avoid potential RegExp denial-of-service (#5135)

closes #5133
closes #5134

lib/compress.js

@@ -11336,7 +11336,7 @@ merge(Compressor.prototype, {
 
     function decode_template(str) {
         var malformed = false;
-        str = str.replace(/\\(u\{[^}]*\}?|u[\s\S]{0,4}|x[\s\S]{0,2}|[0-9]+|[\s\S])/g, function(match, seq) {
+        str = str.replace(/\\(u\{[^{}]*\}?|u[\s\S]{0,4}|x[\s\S]{0,2}|[0-9]+|[\s\S])/g, function(match, seq) {
             var ch = decode_escape_sequence(seq);
             if (typeof ch == "string") return ch;
             malformed = true;

lib/utils.js

@@ -143,7 +143,7 @@ function push_uniq(array, el) {
 }
 
 function string_template(text, props) {
-    return text.replace(/\{([^}]+)\}/g, function(str, p) {
+    return text.replace(/\{([^{}]+)\}/g, function(str, p) {
         var value = props[p];
         return value instanceof AST_Node ? value.print_to_string() : value;
     });