[regexp] Throw on invalid capture group names in replacer string

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 2901840af92fbe0b1cd995ba1129a4cb4024befa..b65cc109096aef55fd35f424b14d44519d306ae0 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -11517,6 +11517,8 @@ MaybeHandle<String> String::GetSubstitution(Isolate* isolate, Match* match,
         break;
       }
       case '<': {  // $<name> - named capture
+        typedef String::Match::CaptureState CaptureState;
+
         if (!match->HasNamedCaptures()) {
           builder.AppendCharacter('$');
           continue_from_ix = peek_ix;
@@ -11538,12 +11540,27 @@ MaybeHandle<String> String::GetSubstitution(Isolate* isolate, Match* match,
 
         Handle<String> capture_name =
             factory->NewSubString(replacement, peek_ix + 1, closing_bracket_ix);
-        bool capture_exists;
         Handle<String> capture;
+        CaptureState capture_state;
         ASSIGN_RETURN_ON_EXCEPTION(
             isolate, capture,
-            match->GetNamedCapture(capture_name, &capture_exists), String);
-        if (capture_exists) builder.AppendString(capture);
+            match->GetNamedCapture(capture_name, &capture_state), String);
+
+        switch (capture_state) {
+          case CaptureState::INVALID:
+            THROW_NEW_ERROR(
+                isolate,
+                NewSyntaxError(MessageTemplate::kRegExpInvalidReplaceString,
+                               replacement),
+                String);
+            break;
+          case CaptureState::UNMATCHED:
+            break;
+          case CaptureState::MATCHED:
+            builder.AppendString(capture);
+            break;
+        }
+
         continue_from_ix = closing_bracket_ix + 1;
         break;
       }