[regexp] back refs must not start/end in the middle of a surrogate pair

src/regexp/jsregexp.cc

Index: src/regexp/jsregexp.cc
diff --git a/src/regexp/jsregexp.cc b/src/regexp/jsregexp.cc
index 6235c25c7762f05ef399fc31838e64a10e2b2a39..777ee610e4b5eb4f9bc308e41985d5ba9c83e17c 100644
--- a/src/regexp/jsregexp.cc
+++ b/src/regexp/jsregexp.cc
@@ -3587,12 +3587,6 @@ class AlternativeGenerationList {
 };
 
 
-static const uc32 kLeadSurrogateStart = 0xd800;
-static const uc32 kLeadSurrogateEnd = 0xdbff;
-static const uc32 kTrailSurrogateStart = 0xdc00;
-static const uc32 kTrailSurrogateEnd = 0xdfff;
-static const uc32 kNonBmpStart = 0x10000;
-static const uc32 kNonBmpEnd = 0x10ffff;
 static const uc32 kRangeEndMarker = 0x110000;
 
 // The '2' variant is has inclusive from and exclusive to.
@@ -4393,6 +4387,11 @@ void BackReferenceNode::Emit(RegExpCompiler* compiler, Trace* trace) {
 
   RecursionCheck rc(compiler);
 
+  bool surrogate_check = compiler->unicode() && !compiler->one_byte();
+  if (surrogate_check) {
+    assembler->CheckNotInSurrogatePair(trace->cp_offset(), trace->backtrack());
+  }

[erikcorry, 2016/01/26 16:25:06]

You don't need this check (and thus you don't need the surrogate_check variable
either).

[Yang, 2016/01/27 09:06:06]

Done. Thanks.

+
   DCHECK_EQ(start_reg_ + 1, end_reg_);
   if (compiler->ignore_case()) {
     assembler->CheckNotBackReferenceIgnoreCase(start_reg_, read_backward(),
@@ -4403,6 +4402,10 @@ void BackReferenceNode::Emit(RegExpCompiler* compiler, Trace* trace) {
   }
   // We are going to advance backward, so we may end up at the start.
   if (read_backward()) trace->set_at_start(Trace::UNKNOWN);
+
+  if (surrogate_check) {
+    assembler->CheckNotInSurrogatePair(trace->cp_offset(), trace->backtrack());
+  }
   on_success()->Emit(compiler, trace);
 }