[regexp] Disallow '\' in capture names

test/mjsunit/harmony/regexp-named-captures.js

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-regexp-named-captures --harmony-regexp-lookbehind
 
 // Malformed named captures.
 assertThrows("/(?<>a)/u", SyntaxError);  // Empty name.
 assertThrows("/(?<aa)/u", SyntaxError);  // Unterminated name.
 assertThrows("/(?<42a>a)/u", SyntaxError);  // Name starting with digits.
@@ skipping 159 matching lines @@
 
 // Properties created on result.groups.
 assertEquals(["fst", "snd"],
              Object.getOwnPropertyNames(
                  /(?<fst>.)|(?<snd>.)/u.exec("abcd").groups));
 
 // The '__proto__' property on the groups object.
 assertEquals(undefined, /(?<a>.)/u.exec("a").groups.__proto__);
 assertEquals("a", /(?<__proto__>a)/u.exec("a").groups.__proto__);
 
+// Backslash as ID_Start and ID_Continue (v8:5868).
+assertThrows("/(?<\\>.)/", SyntaxError);   // '\' misclassified as ID_Start.
+assertThrows("/(?<a\\>.)/", SyntaxError);  // '\' misclassified as ID_Continue.
+
 // Backreference before the group (exercises the capture mini-parser).
 assertThrows("/\\1(?:.)/u", SyntaxError);
 assertThrows("/\\1(?<=a)./u", SyntaxError);
 assertThrows("/\\1(?<!a)./u", SyntaxError);
 assertEquals(["a", "a"], /\1(?<a>.)/u.exec("abcd"));
 
 // @@replace with a callable replacement argument (no named captures).
 {
   let result = "abcd".replace(/(.)(.)/u, (match, fst, snd, offset, str) => {
     assertEquals("ab", match);
@@ skipping 172 matching lines @@
 // named captures).
 {
   let re = toSlowMode(/(?<fst>.)(?<snd>.)/u);
   assertEquals("bacd", "abcd".replace(re, "$<snd>$<fst>"));
   assertEquals("bacd", "abcd".replace(re, "$2$1"));
   assertThrows(() => "abcd".replace(re, "$<snd"), SyntaxError);
   assertEquals("cd", "abcd".replace(re, "$<42$1>"));
   assertEquals("cd", "abcd".replace(re, "$<thd>"));
   assertEquals("cd", "abcd".replace(re, "$<$1>"));
 }