`npm run build` produces broken code

[rwoll]

Describe the bug

The following statement evaluates differently when run in React Dev mode versus
a production optimized build produced by create-react-app:

console.log(/[^\d\-a-z]/iu.exec("a"))

The code should print null in both settings, but prints a null in dev (correct) and a match (incorrect) in the production optimized build.

Did you try recovering your dependencies?

N/A - The repo starts from a fresh npx create-react-app run.

Which terms did you search for in User Guide?

regex, production vs dev build, terser

Environment

$ npx create-react-app --info
npx: installed 98 in 4.318s

Environment Info:

  current version of create-react-app: 3.4.1
  running from /$HOME/.npm/_npx/57675/lib/node_modules/create-react-app

  System:
    OS: macOS 10.15.6
    CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
  Binaries:
    Node: 14.7.0 - /usr/local/bin/node
    Yarn: Not Found
    npm: 6.14.7 - /usr/local/bin/npm
  Browsers:
    Chrome: Not Found
    Firefox: 80.0.1
    Safari: 13.1.2
  npmPackages:
    react: ^16.13.1 => 16.13.1 
    react-dom: ^16.13.1 => 16.13.1 
    react-scripts: 3.4.3 => 3.4.3 
  npmGlobalPackages:
    create-react-app: Not Found

Steps to reproduce

See full contained repro repo: https://github.com/rwoll/repro-create-react-app-regex

1. Clone and navigate to repo:

   $ git@github.com:rwoll/repro-create-react-app-regex.git
   $ cd repro-create-react-app-regex
   

2. Install dependencies:

   $ npm i
   

3. Launch the app in dev mode:

   $ npm start
   

Observe true is displayed.

4. Build the production optimized version of the app, and launch on port 4000:

   $ npm run build
   $ npx serve -s build -l tcp://localhost:4000
   

Observe false is displayed.

Both cases should be consistent and display true; however, something as part of
the production build (Terser?) is making the code wrong.

Expected behavior

true is displayed in both dev and prod envs.

Actual behavior

true is displayed in dev, false is displayed in prod.

Reproducible demo

https://github.com/rwoll/repro-create-react-app-regex

[rwoll]

It looks like this may be caused by Babel's babel-plugin-transform-es2015-unicode-regex plugin.

See the example below where the input:

/[^\d\-a-z]/iu.exec("a")

evalutes to null, but the transformed output:

/(?:[\0-,\.\/:-`\{-\u017E\u0180-\u2129\u212B-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])/i.exec("a");

evaluates to:

[ 'a', index: 0, input: 'a', groups: undefined ]

https://babeljs.io/repl#?browsers=defaults%2C%20not%20ie%2011%2C%20not%20ie_mob%2011&build=&builtIns=false&spec=false&loose=false&code_lz=PQbQegOgJhC0CGsBeBdYBLArgOgKYA9cBjACgCJ4yBKIA&debug=false&forceAllTransforms=false&shippedProposals=false&circleciRepo=&evaluate=false&fileSize=false&timeTravel=false&sourceType=module&lineWrap=true&presets=env%2Creact%2Cstage-2%2Cenv&prettier=false&targets=&version=7.11.6&externalPlugins=babel-plugin-transform-es2015-unicode-regex%406.24.1

[rwoll]

It looks like this comes down to a bug in the regex core library used by Babel's babel-plugin-transform-es2015-unicode-regex plugin.

Here's a link to the upstream issue: babel/babel#12075 (which has a dependency on this issue mathiasbynens/regexpu-core#45).

[rwoll]

Confirmed this works with lates create-react-app now that the dependencies are fixed and pulled into the last version.