[regexp] Fix numbered reference before named capture

test/mjsunit/harmony/regexp-named-captures.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-regexp-named-captures
 
 // Malformed named captures.
 assertThrows("/(?<>a)/u");  // Empty name.
 assertThrows("/(?<aa)/u");  // Unterminated name.
 assertThrows("/(?<42a>a)/u");  // Name starting with digits.
@@ skipping 79 matching lines @@
 assertEquals("a", /(?<_\u200C>a)/u.exec("bab").groups._\u200C);
 assertEquals("a", /(?<_\u200D>a)/u.exec("bab").groups._\u200D);
 assertEquals("a", /(?<ಠ_ಠ>a)/u.exec("bab").groups.ಠ_ಠ);
 assertThrows('/(?<❤>a)/u', SyntaxError);
 assertThrows('/(?<𐒤>a)/u', SyntaxError);  // ID_Continue but not ID_Start.
 
 // The '__proto__' property on the groups object.
 assertEquals(undefined, /(?<a>.)/u.exec("a").groups.__proto__);
 assertEquals("a", /(?<__proto__>a)/u.exec("a").groups.__proto__);
 
+// Backreference before the group (exercises the capture mini-parser).
+assertThrows("/\\1(?:.)/u", SyntaxError);
+assertThrows("/\\1(?<=a)./u", SyntaxError);
+assertThrows("/\\1(?<!a)./u", SyntaxError);
+assertEquals(["a", "a"], /\1(?<a>.)/u.exec("abcd"));
+
 // @@replace with a callable replacement argument (no named captures).
 {
   let result = "abcd".replace(/(.)(.)/u, (match, fst, snd, offset, str) => {
     assertEquals("ab", match);
     assertEquals("a", fst);
     assertEquals("b", snd);
     assertEquals(0, offset);
     assertEquals("abcd", str);
     return `${snd}${fst}`;
   });
@@ skipping 166 matching lines @@
 // named captures).
 {
   let re = toSlowMode(/(?<fst>.)(?<snd>.)/u);
   assertEquals("bacd", "abcd".replace(re, "$<snd>$<fst>"));
   assertEquals("bacd", "abcd".replace(re, "$2$1"));
   assertThrows(() => "abcd".replace(re, "$<snd"), SyntaxError);
   assertEquals("cd", "abcd".replace(re, "$<42$1>"));
   assertEquals("cd", "abcd".replace(re, "$<thd>"));
   assertEquals("cd", "abcd".replace(re, "$<$1>"));
 }