[regexp] Disallow '\' in capture names

src/regexp/regexp-parser.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/regexp/regexp-parser.h"
 
 #include "src/char-predicates-inl.h"
 #include "src/factory.h"
 #include "src/isolate.h"
 #include "src/objects-inl.h"
@@ skipping 771 matching lines @@
     if (c == '\\' && current() == 'u') {
       // TODO(jgruber): Reconsider this once the spec has settled.
       // https://github.com/tc39/proposal-regexp-named-groups/issues/23
       Advance();
       if (!ParseUnicodeEscape(&c)) {
         ReportError(CStrVector("Invalid Unicode escape sequence"));
         return nullptr;
       }
     }
 
+    // The backslash char is misclassified as both ID_Start and ID_Continue.
+    if (c == '\\') {
+      ReportError(CStrVector("Invalid capture group name"));
+      return nullptr;
+    }
+
     if (at_start) {
       if (!IdentifierStart::Is(c)) {
         ReportError(CStrVector("Invalid capture group name"));
         return nullptr;
       }
       push_code_unit(name, c);
       at_start = false;
     } else {
       if (c == '>') {
         break;
@@ skipping 1062 matching lines @@
     return false;
   }
   terms_.Add(new (zone()) RegExpQuantifier(min, max, quantifier_type, atom),
              zone());
   LAST(ADD_TERM);
   return true;
 }
 
 }  // namespace internal
 }  // namespace v8