fix(module-runner): prevent crash when sourceMappingURL pattern appears in string literals

packages/vite/src/module-runner/evaluatedModules.ts

@@ -108,12 +108,26 @@ export class EvaluatedModules {
     if (!mod) return null
     if (mod.map) return mod.map
     if (!mod.meta || !('code' in mod.meta)) return null
+
+    // Find the last occurrence of sourceMappingURL by finding the last line that contains it
+    const pattern = `//# ${SOURCEMAPPING_URL}=data:application/json;base64,`
+    const lastIndex = mod.meta.code.lastIndexOf(pattern)
+    if (lastIndex === -1) return null
+
     const mapString = MODULE_RUNNER_SOURCEMAPPING_REGEXP.exec(
-      mod.meta.code,
+      mod.meta.code.slice(lastIndex),
     )?.[1]
     if (!mapString) return null
-    mod.map = new DecodedMap(JSON.parse(decodeBase64(mapString)), mod.file)
-    return mod.map
+
+    try {
+      const decoded = decodeBase64(mapString)
+      const parsed = JSON.parse(decoded)
+      mod.map = new DecodedMap(parsed, mod.file)
+      return mod.map
+    } catch {
+      // Invalid base64 or malformed JSON
+      return null
+    }
   }
 
   public clear(): void {

packages/vite/src/node/ssr/runtime/__tests__/server-source-maps.spec.ts

@@ -93,4 +93,24 @@ describe('module runner initialization', async () => {
       '    at Module.main (<root>/fixtures/has-error-deep.ts:6:3)',
     ])
   })
+
+  it('should not crash when sourceMappingURL pattern appears in string literals', async ({
+    runner,
+  }) => {
+    const modules = runner.evaluatedModules
+
+    const moduleId = '/test/string-literal-sourcemap.js'
+    const moduleUrl = 'http://localhost:3000/test/string-literal-sourcemap.js'
+    const node = modules.ensureModule(moduleId, moduleUrl)
+
+    node.meta = {
+      code: `const text = "//# sourceMappingURL=data:application/json;base64,invalidbase64";
+console.log(text);`,
+    }
+
+    expect(() => {
+      const sourceMap = modules.getModuleSourceMapById(moduleId)
+      expect(sourceMap).toBeNull()
+    }).not.toThrow()
+  })
 })