Skip to content

fix(@angular/build): use oxc-parser fallback when stripping source-map comments - #34632

Closed
clydin wants to merge 3 commits into
angular:mainfrom
clydin:fix/source-map-oxc-comment-stripping
Closed

clydin wants to merge 3 commits into
angular:mainfrom
clydin:fix/source-map-oxc-comment-stripping

Conversation

@clydin

@clydin clydin commented Nov 2, 2026

Copy link
Copy Markdown
Member

Previously, removeSourceMappingURL relied on a custom character-by-character state machine to strip top-level //# sourceMappingURL= comments from JavaScript strings. Because that scanner did not track regular expression literals, quote characters or backticks inside a regex literal (such as /"/) inverted string boundaries for the remainder of the file. When a subsequent string literal contained //# sourceMappingURL=, the scanner misidentified it as a top-level comment and truncated valid JavaScript, or failed to strip the actual trailing comment at the end of the chunk.

Extend the single-trailing-comment fast path to string inputs and pass raw byte buffers directly from the Vite memory plugin so standard chunks slice trailing source-map comments without invoking a parser. When a file contains multiple or non-trailing //# sourceMappingURL= occurrences, lazily load oxc-parser and read only the comments of the parse result, avoiding JS-side AST deserialization while delegating full ECMAScript lexical handling (including regex literals, templates, and escapes) to Oxc. This keeps main-thread startup free of eager native or WASM parser loading. The fallback removes whitespace consistently with the fast path, removing comment-only lines entirely while preserving line terminators for comments that follow code. Also harden trailing URL and base64 validation so block comments or template literals closing on the same line are never misclassified by the fast path.

Closes #34590

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request refactors the sourcemap comment removal logic by replacing a custom state-machine parser with oxc-parser for non-trailing or multiple sourcemap comments, while maintaining a fast path for single trailing comments. It also introduces a decodeUtf8 helper in the Vite memory plugin to avoid copying memory during UTF-8 decoding, and adds extensive unit tests to cover various edge cases. A review comment identifies a high-severity issue where using __filename with createRequire will throw a ReferenceError in ESM environments, suggesting the use of import.meta.url instead.

@alan-agius4 alan-agius4 added action: review The PR is still awaiting reviews from at least one requested reviewer target: patch This PR is targeted for the next patch release labels Nov 2, 2026
…p comments

Previously, `removeSourceMappingURL` relied on a custom character-by-character state machine to
strip top-level `//# sourceMappingURL=` comments from JavaScript strings. Because that scanner did
not track regular expression literals, quote characters or backticks inside a regex literal (such
as `/"/`) inverted string boundaries for the remainder of the file. When a subsequent string
literal contained `//# sourceMappingURL=`, the scanner misidentified it as a top-level comment and
truncated valid JavaScript, or failed to strip the actual trailing comment at the end of the chunk.

Extend the single-trailing-comment fast path to string inputs and pass raw byte buffers directly
from the Vite memory plugin so standard chunks slice trailing source-map comments without invoking
a parser. When a file contains multiple or non-trailing `//# sourceMappingURL=` occurrences, lazily
load `oxc-parser` and read only the `comments` of the parse result, avoiding JS-side AST
deserialization while delegating full ECMAScript lexical handling (including regex literals,
templates, and escapes) to Oxc. This keeps main-thread startup free of eager native or WASM parser
loading. The fallback removes whitespace consistently with the fast path, removing comment-only
lines entirely while preserving line terminators for comments that follow code. Also harden
trailing URL and base64 validation so block comments or template literals closing on the same line
are never misclassified by the fast path.

Closes angular#34590
@alan-agius4 alan-agius4 removed the action: review The PR is still awaiting reviews from at least one requested reviewer label Nov 3, 2026
…ASI shim

Replace side-effect imports of `oxc-wasi-shim` with a centralized
`loadOxcParser()` helper across `@angular/build` consumers.

Because `oxc-parser` evaluates its WASI bindings synchronously during
`require('oxc-parser')`, `loadOxcParser()` restores `Module._resolveFilename`
in a `finally` block immediately after loading. This avoids leaving
`@emnapi/core` and `@emnapi/runtime` resolution permanently overridden on the
main thread where `rolldown` and `vite` resolve their own `@emnapi/*` versions.
@clydin
clydin force-pushed the fix/source-map-oxc-comment-stripping branch from a2e3e69 to 69e3051 Compare November 3, 2026 13:33
@clydin clydin added the action: merge The PR is ready for merge by the caretaker label Nov 3, 2026
@alan-agius4

Copy link
Copy Markdown
Collaborator

This PR was merged into the repository. The changes were merged into the following branches:

alan-agius4 pushed a commit that referenced this pull request Nov 3, 2026
…p comments (#34632)

Previously, `removeSourceMappingURL` relied on a custom character-by-character state machine to
strip top-level `//# sourceMappingURL=` comments from JavaScript strings. Because that scanner did
not track regular expression literals, quote characters or backticks inside a regex literal (such
as `/"/`) inverted string boundaries for the remainder of the file. When a subsequent string
literal contained `//# sourceMappingURL=`, the scanner misidentified it as a top-level comment and
truncated valid JavaScript, or failed to strip the actual trailing comment at the end of the chunk.

Extend the single-trailing-comment fast path to string inputs and pass raw byte buffers directly
from the Vite memory plugin so standard chunks slice trailing source-map comments without invoking
a parser. When a file contains multiple or non-trailing `//# sourceMappingURL=` occurrences, lazily
load `oxc-parser` and read only the `comments` of the parse result, avoiding JS-side AST
deserialization while delegating full ECMAScript lexical handling (including regex literals,
templates, and escapes) to Oxc. This keeps main-thread startup free of eager native or WASM parser
loading. The fallback removes whitespace consistently with the fast path, removing comment-only
lines entirely while preserving line terminators for comments that follow code. Also harden
trailing URL and base64 validation so block comments or template literals closing on the same line
are never misclassified by the fast path.

Closes #34590

PR Close #34632
alan-agius4 pushed a commit that referenced this pull request Nov 3, 2026
…ASI shim (#34632)

Replace side-effect imports of `oxc-wasi-shim` with a centralized
`loadOxcParser()` helper across `@angular/build` consumers.

Because `oxc-parser` evaluates its WASI bindings synchronously during
`require('oxc-parser')`, `loadOxcParser()` restores `Module._resolveFilename`
in a `finally` block immediately after loading. This avoids leaving
`@emnapi/core` and `@emnapi/runtime` resolution permanently overridden on the
main thread where `rolldown` and `vite` resolve their own `@emnapi/*` versions.

PR Close #34632
alan-agius4 pushed a commit to alan-agius4/angular-cli that referenced this pull request Nov 3, 2026
…ASI shim (angular#34632)

Replace side-effect imports of `oxc-wasi-shim` with a centralized
`loadOxcParser()` helper across `@angular/build` consumers.

Because `oxc-parser` evaluates its WASI bindings synchronously during
`require('oxc-parser')`, `loadOxcParser()` restores `Module._resolveFilename`
in a `finally` block immediately after loading. This avoids leaving
`@emnapi/core` and `@emnapi/runtime` resolution permanently overridden on the
main thread where `rolldown` and `vite` resolve their own `@emnapi/*` versions.

PR Close angular#34632
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

action: merge The PR is ready for merge by the caretaker area: @angular/build target: patch This PR is targeted for the next patch release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

@angular/build: source-map comment scanner corrupts valid JS containing a regex literal

2 participants