[regexp] make lookbehind assertions non-quantifiable.

Until now lookbehind assertions have been quantifiable in non-unicode regexps.
This seems to be an oversight in the spec.

R=jgruber@chromium.org

Bug: v8:7462
Change-Id: Iad0db441089c7510dd2c42a861db92c05545ce1e
Reviewed-on: https://chromium-review.googlesource.com/926102
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51392}

src/regexp/regexp-parser.cc

@@ -1986,8 +1986,14 @@ bool RegExpBuilder::AddQuantifierToAtom(
   } else if (terms_.length() > 0) {
     DCHECK(last_added_ == ADD_ATOM);
     atom = terms_.RemoveLast();
-    // With /u, lookarounds are not quantifiable.
-    if (unicode() && atom->IsLookaround()) return false;
+    if (atom->IsLookaround()) {
+      // With /u, lookarounds are not quantifiable.
+      if (unicode()) return false;
+      // Lookbehinds are not quantifiable.
+      if (atom->AsLookaround()->type() == RegExpLookaround::LOOKBEHIND) {
+        return false;
+      }
+    }
     if (atom->max_match() == 0) {
       // Guaranteed to only match an empty string.
       LAST(ADD_TERM);

test/mjsunit/es6/unicode-regexp-restricted-syntax.js

@@ -13,6 +13,7 @@ assertThrows("/\\c/u", SyntaxError);
 assertThrows("/\\c0/u", SyntaxError);
 // test262/built-ins/RegExp/unicode_restricted_quantifiable_assertion
 assertThrows("/(?=.)*/u", SyntaxError);
+assertThrows("/(?=.){1,2}/u", SyntaxError);
 // test262/built-ins/RegExp/unicode_restricted_octal_escape
 assertThrows("/[\\1]/u", SyntaxError);
 assertThrows("/\\00/u", SyntaxError);

test/mjsunit/es9/regexp-lookbehind.js

@@ -162,3 +162,10 @@ assertEquals(["cacb", "a", ""], /(?<=a(.\2)b(\1)).{4}/.exec("aabcacbc"));
 assertEquals(["b", "ac", "ac"], /(?<=a(\2)b(..\1))b/.exec("aacbacb"));
 assertEquals(["x", "aa"], /(?<=(?:\1b)(aa))./.exec("aabaax"));
 assertEquals(["x", "aa"], /(?<=(?:\1|b)(aa))./.exec("aaaax"));
+
+// Restricted syntax in Annex B 1.4.
+assertThrows("/(?<=.)*/u", SyntaxError);
+assertThrows("/(?<=.){1,2}/u", SyntaxError);
+assertThrows("/(?<=.)*/", SyntaxError);
+assertThrows("/(?<=.)?/", SyntaxError);
+assertThrows("/(?<=.)+/", SyntaxError);