[regexp] Throw on invalid capture group names in replacer string

src/objects.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include <cmath>
 #include <iomanip>
 #include <memory>
 #include <sstream>
@@ skipping 11499 matching lines @@
         bool capture_exists;
         Handle<String> capture;
         ASSIGN_RETURN_ON_EXCEPTION(
             isolate, capture, match->GetCapture(scaled_index, &capture_exists),
             String);
         if (capture_exists) builder.AppendString(capture);
         continue_from_ix = peek_ix + advance;
         break;
       }
       case '<': {  // $<name> - named capture
+        typedef String::Match::CaptureState CaptureState;
+
         if (!match->HasNamedCaptures()) {
           builder.AppendCharacter('$');
           continue_from_ix = peek_ix;
           break;
         }
 
         Handle<String> bracket_string =
             factory->LookupSingleCharacterStringFromCode('>');
         const int closing_bracket_ix =
             String::IndexOf(isolate, replacement, bracket_string, peek_ix + 1);
 
         if (closing_bracket_ix == -1) {
           THROW_NEW_ERROR(
               isolate,
               NewSyntaxError(MessageTemplate::kRegExpInvalidReplaceString,
                              replacement),
               String);
         }
 
         Handle<String> capture_name =
             factory->NewSubString(replacement, peek_ix + 1, closing_bracket_ix);
-        bool capture_exists;
         Handle<String> capture;
+        CaptureState capture_state;
         ASSIGN_RETURN_ON_EXCEPTION(
             isolate, capture,
-            match->GetNamedCapture(capture_name, &capture_exists), String);
-        if (capture_exists) builder.AppendString(capture);
+            match->GetNamedCapture(capture_name, &capture_state), String);
+
+        switch (capture_state) {
+          case CaptureState::INVALID:
+            THROW_NEW_ERROR(
+                isolate,
+                NewSyntaxError(MessageTemplate::kRegExpInvalidReplaceString,
+                               replacement),
+                String);
+            break;
+          case CaptureState::UNMATCHED:
+            break;
+          case CaptureState::MATCHED:
+            builder.AppendString(capture);
+            break;
+        }
+
         continue_from_ix = closing_bracket_ix + 1;
         break;
       }
       default:
         builder.AppendCharacter('$');
         continue_from_ix = peek_ix;
         break;
     }
 
     // Go the the next $ in the replacement.
@@ skipping 8863 matching lines @@
       // depend on this.
       return DICTIONARY_ELEMENTS;
     }
     DCHECK_LE(kind, LAST_ELEMENTS_KIND);
     return kind;
   }
 }
 
 }  // namespace internal
 }  // namespace v8