terser 5.14.0 → 5.15.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## v5.15.0
+ - Basic support for ES2022 class static initializer blocks.
+ - Add `AudioWorkletNode` constructor options to domprops list (#1230)
+ - Make identity function inliner not inline `id(...expandedArgs)`
+
+## v5.14.2
+
+ - Security fix for RegExps that should not be evaluated (regexp DDOS)
+ - Source maps improvements (#1211)
+ - Performance improvements in long property access evaluation (#1213)
+
+## v5.14.1
+ - keep_numbers option added to TypeScript defs (#1208)
+ - Fixed parsing of nested template strings (#1204)
+
 ## v5.14.0
  - Switched to @jridgewell/source-map for sourcemap generation (#1190, #1181)
  - Fixed source maps with non-terminated segments (#1106)
@@ -202,6 +217,13 @@ Hotfix release, fixes package.json "engines" syntax
  - Module is now distributed as a dual package - You can `import` and `require()` too.
  - Inline improvements were made
 
+
+-----
+
+## v4.8.1 (backport)
+
+ - Security fix for RegExps that should not be evaluated (regexp DDOS)
+
 ## v4.8.0
 
  - Support for numeric separators (`million = 1_000_000`) was added.

package/bin/terser.mjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+
+"use strict";
+
+import "../tools/exit.cjs";
+
+import fs from "fs"
+import path from "path"
+import program from "commander"
+
+import { run_cli } from "../lib/cli.js"
+
+const packageJson = {
+    name: "terser",
+    version: "experimental module CLI"
+}
+
+run_cli({ program, packageJson, fs, path }).catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+});

package/dist/bundle.min.js

@@ -253,7 +253,15 @@ function regexp_source_fix(source) {
         return (escaped ? "" : "\\") + lineTerminatorEscape[match];
     });
 }
-const all_flags = "gimuy";
+
+// Subset of regexps that is not going to cause regexp based DDOS
+// https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
+const re_safe_regexp = /^[\\/|\0\s\w^$.[\]()]*$/;
+
+/** Check if the regexp is safe for Terser to create without risking a RegExp DOS */
+const regexp_is_safe = (source) => re_safe_regexp.test(source);
+
+const all_flags = "dgimsuy";
 function sort_regexp_flags(flags) {
     const existing_flags = new Set(flags.split(""));
     let out = "";
@@ -323,7 +331,7 @@ function set_annotation(node, annotation) {
  ***********************************************************************/
 
 var LATEST_RAW = "";  // Only used for numbers and template strings
-var LATEST_TEMPLATE_END = true;
+var TEMPLATE_RAWS = new Map();  // Raw template strings
 
 var KEYWORDS = "break case catch class const continue debugger default delete do else export extends finally for function if in instanceof let new return switch throw try typeof var void while with";
 var KEYWORDS_ATOM = "false null true";
@@ -854,8 +862,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
                 next(true, true);
                 S.brace_counter++;
                 tok = token(begin ? "template_head" : "template_substitution", content);
-                LATEST_RAW = raw;
-                LATEST_TEMPLATE_END = false;
+                TEMPLATE_RAWS.set(tok, raw);
+                tok.template_end = false;
                 return tok;
             }
 
@@ -871,8 +879,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
         }
         S.template_braces.pop();
         tok = token(begin ? "template_head" : "template_substitution", content);
-        LATEST_RAW = raw;
-        LATEST_TEMPLATE_END = true;
+        TEMPLATE_RAWS.set(tok, raw);
+        tok.template_end = true;
         return tok;
     });
 
@@ -2528,19 +2536,19 @@ function parse($TEXT, options) {
 
         segments.push(new AST_TemplateSegment({
             start: S.token,
-            raw: LATEST_RAW,
+            raw: TEMPLATE_RAWS.get(S.token),
             value: S.token.value,
             end: S.token
         }));
 
-        while (!LATEST_TEMPLATE_END) {
+        while (!S.token.template_end) {
             next();
             handle_regexp();
             segments.push(expression(true));
 
             segments.push(new AST_TemplateSegment({
                 start: S.token,
-                raw: LATEST_RAW,
+                raw: TEMPLATE_RAWS.get(S.token),
                 value: S.token.value,
                 end: S.token
             }));
@@ -2723,6 +2731,10 @@ function parse($TEXT, options) {
         var accessor_type = null;
 
         if (is_class && name === "static" && is_not_method_start()) {
+            const static_block = class_static_block();
+            if (static_block != null) {
+                return static_block;
+            }
             is_static = true;
             name = as_property_name();
         }
@@ -2829,6 +2841,25 @@ function parse($TEXT, options) {
         }
     }
 
+    function class_static_block() {
+        if (!is("punc", "{")) {
+            return null;
+        }
+
+        const start = S.token;
+        const body = [];
+
+        next();
+
+        while (!is("punc", "}")) {
+            body.push(statement());
+        }
+
+        next();
+
+        return new AST_ClassStaticBlock({ start, body, end: prev() });
+    }
+
     function maybe_import_assertion() {
         if (is("name", "assert") && !has_newline_before(S.token)) {
             next();
@@ -3503,6 +3534,7 @@ function parse($TEXT, options) {
         } else {
             toplevel = new AST_Toplevel({ start: start, body: body, end: end });
         }
+        TEMPLATE_RAWS = new Map();
         return toplevel;
     })();
 
@@ -3596,6 +3628,7 @@ const set_tok_flag = (tok, flag, truth) => {
 const TOK_FLAG_NLB          = 0b0001;
 const TOK_FLAG_QUOTE_SINGLE = 0b0010;
 const TOK_FLAG_QUOTE_EXISTS = 0b0100;
+const TOK_FLAG_TEMPLATE_END = 0b1000;
 
 class AST_Token {
     constructor(type, value, line, col, pos, nlb, comments_before, comments_after, file) {
@@ -3631,6 +3664,14 @@ class AST_Token {
         set_tok_flag(this, TOK_FLAG_QUOTE_SINGLE, quote_type === "'");
         set_tok_flag(this, TOK_FLAG_QUOTE_EXISTS, !!quote_type);
     }
+
+    get template_end() {
+        return has_tok_flag(this, TOK_FLAG_TEMPLATE_END);
+    }
+
+    set template_end(new_template_end) {
+        set_tok_flag(this, TOK_FLAG_TEMPLATE_END, new_template_end);
+    }
 }
 
 var AST_Node = DEFNODE("Node", "start end", function AST_Node(props) {
@@ -5766,6 +5807,28 @@ var AST_DefClass = DEFNODE("DefClass", null, function AST_DefClass(props) {
     $documentation: "A class definition",
 }, AST_Class);
 
+var AST_ClassStaticBlock = DEFNODE("ClassStaticBlock", "body block_scope", function AST_ClassStaticBlock (props) {
+    this.body = props.body;
+    this.block_scope = props.block_scope;
+    this.start = props.start;
+    this.end = props.end;
+}, {
+    $documentation: "A block containing statements to be executed in the context of the class",
+    $propdoc: {
+        body: "[AST_Statement*] an array of statements",
+    },
+    _walk: function(visitor) {
+        return visitor._visit(this, function() {
+            walk_body(this, visitor);
+        });
+    },
+    _children_backwards(push) {
+        let i = this.body.length;
+        while (i--) push(this.body[i]);
+    },
+    clone: clone_block_scope,
+}, AST_Scope);
+
 var AST_ClassExpression = DEFNODE("ClassExpression", null, function AST_ClassExpression(props) {
     if (props) {
         this.name = props.name;
@@ -6782,6 +6845,10 @@ def_transform(AST_Class, function(self, tw) {
     self.properties = do_list(self.properties, tw);
 });
 
+def_transform(AST_ClassStaticBlock, function(self, tw) {
+    self.body = do_list(self.body, tw);
+});
+
 def_transform(AST_Expansion, function(self, tw) {
     self.expression = self.expression.transform(tw);
 });
@@ -7141,6 +7208,14 @@ def_transform(AST_PrefixedTemplateString, function(self, tw) {
             });
         },
 
+        StaticBlock: function(M) {
+            return new AST_ClassStaticBlock({
+                start : my_start_token(M),
+                end   : my_end_token(M),
+                body  : M.body.map(from_moz),
+            });
+        },
+
         ArrayExpression: function(M) {
             return new AST_Array({
                 start    : my_start_token(M),
@@ -8280,6 +8355,13 @@ def_transform(AST_PrefixedTemplateString, function(self, tw) {
         };
     });
 
+    def_to_moz(AST_ClassStaticBlock, function To_Moz_StaticBlock(M) {
+        return {
+            type: "StaticBlock",
+            body: M.body.map(to_moz),
+        };
+    });
+
     def_to_moz(AST_NewTarget, function To_Moz_MetaProperty() {
         return {
             type: "MetaProperty",
@@ -9630,12 +9712,14 @@ function OutputStream(options) {
         output.with_indent(output.next_indent(), function() {
             output.append_comments(self, true);
         });
+        output.add_mapping(self.end);
         output.print("}");
     }
     function print_braced(self, output, allow_directives) {
         if (self.body.length > 0) {
             output.with_block(function() {
                 display_body(self.body, false, output, allow_directives);
+                output.add_mapping(self.end);
             });
         } else print_braced_empty(self, output);
     }
@@ -10575,6 +10659,11 @@ function OutputStream(options) {
         }
         self._print_getter_setter(type, false, output);
     });
+    DEFPRINT(AST_ClassStaticBlock, function (self, output) {
+        output.print("static");
+        output.space();
+        print_braced(self, output);
+    });
     AST_Symbol.DEFMETHOD("_do_print", function(output) {
         var def = this.definition();
         output.print_name(def ? def.mangled_name || def.name : this.name);
@@ -12248,6 +12337,11 @@ AST_Class.prototype._size = function () {
     );
 };
 
+AST_ClassStaticBlock.prototype._size = function () {
+    // "class{}" + semicolons
+    return 7 + list_overhead(this.body);
+};
+
 AST_ClassProperty.prototype._size = function () {
     return (
         static_size(this.static)
@@ -13118,6 +13212,9 @@ function is_nullish(node, compressor) {
         }
         return any(this.properties, compressor);
     });
+    def_has_side_effects(AST_ClassStaticBlock, function(compressor) {
+        return any(this.body, compressor);
+    });
     def_has_side_effects(AST_Binary, function(compressor) {
         return this.left.has_side_effects(compressor)
             || this.right.has_side_effects(compressor);
@@ -13217,6 +13314,9 @@ function is_nullish(node, compressor) {
         if (this.extends && this.extends.may_throw(compressor)) return true;
         return any(this.properties, compressor);
     });
+    def_may_throw(AST_ClassStaticBlock, function (compressor) {
+        return any(this.body, compressor);
+    });
 
     def_may_throw(AST_Array, function(compressor) {
         return any(this.elements, compressor);
@@ -13385,6 +13485,9 @@ function is_nullish(node, compressor) {
             if (prop.static && prop.value && !prop.value.is_constant_expression(scope)) {
                 return false;
             }
+            if (prop instanceof AST_ClassStaticBlock) {
+                return false;
+            }
         }
 
         return all_refs_local.call(this, scope);
@@ -13708,9 +13811,18 @@ const aborts = (thing) => thing && thing.aborts();
         }
         return null;
     }
-    def_aborts(AST_Import, function() { return null; });
+    def_aborts(AST_Import, return_null);
     def_aborts(AST_BlockStatement, block_aborts);
     def_aborts(AST_SwitchBranch, block_aborts);
+    def_aborts(AST_DefClass, function () {
+        for (const prop of this.properties) {
+            if (prop instanceof AST_ClassStaticBlock) {
+                if (prop.aborts()) return prop;
+            }
+        }
+        return null;
+    });
+    def_aborts(AST_ClassStaticBlock, block_aborts);
     def_aborts(AST_If, function() {
         return this.alternative && aborts(this.body) && aborts(this.alternative) && this;
     });
@@ -13841,7 +13953,7 @@ def_eval(AST_BigInt, return_this);
 
 def_eval(AST_RegExp, function (compressor) {
     let evaluated = compressor.evaluated_regexps.get(this.value);
-    if (evaluated === undefined) {
+    if (evaluated === undefined && regexp_is_safe(this.value.source)) {
         try {
             const { source, flags } = this.value;
             evaluated = new RegExp(source, flags);
@@ -14054,7 +14166,7 @@ const regexp_flags = new Set([
 ]);
 
 def_eval(AST_PropAccess, function (compressor, depth) {
-    const obj = this.expression._eval(compressor, depth);
+    let obj = this.expression._eval(compressor, depth + 1);
     if (obj === nullish || (this.optional && obj == null)) return nullish;
     if (compressor.option("unsafe")) {
         var key = this.property;
@@ -14064,7 +14176,6 @@ def_eval(AST_PropAccess, function (compressor, depth) {
                 return this;
         }
         var exp = this.expression;
-        var val;
         if (is_undeclared_ref(exp)) {
 
             var aa;
@@ -14081,29 +14192,29 @@ def_eval(AST_PropAccess, function (compressor, depth) {
             }
             if (!is_pure_native_value(exp.name, key))
                 return this;
-            val = global_objs[exp.name];
+            obj = global_objs[exp.name];
         } else {
-            val = exp._eval(compressor, depth + 1);
-            if (val instanceof RegExp) {
+            if (obj instanceof RegExp) {
                 if (key == "source") {
-                    return regexp_source_fix(val.source);
+                    return regexp_source_fix(obj.source);
                 } else if (key == "flags" || regexp_flags.has(key)) {
-                    return val[key];
+                    return obj[key];
                 }
             }
-            if (!val || val === exp || !HOP(val, key))
+            if (!obj || obj === exp || !HOP(obj, key))
                 return this;
-            if (typeof val == "function")
+
+            if (typeof obj == "function")
                 switch (key) {
                     case "name":
-                        return val.node.name ? val.node.name.name : "";
+                        return obj.node.name ? obj.node.name.name : "";
                     case "length":
-                        return val.node.length_property();
+                        return obj.node.length_property();
                     default:
                         return this;
                 }
         }
-        return val[key];
+        return obj[key];
     }
     return this;
 });
@@ -14290,6 +14401,14 @@ def_drop_side_effect_free(AST_Class, function (compressor) {
     if (trimmed_extends)
         with_effects.push(trimmed_extends);
     for (const prop of this.properties) {
+        if (prop instanceof AST_ClassStaticBlock) {
+            if (prop.body.some(stat => stat.has_side_effects(compressor))) {
+                return this;
+            } else {
+                continue;
+            }
+        }
+
         const trimmed_prop = prop.drop_side_effect_free(compressor);
         if (trimmed_prop)
             with_effects.push(trimmed_prop);
@@ -14801,6 +14920,10 @@ def_reduce_vars(AST_Class, function(tw, descend) {
     return true;
 });
 
+def_reduce_vars(AST_ClassStaticBlock, function(tw, descend, compressor) {
+    reset_block_variables(compressor, this);
+});
+
 def_reduce_vars(AST_Conditional, function(tw) {
     this.condition.walk(tw);
     push(tw);
@@ -16715,6 +16838,7 @@ function inline_into_call(self, fn, compressor) {
             fn.argnames.length === 1
             && (fn.argnames[0] instanceof AST_SymbolFunarg)
             && self.args.length < 2
+            && !(self.args[0] instanceof AST_Expansion)
             && returned instanceof AST_SymbolRef
             && returned.name === fn.argnames[0].name
         ) {
@@ -17674,18 +17798,13 @@ AST_Scope.DEFMETHOD("drop_unused", function(compressor) {
             }
             if ((node instanceof AST_Defun || node instanceof AST_DefClass) && node !== self) {
                 const def = node.name.definition();
-                let keep = def.global && !drop_funcs || in_use_ids.has(def.id);
-                if (!keep) {
+                const keep = def.global && !drop_funcs || in_use_ids.has(def.id);
+                // Class "extends" and static blocks may have side effects
+                const has_side_effects = !keep
+                    && node instanceof AST_Class
+                    && node.has_side_effects(compressor);
+                if (!keep && !has_side_effects) {
                     def.eliminated++;
-                    if (node instanceof AST_DefClass) {
-                        // Classes might have extends with side effects
-                        const side_effects = node.drop_side_effect_free(compressor);
-                        if (side_effects) {
-                            return make_node(AST_SimpleStatement, node, {
-                                body: side_effects
-                            });
-                        }
-                    }
                     return in_list ? MAP.skip : make_node(AST_EmptyStatement, node);
                 }
             }
@@ -18982,6 +19101,7 @@ def_optimize(AST_Call, function(self, compressor) {
                     params.push(value);
                     return arg !== value;
                 })
+                && regexp_is_safe(params[0])
             ) {
                 let [ source, flags ] = params;
                 source = regexp_source_fix(new RegExp(source).source);
@@ -20641,6 +20761,12 @@ def_optimize(AST_Dot, function(self, compressor) {
         const sub = self.flatten_object(self.property, compressor);
         if (sub) return sub.optimize(compressor);
     }
+
+    if (self.expression instanceof AST_PropAccess
+        && parent instanceof AST_PropAccess) {
+        return self;
+    }
+
     let ev = self.evaluate(compressor);
     if (ev !== self) {
         ev = make_node_from_constant(ev, self).optimize(compressor);
@@ -20757,6 +20883,11 @@ def_optimize(AST_Class, function(self) {
     return self;
 });
 
+def_optimize(AST_ClassStaticBlock, function(self, compressor) {
+    tighten_body(self.body, compressor);
+    return self;
+});
+
 def_optimize(AST_Yield, function(self, compressor) {
     if (self.expression && !self.is_star && is_undefined(self.expression, compressor)) {
         self.expression = null;
@@ -27144,6 +27275,7 @@ var domprops = [
     "outlineStyle",
     "outlineWidth",
     "outputBuffer",
+    "outputChannelCount",
     "outputLatency",
     "outputs",
     "overflow",
@@ -27231,6 +27363,7 @@ var domprops = [
     "palette",
     "pan",
     "panningModel",
+    "parameterData",
     "parameters",
     "parent",
     "parentElement",
@@ -27406,6 +27539,7 @@ var domprops = [
     "processIceMessage",
     "processingEnd",
     "processingStart",
+    "processorOptions",
     "product",
     "productId",
     "productName",
@@ -29846,7 +29980,9 @@ async function run_cli({ program, packageJson, fs, path }) {
                         result.enclosed = value.block_scope.enclosed;
                     }
                     value.CTOR.PROPS.forEach(function(prop) {
-                        result[prop] = value[prop];
+                        if (prop !== "block_scope") {
+                            result[prop] = value[prop];
+                        }
                     });
                     return result;
                 }

package/lib/ast.js

@@ -93,6 +93,7 @@ const set_tok_flag = (tok, flag, truth) => {
 const TOK_FLAG_NLB          = 0b0001;
 const TOK_FLAG_QUOTE_SINGLE = 0b0010;
 const TOK_FLAG_QUOTE_EXISTS = 0b0100;
+const TOK_FLAG_TEMPLATE_END = 0b1000;
 
 class AST_Token {
     constructor(type, value, line, col, pos, nlb, comments_before, comments_after, file) {
@@ -128,6 +129,14 @@ class AST_Token {
         set_tok_flag(this, TOK_FLAG_QUOTE_SINGLE, quote_type === "'");
         set_tok_flag(this, TOK_FLAG_QUOTE_EXISTS, !!quote_type);
     }
+
+    get template_end() {
+        return has_tok_flag(this, TOK_FLAG_TEMPLATE_END);
+    }
+
+    set template_end(new_template_end) {
+        set_tok_flag(this, TOK_FLAG_TEMPLATE_END, new_template_end);
+    }
 }
 
 var AST_Node = DEFNODE("Node", "start end", function AST_Node(props) {
@@ -2263,6 +2272,28 @@ var AST_DefClass = DEFNODE("DefClass", null, function AST_DefClass(props) {
     $documentation: "A class definition",
 }, AST_Class);
 
+var AST_ClassStaticBlock = DEFNODE("ClassStaticBlock", "body block_scope", function AST_ClassStaticBlock (props) {
+    this.body = props.body;
+    this.block_scope = props.block_scope;
+    this.start = props.start;
+    this.end = props.end;
+}, {
+    $documentation: "A block containing statements to be executed in the context of the class",
+    $propdoc: {
+        body: "[AST_Statement*] an array of statements",
+    },
+    _walk: function(visitor) {
+        return visitor._visit(this, function() {
+            walk_body(this, visitor);
+        });
+    },
+    _children_backwards(push) {
+        let i = this.body.length;
+        while (i--) push(this.body[i]);
+    },
+    clone: clone_block_scope,
+}, AST_Scope);
+
 var AST_ClassExpression = DEFNODE("ClassExpression", null, function AST_ClassExpression(props) {
     if (props) {
         this.name = props.name;
@@ -3063,6 +3094,7 @@ export {
     AST_ClassExpression,
     AST_ClassPrivateProperty,
     AST_ClassProperty,
+    AST_ClassStaticBlock,
     AST_ConciseMethod,
     AST_Conditional,
     AST_Const,

package/lib/cli.js

@@ -279,7 +279,9 @@ export async function run_cli({ program, packageJson, fs, path }) {
                         result.enclosed = value.block_scope.enclosed;
                     }
                     value.CTOR.PROPS.forEach(function(prop) {
-                        result[prop] = value[prop];
+                        if (prop !== "block_scope") {
+                            result[prop] = value[prop];
+                        }
                     });
                     return result;
                 }

package/lib/compress/drop-side-effect-free.js

@@ -50,6 +50,7 @@ import {
     AST_Call,
     AST_Chain,
     AST_Class,
+    AST_ClassStaticBlock,
     AST_ClassProperty,
     AST_ConciseMethod,
     AST_Conditional,
@@ -156,6 +157,14 @@ def_drop_side_effect_free(AST_Class, function (compressor) {
     if (trimmed_extends)
         with_effects.push(trimmed_extends);
     for (const prop of this.properties) {
+        if (prop instanceof AST_ClassStaticBlock) {
+            if (prop.body.some(stat => stat.has_side_effects(compressor))) {
+                return this;
+            } else {
+                continue;
+            }
+        }
+
         const trimmed_prop = prop.drop_side_effect_free(compressor);
         if (trimmed_prop)
             with_effects.push(trimmed_prop);

package/lib/compress/evaluate.js

@@ -46,7 +46,8 @@ import {
     makePredicate,
     return_this,
     string_template,
-    regexp_source_fix
+    regexp_source_fix,
+    regexp_is_safe,
 } from "../utils/index.js";
 import {
     AST_Array,
@@ -129,7 +130,7 @@ def_eval(AST_BigInt, return_this);
 
 def_eval(AST_RegExp, function (compressor) {
     let evaluated = compressor.evaluated_regexps.get(this.value);
-    if (evaluated === undefined) {
+    if (evaluated === undefined && regexp_is_safe(this.value.source)) {
         try {
             const { source, flags } = this.value;
             evaluated = new RegExp(source, flags);
@@ -342,7 +343,7 @@ const regexp_flags = new Set([
 ]);
 
 def_eval(AST_PropAccess, function (compressor, depth) {
-    const obj = this.expression._eval(compressor, depth);
+    let obj = this.expression._eval(compressor, depth + 1);
     if (obj === nullish || (this.optional && obj == null)) return nullish;
     if (compressor.option("unsafe")) {
         var key = this.property;
@@ -352,7 +353,6 @@ def_eval(AST_PropAccess, function (compressor, depth) {
                 return this;
         }
         var exp = this.expression;
-        var val;
         if (is_undeclared_ref(exp)) {
 
             var aa;
@@ -369,29 +369,29 @@ def_eval(AST_PropAccess, function (compressor, depth) {
             }
             if (!is_pure_native_value(exp.name, key))
                 return this;
-            val = global_objs[exp.name];
+            obj = global_objs[exp.name];
         } else {
-            val = exp._eval(compressor, depth + 1);
-            if (val instanceof RegExp) {
+            if (obj instanceof RegExp) {
                 if (key == "source") {
-                    return regexp_source_fix(val.source);
+                    return regexp_source_fix(obj.source);
                 } else if (key == "flags" || regexp_flags.has(key)) {
-                    return val[key];
+                    return obj[key];
                 }
             }
-            if (!val || val === exp || !HOP(val, key))
+            if (!obj || obj === exp || !HOP(obj, key))
                 return this;
-            if (typeof val == "function")
+
+            if (typeof obj == "function")
                 switch (key) {
                     case "name":
-                        return val.node.name ? val.node.name.name : "";
+                        return obj.node.name ? obj.node.name.name : "";
                     case "length":
-                        return val.node.length_property();
+                        return obj.node.length_property();
                     default:
                         return this;
                 }
         }
-        return val[key];
+        return obj[key];
     }
     return this;
 });

package/lib/compress/index.js

@@ -58,6 +58,7 @@ import {
     AST_Class,
     AST_ClassExpression,
     AST_ClassProperty,
+    AST_ClassStaticBlock,
     AST_ConciseMethod,
     AST_Conditional,
     AST_Const,
@@ -158,6 +159,7 @@ import {
     return_true,
     regexp_source_fix,
     has_annotation,
+    regexp_is_safe,
 } from "../utils/index.js";
 import { first_in_statement } from "../utils/first_in_statement.js";
 import { equivalent_to } from "../equivalent-to.js";
@@ -832,18 +834,13 @@ AST_Scope.DEFMETHOD("drop_unused", function(compressor) {
             }
             if ((node instanceof AST_Defun || node instanceof AST_DefClass) && node !== self) {
                 const def = node.name.definition();
-                let keep = def.global && !drop_funcs || in_use_ids.has(def.id);
-                if (!keep) {
+                const keep = def.global && !drop_funcs || in_use_ids.has(def.id);
+                // Class "extends" and static blocks may have side effects
+                const has_side_effects = !keep
+                    && node instanceof AST_Class
+                    && node.has_side_effects(compressor);
+                if (!keep && !has_side_effects) {
                     def.eliminated++;
-                    if (node instanceof AST_DefClass) {
-                        // Classes might have extends with side effects
-                        const side_effects = node.drop_side_effect_free(compressor);
-                        if (side_effects) {
-                            return make_node(AST_SimpleStatement, node, {
-                                body: side_effects
-                            });
-                        }
-                    }
                     return in_list ? MAP.skip : make_node(AST_EmptyStatement, node);
                 }
             }
@@ -2140,6 +2137,7 @@ def_optimize(AST_Call, function(self, compressor) {
                     params.push(value);
                     return arg !== value;
                 })
+                && regexp_is_safe(params[0])
             ) {
                 let [ source, flags ] = params;
                 source = regexp_source_fix(new RegExp(source).source);
@@ -3799,6 +3797,12 @@ def_optimize(AST_Dot, function(self, compressor) {
         const sub = self.flatten_object(self.property, compressor);
         if (sub) return sub.optimize(compressor);
     }
+
+    if (self.expression instanceof AST_PropAccess
+        && parent instanceof AST_PropAccess) {
+        return self;
+    }
+
     let ev = self.evaluate(compressor);
     if (ev !== self) {
         ev = make_node_from_constant(ev, self).optimize(compressor);
@@ -3915,6 +3919,11 @@ def_optimize(AST_Class, function(self) {
     return self;
 });
 
+def_optimize(AST_ClassStaticBlock, function(self, compressor) {
+    tighten_body(self.body, compressor);
+    return self;
+});
+
 def_optimize(AST_Yield, function(self, compressor) {
     if (self.expression && !self.is_star && is_undefined(self.expression, compressor)) {
         self.expression = null;

package/lib/compress/inference.js

@@ -52,6 +52,8 @@ import {
   AST_Case,
   AST_Chain,
   AST_Class,
+  AST_DefClass,
+  AST_ClassStaticBlock,
   AST_ClassProperty,
   AST_ConciseMethod,
   AST_Conditional,
@@ -320,6 +322,9 @@ export function is_nullish(node, compressor) {
         }
         return any(this.properties, compressor);
     });
+    def_has_side_effects(AST_ClassStaticBlock, function(compressor) {
+        return any(this.body, compressor);
+    });
     def_has_side_effects(AST_Binary, function(compressor) {
         return this.left.has_side_effects(compressor)
             || this.right.has_side_effects(compressor);
@@ -419,6 +424,9 @@ export function is_nullish(node, compressor) {
         if (this.extends && this.extends.may_throw(compressor)) return true;
         return any(this.properties, compressor);
     });
+    def_may_throw(AST_ClassStaticBlock, function (compressor) {
+        return any(this.body, compressor);
+    });
 
     def_may_throw(AST_Array, function(compressor) {
         return any(this.elements, compressor);
@@ -587,6 +595,9 @@ export function is_nullish(node, compressor) {
             if (prop.static && prop.value && !prop.value.is_constant_expression(scope)) {
                 return false;
             }
+            if (prop instanceof AST_ClassStaticBlock) {
+                return false;
+            }
         }
 
         return all_refs_local.call(this, scope);
@@ -910,9 +921,18 @@ export const aborts = (thing) => thing && thing.aborts();
         }
         return null;
     }
-    def_aborts(AST_Import, function() { return null; });
+    def_aborts(AST_Import, return_null);
     def_aborts(AST_BlockStatement, block_aborts);
     def_aborts(AST_SwitchBranch, block_aborts);
+    def_aborts(AST_DefClass, function () {
+        for (const prop of this.properties) {
+            if (prop instanceof AST_ClassStaticBlock) {
+                if (prop.aborts()) return prop;
+            }
+        }
+        return null;
+    });
+    def_aborts(AST_ClassStaticBlock, block_aborts);
     def_aborts(AST_If, function() {
         return this.alternative && aborts(this.body) && aborts(this.alternative) && this;
     });

package/lib/compress/inline.js

@@ -335,6 +335,7 @@ export function inline_into_call(self, fn, compressor) {
             fn.argnames.length === 1
             && (fn.argnames[0] instanceof AST_SymbolFunarg)
             && self.args.length < 2
+            && !(self.args[0] instanceof AST_Expansion)
             && returned instanceof AST_SymbolRef
             && returned.name === fn.argnames[0].name
         ) {

package/lib/compress/reduce-vars.js

@@ -52,6 +52,7 @@ import {
     AST_Case,
     AST_Chain,
     AST_Class,
+    AST_ClassStaticBlock,
     AST_ClassExpression,
     AST_Conditional,
     AST_Default,
@@ -377,6 +378,10 @@ def_reduce_vars(AST_Class, function(tw, descend) {
     return true;
 });
 
+def_reduce_vars(AST_ClassStaticBlock, function(tw, descend, compressor) {
+    reset_block_variables(compressor, this);
+});
+
 def_reduce_vars(AST_Conditional, function(tw) {
     this.condition.walk(tw);
     push(tw);

package/lib/mozilla-ast.js

@@ -60,6 +60,7 @@ import {
     AST_Catch,
     AST_Chain,
     AST_Class,
+    AST_ClassStaticBlock,
     AST_ClassExpression,
     AST_ClassProperty,
     AST_ClassPrivateProperty,
@@ -444,6 +445,14 @@ import { is_basic_identifier_string } from "./parse.js";
             });
         },
 
+        StaticBlock: function(M) {
+            return new AST_ClassStaticBlock({
+                start : my_start_token(M),
+                end   : my_end_token(M),
+                body  : M.body.map(from_moz),
+            });
+        },
+
         ArrayExpression: function(M) {
             return new AST_Array({
                 start    : my_start_token(M),
@@ -1583,6 +1592,13 @@ import { is_basic_identifier_string } from "./parse.js";
         };
     });
 
+    def_to_moz(AST_ClassStaticBlock, function To_Moz_StaticBlock(M) {
+        return {
+            type: "StaticBlock",
+            body: M.body.map(to_moz),
+        };
+    });
+
     def_to_moz(AST_NewTarget, function To_Moz_MetaProperty() {
         return {
             type: "MetaProperty",

package/lib/output.js

@@ -70,6 +70,7 @@ import {
     AST_ClassExpression,
     AST_ClassPrivateProperty,
     AST_ClassProperty,
+    AST_ClassStaticBlock,
     AST_ConciseMethod,
     AST_PrivateGetter,
     AST_PrivateMethod,
@@ -1247,12 +1248,14 @@ function OutputStream(options) {
         output.with_indent(output.next_indent(), function() {
             output.append_comments(self, true);
         });
+        output.add_mapping(self.end);
         output.print("}");
     }
     function print_braced(self, output, allow_directives) {
         if (self.body.length > 0) {
             output.with_block(function() {
                 display_body(self.body, false, output, allow_directives);
+                output.add_mapping(self.end);
             });
         } else print_braced_empty(self, output);
     }
@@ -2192,6 +2195,11 @@ function OutputStream(options) {
         }
         self._print_getter_setter(type, false, output);
     });
+    DEFPRINT(AST_ClassStaticBlock, function (self, output) {
+        output.print("static");
+        output.space();
+        print_braced(self, output);
+    });
     AST_Symbol.DEFMETHOD("_do_print", function(output) {
         var def = this.definition();
         output.print_name(def ? def.mangled_name || def.name : this.name);

package/lib/parse.js

@@ -67,6 +67,7 @@ import {
     AST_ClassExpression,
     AST_ClassPrivateProperty,
     AST_ClassProperty,
+    AST_ClassStaticBlock,
     AST_ConciseMethod,
     AST_PrivateGetter,
     AST_PrivateMethod,
@@ -162,7 +163,7 @@ import {
 } from "./ast.js";
 
 var LATEST_RAW = "";  // Only used for numbers and template strings
-var LATEST_TEMPLATE_END = true;
+var TEMPLATE_RAWS = new Map();  // Raw template strings
 
 var KEYWORDS = "break case catch class const continue debugger default delete do else export extends finally for function if in instanceof let new return switch throw try typeof var void while with";
 var KEYWORDS_ATOM = "false null true";
@@ -693,8 +694,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
                 next(true, true);
                 S.brace_counter++;
                 tok = token(begin ? "template_head" : "template_substitution", content);
-                LATEST_RAW = raw;
-                LATEST_TEMPLATE_END = false;
+                TEMPLATE_RAWS.set(tok, raw);
+                tok.template_end = false;
                 return tok;
             }
 
@@ -710,8 +711,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
         }
         S.template_braces.pop();
         tok = token(begin ? "template_head" : "template_substitution", content);
-        LATEST_RAW = raw;
-        LATEST_TEMPLATE_END = true;
+        TEMPLATE_RAWS.set(tok, raw);
+        tok.template_end = true;
         return tok;
     });
 
@@ -2367,19 +2368,19 @@ function parse($TEXT, options) {
 
         segments.push(new AST_TemplateSegment({
             start: S.token,
-            raw: LATEST_RAW,
+            raw: TEMPLATE_RAWS.get(S.token),
             value: S.token.value,
             end: S.token
         }));
 
-        while (!LATEST_TEMPLATE_END) {
+        while (!S.token.template_end) {
             next();
             handle_regexp();
             segments.push(expression(true));
 
             segments.push(new AST_TemplateSegment({
                 start: S.token,
-                raw: LATEST_RAW,
+                raw: TEMPLATE_RAWS.get(S.token),
                 value: S.token.value,
                 end: S.token
             }));
@@ -2562,6 +2563,10 @@ function parse($TEXT, options) {
         var accessor_type = null;
 
         if (is_class && name === "static" && is_not_method_start()) {
+            const static_block = class_static_block();
+            if (static_block != null) {
+                return static_block;
+            }
             is_static = true;
             name = as_property_name();
         }
@@ -2668,6 +2673,25 @@ function parse($TEXT, options) {
         }
     }
 
+    function class_static_block() {
+        if (!is("punc", "{")) {
+            return null;
+        }
+
+        const start = S.token;
+        const body = [];
+
+        next();
+
+        while (!is("punc", "}")) {
+            body.push(statement());
+        }
+
+        next();
+
+        return new AST_ClassStaticBlock({ start, body, end: prev() });
+    }
+
     function maybe_import_assertion() {
         if (is("name", "assert") && !has_newline_before(S.token)) {
             next();
@@ -3342,6 +3366,7 @@ function parse($TEXT, options) {
         } else {
             toplevel = new AST_Toplevel({ start: start, body: body, end: end });
         }
+        TEMPLATE_RAWS = new Map();
         return toplevel;
     })();
 

package/lib/size.js

@@ -10,6 +10,7 @@ import {
     AST_Call,
     AST_Case,
     AST_Class,
+    AST_ClassStaticBlock,
     AST_ClassPrivateProperty,
     AST_ClassProperty,
     AST_ConciseMethod,
@@ -401,6 +402,11 @@ AST_Class.prototype._size = function () {
     );
 };
 
+AST_ClassStaticBlock.prototype._size = function () {
+    // "class{}" + semicolons
+    return 7 + list_overhead(this.body);
+};
+
 AST_ClassProperty.prototype._size = function () {
     return (
         static_size(this.static)

package/lib/transform.js

@@ -53,6 +53,7 @@ import {
     AST_Catch,
     AST_Chain,
     AST_Class,
+    AST_ClassStaticBlock,
     AST_Conditional,
     AST_Definitions,
     AST_Destructuring,
@@ -285,6 +286,10 @@ def_transform(AST_Class, function(self, tw) {
     self.properties = do_list(self.properties, tw);
 });
 
+def_transform(AST_ClassStaticBlock, function(self, tw) {
+    self.body = do_list(self.body, tw);
+});
+
 def_transform(AST_Expansion, function(self, tw) {
     self.expression = self.expression.transform(tw);
 });

package/lib/utils/index.js

@@ -249,7 +249,15 @@ function regexp_source_fix(source) {
         return (escaped ? "" : "\\") + lineTerminatorEscape[match];
     });
 }
-const all_flags = "gimuy";
+
+// Subset of regexps that is not going to cause regexp based DDOS
+// https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
+const re_safe_regexp = /^[\\/|\0\s\w^$.[\]()]*$/;
+
+/** Check if the regexp is safe for Terser to create without risking a RegExp DOS */
+export const regexp_is_safe = (source) => re_safe_regexp.test(source);
+
+const all_flags = "dgimsuy";
 function sort_regexp_flags(flags) {
     const existing_flags = new Set(flags.split(""));
     let out = "";

package/package.json

@@ -4,7 +4,7 @@
   "homepage": "https://terser.org",
   "author": "Mihai Bazon <mihai.bazon@gmail.com> (http://lisperator.net/)",
   "license": "BSD-2-Clause",
-  "version": "5.14.0",
+  "version": "5.15.0",
   "engines": {
     "node": ">=10"
   },

package/tools/domprops.js

@@ -6021,6 +6021,7 @@ export var domprops = [
     "outlineStyle",
     "outlineWidth",
     "outputBuffer",
+    "outputChannelCount",
     "outputLatency",
     "outputs",
     "overflow",
@@ -6108,6 +6109,7 @@ export var domprops = [
     "palette",
     "pan",
     "panningModel",
+    "parameterData",
     "parameters",
     "parent",
     "parentElement",
@@ -6283,6 +6285,7 @@ export var domprops = [
     "processIceMessage",
     "processingEnd",
     "processingStart",
+    "processorOptions",
     "product",
     "productId",
     "productName",

package/tools/terser.d.ts

@@ -145,6 +145,7 @@ export interface FormatOptions {
     }) => boolean );
     ecma?: ECMA;
     ie8?: boolean;
+    keep_numbers?: boolean;
     indent_level?: number;
     indent_start?: number;
     inline_script?: boolean;