[regexp] Throw on invalid capture group names in replacer string

src/runtime/runtime-regexp.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include <functional>
 
 #include "src/arguments.h"
 #include "src/conversions-inl.h"
@@ skipping 57 matching lines @@
 
   Zone* zone() const { return zone_; }
 
  private:
   enum PartType {
     SUBJECT_PREFIX = 1,
     SUBJECT_SUFFIX,
     SUBJECT_CAPTURE,
     REPLACEMENT_SUBSTRING,
     REPLACEMENT_STRING,
-    EMPTY,
     NUMBER_OF_PART_TYPES
   };
 
   struct ReplacementPart {
     static inline ReplacementPart SubjectMatch() {
       return ReplacementPart(SUBJECT_CAPTURE, 0);
     }
     static inline ReplacementPart SubjectCapture(int capture_index) {
       return ReplacementPart(SUBJECT_CAPTURE, capture_index);
     }
     static inline ReplacementPart SubjectPrefix() {
       return ReplacementPart(SUBJECT_PREFIX, 0);
     }
     static inline ReplacementPart SubjectSuffix(int subject_length) {
       return ReplacementPart(SUBJECT_SUFFIX, subject_length);
     }
     static inline ReplacementPart ReplacementString() {
       return ReplacementPart(REPLACEMENT_STRING, 0);
     }
     static inline ReplacementPart ReplacementSubString(int from, int to) {
       DCHECK(from >= 0);
       DCHECK(to > from);
       return ReplacementPart(-from, to);
     }
-    static inline ReplacementPart Empty() { return ReplacementPart(EMPTY, 0); }
 
     // If tag <= 0 then it is the negation of a start index of a substring of
     // the replacement pattern, otherwise it's a value from PartType.
     ReplacementPart(int tag, int data) : tag(tag), data(data) {
       // Must be non-positive or a PartType value.
       DCHECK(tag < NUMBER_OF_PART_TYPES);
     }
     // Either a value of PartType or a non-positive number that is
     // the negation of an index into the replacement string.
     int tag;
     // The data value's interpretation depends on the value of tag:
     // tag == SUBJECT_PREFIX ||
-    // tag == SUBJECT_SUFFIX ||
-    // tag == EMPTY:  data is unused.
+    // tag == SUBJECT_SUFFIX:  data is unused.
     // tag == SUBJECT_CAPTURE: data is the number of the capture.
     // tag == REPLACEMENT_SUBSTRING ||
     // tag == REPLACEMENT_STRING:    data is index into array of substrings
     //                               of the replacement string.
     // tag <= 0: Temporary representation of the substring of the replacement
     //           string ranging over -tag .. data.
     //           Is replaced by REPLACEMENT_{SUB,}STRING when we create the
     //           substring objects.
     int data;
   };
@@ skipping 116 matching lines @@
             }
 
             // Throw a SyntaxError for invalid replacement strings.
             if (closing_bracket_index == -1) return Nothing<bool>();
 
             Vector<Char> requested_name =
                 characters.SubVector(name_start_index, closing_bracket_index);
 
             // Let capture be ? Get(namedCaptures, groupName).
 
-            int capture_index = LookupNamedCapture(
+            const int capture_index = LookupNamedCapture(
                 [=](String* capture_name) {
                   return capture_name->IsEqualTo(requested_name);
                 },
                 capture_name_map);
 
+            // If ? HasProperty(_namedCaptures_, _groupName_) is *false*, throw
+            // a *SyntaxError* exception.
+            if (capture_index == -1) return Nothing<bool>();
+
             // If capture is undefined, replace the text through the following
             // '>' with the empty string.
             // Otherwise, replace the text through the following '>' with
             // ? ToString(capture).
 
-            DCHECK_IMPLIES(
-                capture_index != -1,
-                1 <= capture_index && capture_index <= capture_count);
-
-            ReplacementPart replacement =
-                (capture_index == -1)
-                    ? ReplacementPart::Empty()
-                    : ReplacementPart::SubjectCapture(capture_index);
+            DCHECK(1 <= capture_index && capture_index <= capture_count);
 
             if (i > last) {
               parts->Add(ReplacementPart::ReplacementSubString(last, i), zone);
             }
-            parts->Add(replacement, zone);
+            parts->Add(ReplacementPart::SubjectCapture(capture_index), zone);
             last = closing_bracket_index + 1;
             i = closing_bracket_index;
             break;
           }
           default:
             i = next_index;
             break;
         }
       }
     }
@@ skipping 91 matching lines @@
         int to = match[capture * 2 + 1];
         if (from >= 0 && to > from) {
           builder->AddSubjectSlice(from, to);
         }
         break;
       }
       case REPLACEMENT_SUBSTRING:
       case REPLACEMENT_STRING:
         builder->AddString(replacement_substrings_[part.data]);
         break;
-      case EMPTY:
-        break;
       default:
         UNREACHABLE();
     }
   }
 }
 
 void FindOneByteStringIndices(Vector<const uint8_t> subject, uint8_t pattern,
                               List<int>* indices, unsigned int limit) {
   DCHECK(limit > 0);
   // Collect indices of pattern in subject using memchr.
@@ skipping 610 matching lines @@
   }
 
   MaybeHandle<String> GetCapture(int i, bool* capture_exists) override {
     Handle<Object> capture_obj = RegExpUtils::GenericCaptureGetter(
         isolate_, match_info_, i, capture_exists);
     return (*capture_exists) ? Object::ToString(isolate_, capture_obj)
                              : isolate_->factory()->empty_string();
   }
 
   MaybeHandle<String> GetNamedCapture(Handle<String> name,
-                                      bool* capture_exists) override {
+                                      CaptureState* state) override {
     DCHECK(has_named_captures_);
     const int capture_index = LookupNamedCapture(
         [=](String* capture_name) { return capture_name->Equals(*name); },
         *capture_name_map_);
 
     if (capture_index == -1) {
-      *capture_exists = false;
+      *state = INVALID;
       return name;  // Arbitrary string handle.
     }
 
     DCHECK(1 <= capture_index && capture_index <= CaptureCount());
-    return GetCapture(capture_index, capture_exists);
+
+    bool capture_exists;
+    Handle<String> capture_value;
+    ASSIGN_RETURN_ON_EXCEPTION(isolate_, capture_value,
+                               GetCapture(capture_index, &capture_exists),
+                               String);
+
+    if (!capture_exists) {
+      *state = UNMATCHED;
+      return isolate_->factory()->empty_string();
+    } else {
+      *state = MATCHED;
+      return capture_value;
+    }
   }
 
  private:
   Isolate* isolate_;
   Handle<String> subject_;
   Handle<RegExpMatchInfo> match_info_;
 
   bool has_named_captures_;
   Handle<FixedArray> capture_name_map_;
 };
@@ skipping 35 matching lines @@
     Handle<Object> capture_obj = captures_->at(i);
     if (capture_obj->IsUndefined(isolate_)) {
       *capture_exists = false;
       return isolate_->factory()->empty_string();
     }
     *capture_exists = true;
     return Object::ToString(isolate_, capture_obj);
   }
 
   MaybeHandle<String> GetNamedCapture(Handle<String> name,
-                                      bool* capture_exists) override {
+                                      CaptureState* state) override {
     DCHECK(has_named_captures_);
+
+    Maybe<bool> maybe_capture_exists =
+        JSReceiver::HasProperty(groups_obj_, name);
+    if (maybe_capture_exists.IsNothing()) return MaybeHandle<String>();
+
+    if (!maybe_capture_exists.FromJust()) {
+      *state = INVALID;
+      return name;  // Arbitrary string handle.
+    }
+
     Handle<Object> capture_obj;
     ASSIGN_RETURN_ON_EXCEPTION(isolate_, capture_obj,
                                Object::GetProperty(groups_obj_, name), String);
     if (capture_obj->IsUndefined(isolate_)) {
-      *capture_exists = false;
-      return name;
+      *state = UNMATCHED;
+      return isolate_->factory()->empty_string();
     } else {
-      *capture_exists = true;
+      *state = MATCHED;
       return Object::ToString(isolate_, capture_obj);
     }
   }
 
  private:
   Isolate* isolate_;
   Handle<String> subject_;
   Handle<String> match_;
   const int match_position_;
   ZoneVector<Handle<Object>>* captures_;
@@ skipping 776 matching lines @@
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, replacement_obj,
           Execution::Call(isolate, replace_obj, factory->undefined_value(),
                           argc, argv.start()));
 
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, replacement, Object::ToString(isolate, replacement_obj));
     } else {
       DCHECK(!functional_replace);
       if (!groups_obj->IsUndefined(isolate)) {
-        // TODO(jgruber): Behavior in this case is not yet specced.
         ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
             isolate, groups_obj, JSReceiver::ToObject(isolate, groups_obj));
       }
       VectorBackedMatch m(isolate, string, match, position, &captures,
                           groups_obj);
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
           isolate, replacement, String::GetSubstitution(isolate, &m, replace));
     }
 
     if (position >= next_source_position) {
@@ skipping 36 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_IsRegExp) {
   SealHandleScope shs(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_CHECKED(Object, obj, 0);
   return isolate->heap()->ToBoolean(obj->IsJSRegExp());
 }
 
 }  // namespace internal
 }  // namespace v8