flags) {
     const existing_flags = new Set(flags.split(""));
     let out = "";

package/package.json

@@ -4,7 +4,7 @@
   "homepage": "https://terser.org",
   "author": "Mihai Bazon <mihai.bazon@gmail.com> (http://lisperator.net/)",
   "license": "BSD-2-Clause",
-  "version": "5.13.1",
+  "version": "5.14.2",
   "engines": {
     "node": ">=10"
   },
@@ -18,6 +18,7 @@
   "exports": {
     ".": [
       {
+        "types": "./tools/terser.d.ts",
         "import": "./main.js",
         "require": "./dist/bundle.min.js"
       },
@@ -43,9 +44,9 @@
     "main.js"
   ],
   "dependencies": {
+    "@jridgewell/source-map": "^0.3.2",
     "acorn": "^8.5.0",
     "commander": "^2.20.0",
-    "source-map": "~0.8.0-beta.0",
     "source-map-support": "~0.5.20"
   },
   "devDependencies": {
@@ -58,7 +59,8 @@
     "pre-commit": "^1.2.2",
     "rimraf": "^3.0.2",
     "rollup": "2.56.3",
-    "semver": "^7.3.4"
+    "semver": "^7.3.4",
+    "source-map": "~0.8.0-beta.0"
   },
   "scripts": {
     "test": "node test/compress.js && mocha test/mocha",

package/tools/domprops.js

@@ -320,6 +320,7 @@ export var domprops = [
     "COMMENT_NODE",
     "COMPARE_REF_TO_TEXTURE",
     "COMPILE_STATUS",
+    "COMPLETION_STATUS_KHR",
     "COMPRESSED_RGBA_S3TC_DXT1_EXT",
     "COMPRESSED_RGBA_S3TC_DXT3_EXT",
     "COMPRESSED_RGBA_S3TC_DXT5_EXT",

package/tools/terser.d.ts

@@ -1,11 +1,12 @@
 /// <reference lib="es2015" />
 
-import { RawSourceMap } from 'source-map';
+import { SectionedSourceMapInput, EncodedSourceMap, DecodedSourceMap } from '@jridgewell/source-map';
 
 export type ECMA = 5 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020;
 
 export interface ParseOptions {
     bare_returns?: boolean;
+    /** @deprecated legacy option. Currently, all supported EcmaScript is valid to parse. */
     ecma?: ECMA;
     html5_comments?: boolean;
     shebang?: boolean;
@@ -144,6 +145,7 @@ export interface FormatOptions {
     }) => boolean );
     ecma?: ECMA;
     ie8?: boolean;
+    keep_numbers?: boolean;
     indent_level?: number;
     indent_start?: number;
     inline_script?: boolean;
@@ -192,12 +194,13 @@ export interface MinifyOptions {
 
 export interface MinifyOutput {
     code?: string;
-    map?: RawSourceMap | string;
+    map?: EncodedSourceMap | string;
+    decoded_map?: DecodedSourceMap | null;
 }
 
 export interface SourceMapOptions {
     /** Source map object, 'inline' or source map file content */
-    content?: RawSourceMap | string;
+    content?: SectionedSourceMapInput | string;
     includeSources?: boolean;
     filename?: string;
     root?: string;