fix(@angular/build): use oxc-parser fallback when stripping source-map comments

Previously, `removeSourceMappingURL` relied on a custom character-by-character state machine to
strip top-level `//# sourceMappingURL=` comments from JavaScript strings. Because that scanner did
not track regular expression literals, quote characters or backticks inside a regex literal (such
as `/"/`) inverted string boundaries for the remainder of the file. When a subsequent string
literal contained `//# sourceMappingURL=`, the scanner misidentified it as a top-level comment and
truncated valid JavaScript, or failed to strip the actual trailing comment at the end of the chunk.

Extend the single-trailing-comment fast path to string inputs and pass raw byte buffers directly
from the Vite memory plugin so standard chunks slice trailing source-map comments without invoking
a parser. When a file contains multiple or non-trailing `//# sourceMappingURL=` occurrences, lazily
load `oxc-parser` and read only the `comments` of the parse result, avoiding JS-side AST
deserialization while delegating full ECMAScript lexical handling (including regex literals,
templates, and escapes) to Oxc. This keeps main-thread startup free of eager native or WASM parser
loading. The fallback removes whitespace consistently with the fast path, removing comment-only
lines entirely while preserving line terminators for comments that follow code. Also harden
trailing URL and base64 validation so block comments or template literals closing on the same line
are never misclassified by the fast path.

Closes angular#34590

Author: clydin

packages/angular/build/src/tools/javascript-transformer/javascript-transformer-worker.ts

@@ -136,11 +136,11 @@ export default async function transformJavaScript(
         textData = textDecoder.decode(trailing.code);
         isAlreadyStripped = true;
       } else {
-        // Fallback to full decode and state-machine stripping
+        // Not a valid trailing sourcemap: fall back to full decode and oxc comment stripping
         textData = textDecoder.decode(data);
       }
     } else {
-      // Multiple comments or comment not at line start: fall back to full decode and string parser
+      // Multiple comments or comment not at line start: fall back to full decode and oxc comment stripping
       textData = textDecoder.decode(data);
     }
   } else {

packages/angular/build/src/tools/vite/plugins/angular-memory-plugin.ts

@@ -99,19 +99,30 @@ export async function createAngularMemoryPlugin(
         return undefined;
       }
 
-      const code = Buffer.from(codeContents).toString('utf-8');
       const mapContents = outputFiles.get(relativeFile + '.map')?.contents;
+      const strippedContents = mapContents ? removeSourceMappingURL(codeContents) : codeContents;
 
       return {
         // Remove source map URL comments from the code if a sourcemap is present.
         // Vite will inline and add an additional sourcemap URL for the sourcemap.
-        code: mapContents ? removeSourceMappingURL(code) : code,
-        map: mapContents && Buffer.from(mapContents).toString('utf-8'),
+        code: decodeUtf8(strippedContents),
+        map: mapContents && decodeUtf8(mapContents),
       };
     },
   };
 }
 
+/**
+ * Decodes UTF-8 bytes into a string without copying the underlying memory.
+ */
+function decodeUtf8(data: Uint8Array): string {
+  const buffer = Buffer.isBuffer(data)
+    ? data
+    : Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+
+  return buffer.toString('utf-8');
+}
+
 /**
  * Reads the resolved Vite client code from disk and updates the content to remove
  * an unactionable suggestion to update the Vite configuration file to disable the

packages/angular/build/src/utils/source-map.ts

@@ -8,11 +8,15 @@
 
 import type { EncodedSourceMap } from '@ampproject/remapping';
 import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const SOURCEMAP_COMMENT_PREFIX = '//# sourceMappingURL=';
 export const SOURCEMAP_COMMENT_BYTES = Buffer.from(SOURCEMAP_COMMENT_PREFIX);
+const SOURCEMAP_COMMENT_VALUE_PREFIX = SOURCEMAP_COMMENT_PREFIX.slice(2);
+
+let parseSync: typeof import('oxc-parser').parseSync | undefined;
 
 /**
  * Checks for a single trailing `//# sourceMappingURL=` comment on a raw buffer.
@@ -59,10 +63,11 @@ export function findTrailingSourceMapComment(
 
 /**
  * Removes `//# sourceMappingURL=` comments safely from the given JavaScript code,
- * ignoring any occurrences that are inside string literals, template literals, or block comments.
+ * ignoring any occurrences that are inside string literals, template literals, regex literals,
+ * or block comments.
  *
- * For raw Uint8Array / Buffer inputs, it optimizes performance by inspecting trailing byte sequences
- * to slice the buffer directly without full string decoding.
+ * Single trailing sourcemap comments are sliced directly via a fast path; files with multiple
+ * or non-trailing occurrences lazily fall back to `oxc-parser` comment extraction.
  *
  * @param code The JavaScript source code as a string or Uint8Array.
  * @returns The code with top-level sourcemap comments removed.
@@ -83,179 +88,123 @@ export function removeSourceMappingURL(code: string | Uint8Array): string | Uint
     return trailing.code;
   }
 
-  // Fallback to full decode and state-machine stripping for multiple comments or non-trailing comments
+  // Fallback to full decode and AST lexer comment stripping for multiple or non-trailing comments
   const dataBuffer = Buffer.isBuffer(code)
     ? code
     : Buffer.from(code.buffer, code.byteOffset, code.byteLength);
   const text = dataBuffer.toString('utf-8');
-  const stripped = removeSourceMappingURLFromString(text);
+  const stripped = removeSourceMappingURLFromString(text, true);
 
   return stripped === text ? code : Buffer.from(stripped, 'utf-8');
 }
 
-function removeSourceMappingURLFromString(code: string): string {
-  if (!code.includes(SOURCEMAP_COMMENT_PREFIX)) {
+function removeSourceMappingURLFromString(code: string, skipTrailingCheck = false): string {
+  const firstIndex = code.indexOf(SOURCEMAP_COMMENT_PREFIX);
+  if (firstIndex === -1) {
     return code;
   }
 
+  if (!skipTrailingCheck) {
+    const lastIndex = code.lastIndexOf(SOURCEMAP_COMMENT_PREFIX);
+    let prevIdx = lastIndex - 1;
+    while (prevIdx >= 0 && (code[prevIdx] === ' ' || code[prevIdx] === '\t')) {
+      prevIdx--;
+    }
+    const isLineStart = prevIdx < 0 || code[prevIdx] === '\n' || code[prevIdx] === '\r';
+    if (
+      firstIndex === lastIndex &&
+      isLineStart &&
+      isTrailingSourceMapComment(code.slice(lastIndex + SOURCEMAP_COMMENT_PREFIX.length))
+    ) {
+      return code.slice(0, prevIdx < 0 ? 0 : prevIdx + 1);
+    }
+  }
+
+  parseSync ??= (createRequire(__filename)('oxc-parser') as typeof import('oxc-parser')).parseSync;
+
+  const { comments } = parseSync('source.js', code, {
+    lang: 'js',
+    sourceType: 'unambiguous',
+  });
+
   const result: string[] = [];
   let lastCopiedIndex = 0;
-  let i = 0;
-  const len = code.length;
-
-  // Stack to track template literal state and curly brace depth for nested interpolations.
-  const stack: { type: 'template'; braceDepth: number }[] = [];
-  let currentState:
-    'normal' | 'string_double' | 'string_single' | 'template' | 'comment_block' | 'comment_line' =
-    'normal';
-
-  while (i < len) {
-    const char = code[i];
-    const nextChar = code[i + 1];
-
-    if (currentState === 'normal') {
-      if (char === '/' && nextChar === '*') {
-        currentState = 'comment_block';
-        i += 2;
-        continue;
-      }
-      if (char === '/' && nextChar === '/') {
-        // Detect if the comment is escaped (e.g. inside a regex literal like `/\/\/#/`).
-        let isEscaped = false;
-        let prevIdx = i - 1;
-        while (prevIdx >= 0 && /\s/.test(code[prevIdx])) {
-          prevIdx--;
-        }
-        if (prevIdx >= 0 && code[prevIdx] === '\\') {
-          let bsCount = 0;
-          while (prevIdx >= 0 && code[prevIdx] === '\\') {
-            bsCount++;
-            prevIdx--;
-          }
-          if (bsCount % 2 === 1) {
-            isEscaped = true;
-          }
-        }
-
-        if (!isEscaped && code.startsWith(SOURCEMAP_COMMENT_PREFIX, i)) {
-          if (i > lastCopiedIndex) {
-            result.push(code.slice(lastCopiedIndex, i));
-          }
-          // Skip the rest of the comment line up to the newline
-          i += SOURCEMAP_COMMENT_PREFIX.length;
-          while (i < len && code[i] !== '\n' && code[i] !== '\r') {
-            i++;
-          }
-          lastCopiedIndex = i;
-          continue;
-        } else {
-          currentState = 'comment_line';
-          i += 2;
-          continue;
-        }
-      }
-      if (char === '"') {
-        currentState = 'string_double';
-        i++;
-        continue;
-      }
-      if (char === "'") {
-        currentState = 'string_single';
-        i++;
-        continue;
-      }
-      if (char === '`') {
-        currentState = 'template';
-        stack.push({ type: 'template', braceDepth: 0 });
-        i++;
-        continue;
-      }
-      if (char === '{') {
-        const top = stack[stack.length - 1];
-        if (top) {
-          top.braceDepth++;
-        }
-        i++;
-        continue;
-      }
-      if (char === '}') {
-        const top = stack[stack.length - 1];
-        if (top) {
-          top.braceDepth--;
-          if (top.braceDepth < 0) {
-            // Exiting a template literal interpolation ${ ... }
-            stack.pop();
-            currentState = 'template';
-            i++;
-            continue;
-          }
-        }
-        i++;
-        continue;
-      }
 
-      i++;
-    } else if (currentState === 'string_double') {
-      if (char === '\\') {
-        i += 2;
-        continue;
-      }
-      if (char === '"') {
-        currentState = 'normal';
-      }
-      i++;
-    } else if (currentState === 'string_single') {
-      if (char === '\\') {
-        i += 2;
-        continue;
-      }
-      if (char === "'") {
-        currentState = 'normal';
-      }
-      i++;
-    } else if (currentState === 'template') {
-      if (char === '\\') {
-        i += 2;
-        continue;
-      }
-      if (char === '$' && nextChar === '{') {
-        // Entering template literal interpolation context
-        currentState = 'normal';
-        stack.push({ type: 'template', braceDepth: 0 });
-        i += 2;
-        continue;
-      }
-      if (char === '`') {
-        stack.pop();
-        currentState = 'normal';
-      }
-      i++;
-    } else if (currentState === 'comment_block') {
-      if (char === '*' && nextChar === '/') {
-        currentState = 'normal';
-        i += 2;
-        continue;
-      }
-      i++;
-    } else if (currentState === 'comment_line') {
-      if (char === '\n' || char === '\r') {
-        currentState = 'normal';
+  for (const comment of comments) {
+    if (comment.type !== 'Line' || !comment.value.startsWith(SOURCEMAP_COMMENT_VALUE_PREFIX)) {
+      continue;
+    }
+
+    let start = comment.start;
+    let end = comment.end;
+
+    // Match the trailing fast path: when the comment is the only content on its line, remove the
+    // entire line (or everything up to EOF if only whitespace follows). Comments that follow code
+    // on the same line keep their line terminator to avoid altering automatic semicolon insertion.
+    let lineStart = start;
+    while (lineStart > lastCopiedIndex && isHorizontalWhitespace(code.charCodeAt(lineStart - 1))) {
+      lineStart--;
+    }
+    if (lineStart === 0 || isLineTerminator(code.charCodeAt(lineStart - 1))) {
+      start = lineStart;
+      if (isWhitespaceToEnd(code, end)) {
+        end = code.length;
+      } else if (code.charCodeAt(end) === 13 && code.charCodeAt(end + 1) === 10) {
+        end += 2;
+      } else if (isLineTerminator(code.charCodeAt(end))) {
+        end++;
       }
-      i++;
     }
+
+    if (start > lastCopiedIndex) {
+      result.push(code.slice(lastCopiedIndex, start));
+    }
+    lastCopiedIndex = end;
   }
 
   if (lastCopiedIndex === 0) {
     return code;
   }
 
-  if (lastCopiedIndex < len) {
+  if (lastCopiedIndex < code.length) {
     result.push(code.slice(lastCopiedIndex));
   }
 
   return result.join('');
 }
 
+function isHorizontalWhitespace(code: number): boolean {
+  return code === 32 || code === 9; // space, tab
+}
+
+function isLineTerminator(code: number): boolean {
+  return code === 10 || code === 13; // \n, \r
+}
+
+function isWhitespaceToEnd(code: string, start: number): boolean {
+  for (let i = start; i < code.length; i++) {
+    const char = code.charCodeAt(i);
+    if (!isHorizontalWhitespace(char) && !isLineTerminator(char)) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function isBase64Char(code: number): boolean {
+  return (
+    (code >= 65 && code <= 90) || // A-Z
+    (code >= 97 && code <= 122) || // a-z
+    (code >= 48 && code <= 57) || // 0-9
+    code === 43 || // +
+    code === 47 || // /
+    code === 61 || // =
+    code === 45 || // -
+    code === 95 // _
+  );
+}
+
 /**
  * Extracts the base64 payload from an inline sourcemap data URI line and verifies
  * that only trailing whitespace follows the payload.
@@ -274,13 +223,22 @@ function extractTrailingBase64Payload(urlLine: string): string | undefined {
 
   const payloadStart = base64StartIndex + 7;
   let payloadEnd = urlLine.length;
-  // Find the first trailing whitespace character that marks the end of the base64 payload.
+  // Find the first trailing whitespace character that marks the end of the base64 payload,
+  // while ensuring all payload characters are valid base64 (preventing false positives when
+  // closing quotes, backticks, or `*/` immediately follow the payload).
   for (let i = payloadStart; i < urlLine.length; i++) {
     const char = urlLine[i];
     if (char === ' ' || char === '\r' || char === '\n' || char === '\t') {
       payloadEnd = i;
       break;
     }
+    if (!isBase64Char(urlLine.charCodeAt(i))) {
+      return undefined;
+    }
+  }
+
+  if (payloadEnd === payloadStart) {
+    return undefined;
   }
 
   // Verify that everything after the base64 payload is trailing whitespace
@@ -307,7 +265,7 @@ function extractTrailingUrl(urlLine: string): string | undefined {
   }
 
   const urlMatch = /^([^\r\n\s'"`]+)/.exec(urlLine);
-  if (!urlMatch) {
+  if (!urlMatch || urlMatch[1].includes('*/')) {
     return undefined;
   }