Irregexp-ia32: Fixed backref-matching (works, and advances current position).

src/interpreter-irregexp.cc

 // Copyright 2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 315 matching lines @@
       BYTECODE(CHECK_NOT_REGS_EQUAL)
         if (registers[pc[1]] == registers[pc[2]]) {
           pc += BC_CHECK_NOT_REGS_EQUAL_LENGTH;
         } else {
           pc = code_base + Load32(pc + 3);
         }
         break;
       BYTECODE(CHECK_NOT_BACK_REF) {
         int from = registers[pc[1]];
         int len = registers[pc[1] + 1] - from;
+        if (from < 0 || len <= 0) {
+          pc += BC_CHECK_NOT_BACK_REF_LENGTH;
+          break;
+        }
         if (current + len > subject.length()) {
           pc = code_base + Load32(pc + 2);
           break;
         } else {
           int i;
           for (i = 0; i < len; i++) {
             if (subject[from + i] != subject[current + i]) {
               pc = code_base + Load32(pc + 2);
               break;
             }
           }
           if (i < len) break;
           current += len;
         }
         pc += BC_CHECK_NOT_BACK_REF_LENGTH;
         break;
       }
       BYTECODE(CHECK_NOT_BACK_REF_NO_CASE) {
         int from = registers[pc[1]];
         int len = registers[pc[1] + 1] - from;
+        if (from < 0 || len <= 0) {
+          pc += BC_CHECK_NOT_BACK_REF_NO_CASE_LENGTH;
+          break;
+        }
         if (current + len > subject.length()) {
           pc = code_base + Load32(pc + 2);
           break;
         } else {
           if (BackRefMatchesNoCase(from, current, len, subject)) {
             pc += BC_CHECK_NOT_BACK_REF_NO_CASE_LENGTH;
           } else {
             pc = code_base + Load32(pc + 2);
           }
         }
@@ skipping 28 matching lines @@
       Vector<const uc16>(subject16->GetTwoByteData(), subject16->length());
   if (start_position != 0) previous_char = subject_vector[start_position - 1];
   return RawMatch(code_base,
                   subject_vector,
                   registers,
                   start_position,
                   previous_char);
 }
 
 } }  // namespace v8::internal