[regexp] Properly handle failed RegExp compilations

src/runtime/runtime-regexp.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include <functional>
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
@@ skipping 588 matching lines @@
     Handle<String> replacement, Handle<RegExpMatchInfo> last_match_info) {
   DCHECK(subject->IsFlat());
   DCHECK(replacement->IsFlat());
 
   int capture_count = regexp->CaptureCount();
   int subject_length = subject->length();
 
   JSRegExp::Type typeTag = regexp->TypeTag();
   if (typeTag == JSRegExp::IRREGEXP) {
     // Ensure the RegExp is compiled so we can access the capture-name map.
-    RegExpImpl::IrregexpPrepare(regexp, subject);
+    if (RegExpImpl::IrregexpPrepare(regexp, subject) == -1) {
+      DCHECK(isolate->has_pending_exception());
+      return isolate->heap()->exception();
+    }
   }
 
   // CompiledReplacement uses zone allocation.
   Zone zone(isolate->allocator(), ZONE_NAME);
   CompiledReplacement compiled_replacement(&zone);
   Maybe<bool> maybe_simple_replace = compiled_replacement.Compile(
       regexp, replacement, capture_count, subject_length);
   if (maybe_simple_replace.IsNothing()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewSyntaxError(MessageTemplate::kRegExpInvalidReplaceString,
@@ skipping 1315 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_IsRegExp) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_CHECKED(Object, obj, 0);
   return isolate->heap()->ToBoolean(obj->IsJSRegExp());
 }
 
 }  // namespace internal
 }  // namespace v8