`ModuleRunner` picking wrong `sourceMappingURL`

[AriPerkkio]

Describe the bug

When a source file has specific string that matches the MODULE_RUNNER_SOURCEMAPPING_REGEXP, getModuleSourceMapById will pick wrong source map URL and can fail.

vite/packages/vite/src/module-runner/evaluatedModules.ts

Lines 7 to 9 in 3c961ec

	const MODULE_RUNNER_SOURCEMAPPING_REGEXP = new RegExp(
	`//# ${SOURCEMAPPING_URL}=data:application/json;base64,(.+)`,
	)

      throw lazyDOMException('Invalid character', 'InvalidCharacterError');
            ^
DOMException [InvalidCharacterError]: Invalid character
    at atob (node:buffer:1302:13)
    at EvaluatedModules.getModuleSourceMapById (file:///Users/ari/Git/repros/module-runner/node_modules/.pnpm/vite@7.0.6/node_modules/vite/dist/node/module-runner.js:286:59)
    at file:///Users/ari/Git/repros/module-runner/index.mjs:24:31

In the reproduction, this will fix the crash:

- const text = "//# sourceMappingURL=data:application/json;base64,\${encoded}";
+ const text = "//# sourceMappingURL_ANYTHING=data:application/json;base64,\${encoded}";

Reproduction

https://stackblitz.com/~/edit/node-eolunju1?file=index.js

Steps to reproduce

npm i; node index.js

System Info

System:
    OS: macOS 15.5
    CPU: (8) arm64 Apple M2
    Memory: 121.16 MB / 16.00 GB
    Shell: 3.2.57 - /bin/bash
  Binaries:
    Node: 22.17.0 - ~/.nvm/versions/node/v22.17.0/bin/node
    npm: 10.9.2 - ~/.nvm/versions/node/v22.17.0/bin/npm
    pnpm: 8.15.9 - ~/.nvm/versions/node/v22.17.0/bin/pnpm
    bun: 1.2.16 - ~/.bun/bin/bun
  Browsers:
    Brave Browser: 131.1.73.101
    Chrome: 138.0.7204.184
    Safari: 18.5
  npmPackages:
    vite: ^7.0.6 => 7.0.6

Used Package Manager

npm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[sapphi-red]

It seems this is searching from the start, while this should be searching from the end.

vite/packages/vite/src/module-runner/evaluatedModules.ts

Lines 111 to 113 in 3c961ec

	const mapString = MODULE_RUNNER_SOURCEMAPPING_REGEXP.exec(
	mod.meta.code,
	)?.[1]

Picking up the comment inside a string literal itself is currently spec compliant (https://tc39.es/ecma426/#sec-linking-inline, tc39/ecma426#138).

It seems other places have the same problem.

• vite/packages/vite/src/node/ssr/fetchModule.ts

  Line 140 in 3c961ec

  code = code.replace(OTHER_SOURCE_MAP_REGEXP, '')

• vite/packages/vite/src/node/server/sourcemap.ts

  Line 163 in 3c961ec

  code: code.replace(convertSourceMap.mapFileCommentRegex, blankReplacer),

• vite/packages/vite/src/node/plugins/importAnalysisBuild.ts

  Lines 724 to 727 in 3c961ec

  	chunk.code = chunk.code.replace(
  	convertSourceMap.mapFileCommentRegex,
  	'',
  	)

[AriPerkkio]

Picking the last match should do it. Or, could we limit the matches with sourceMappingSource check too? Pick only the vite-generated ones.

// <sources>

//# sourceMappingSource=vite-generated
//# sourceMappingURL=data:application/json;base64,eyJ2Z...