[date] Fix crash by invalid TimeZone "US/x0" names.

Bug: chromium:1132641
Change-Id: Ifa005f9c901ccc865159b618e5145b6d83293b2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436078
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70182}

src/objects/js-date-time-format.cc

@@ -432,8 +432,10 @@ std::string CanonicalizeTimeZoneID(const std::string& input) {
       }
     } else if (memcmp(upper.c_str(), "US/", 3) == 0) {
       std::string title = ToTitleCaseTimezoneLocation(input);
-      // Change "Us/" to "US/"
-      title[1] = 'S';
+      if (title.length() >= 2) {
+        // Change "Us/" to "US/"
+        title[1] = 'S';
+      }
       return title;
     } else if (memcmp(upper.c_str(), "SYSTEMV/", 8) == 0) {
       upper.replace(0, 8, "SystemV/");

test/intl/regress-1132641.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test invalid timezones under US/...  won't cause crash.
+assertThrows(() => {
+  new Intl.DateTimeFormat("en" , { timeZone: "US/Alaska0" });},
+  RangeError);