[regexp] Throw on invalid capture group names in replacer string

src/runtime/runtime-strings.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/counters.h"
 #include "src/objects-inl.h"
@@ skipping 23 matching lines @@
     Handle<String> GetPrefix() override { return prefix_; }
     Handle<String> GetSuffix() override { return suffix_; }
 
     int CaptureCount() override { return 0; }
     bool HasNamedCaptures() override { return false; }
     MaybeHandle<String> GetCapture(int i, bool* capture_exists) override {
       *capture_exists = false;
       return match_;  // Return arbitrary string handle.
     }
     MaybeHandle<String> GetNamedCapture(Handle<String> name,
-                                        bool* capture_exists) override {
+                                        CaptureState* state) override {
       UNREACHABLE();
+      *state = INVALID;
       return MaybeHandle<String>();
     }
 
    private:
     Handle<String> match_, prefix_, suffix_;
   };
 
   Handle<String> prefix =
       isolate->factory()->NewSubString(subject, 0, position);
   Handle<String> suffix = isolate->factory()->NewSubString(
@@ skipping 696 matching lines @@
   SealHandleScope shs(isolate);
   DCHECK_EQ(2, args.length());
   if (!args[0]->IsString()) return isolate->heap()->undefined_value();
   if (!args[1]->IsNumber()) return isolate->heap()->undefined_value();
   if (std::isinf(args.number_at(1))) return isolate->heap()->nan_value();
   return __RT_impl_Runtime_StringCharCodeAtRT(args, isolate);
 }
 
 }  // namespace internal
 }  // namespace v8