[regexp] Specify signedness when accessing packed arguments

So far this is mainly a readability improvement to specify
expectations on the packed argument. In the future we should also
check signedness during bytecode generation.

Drive-by: Update DCHECK to allow signed args to
CHECK_CURRENT_POSITION.

Bug: chromium:1083450
Change-Id: I9376ec691b51eb251c972309ad65dd6c04eec3ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2207137
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67880}

src/regexp/regexp-bytecode-generator.cc

@@ -182,7 +182,7 @@ void RegExpBytecodeGenerator::LoadCurrentCharacterImpl(int cp_offset,
                                                        int eats_at_least) {
   DCHECK_GE(eats_at_least, characters);
   if (eats_at_least > characters && check_bounds) {
-    DCHECK(is_uint24(cp_offset + eats_at_least));
+    DCHECK(is_int24(cp_offset + eats_at_least));
     Emit(BC_CHECK_CURRENT_POSITION, cp_offset + eats_at_least);
     EmitOrLink(on_failure);
     check_bounds = false;  // Load below doesn't need to check.

src/regexp/regexp-bytecodes.h

@@ -27,6 +27,7 @@ STATIC_ASSERT(1 << BYTECODE_SHIFT > BYTECODE_MASK);
 
 // TODO(pthier): Argument offsets of bytecodes should be easily accessible by
 // name or at least by position.
+// TODO(jgruber): More precise types (e.g. int32/uint32 instead of value32).
 #define BYTECODE_ITERATOR(V)                                                   \
   V(BREAK, 0, 4)              /* bc8                                        */ \
   V(PUSH_CP, 1, 4)            /* bc8 pad24                                  */ \

test/mjsunit/regress/regress-1083450.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const source = "(?<=(?=ab)(|)abc)"
+const re = new RegExp(source);
+assertNotNull(re.exec("abc"));