[regexp] Fix numbered reference before named capture

src/regexp/regexp-parser.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/regexp/regexp-parser.h"
 
 #include "src/char-predicates-inl.h"
 #include "src/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
@@ skipping 652 matching lines @@
           Advance();
           if (c == '\\') {
             Advance();
           } else {
             if (c == ']') break;
           }
         }
         break;
       }
       case '(':
-        if (current() != '?') capture_count++;
+        if (current() == '?') {
+          // At this point we could be in
+          // * a non-capturing group '(:',
+          // * a lookbehind assertion '(?<=' '(?<!'
+          // * or a named capture '(?<'.
+          //
+          // Of these, only named captures are capturing groups.
+          if (!FLAG_harmony_regexp_named_captures) break;
+
+          Advance();
+          if (current() != '<') break;
+
+          // TODO(jgruber): To be more future-proof we could test for
+          // IdentifierStart here once it becomes clear whether group names
+          // allow unicode escapes.
+          Advance();
+          if (current() == '=' || current() == '!') break;
+        }
+        capture_count++;
         break;
     }
   }
   capture_count_ = capture_count;
   is_scanned_for_captures_ = true;
 }
 
 
 bool RegExpParser::ParseBackReferenceIndex(int* index_out) {
   DCHECK_EQ('\\', current());
@@ skipping 1126 matching lines @@
     return false;
   }
   terms_.Add(new (zone()) RegExpQuantifier(min, max, quantifier_type, atom),
              zone());
   LAST(ADD_TERM);
   return true;
 }
 
 }  // namespace internal
 }  // namespace v8