[regexp] Don't use eats_at_least for backwards loops

The eats_at_least (EAL) value is applied in forward-directions only.
Two reasons for that which are relevant to this CL:

- EAL's of neighboring nodes are combined additively, irrespective of
  their read_backward value.
- EatsAtLeastPropagator::VisitText uses the successor's
  eats_at_least_from_not_start value, which doesn't work properly for
  read_backwards successors (which may end at the start).

A symptom of this bug was that we applied an incorrect EAL of 255
starting at the initial 'x' of /x(?<=^x{4})/); for subject strings
shorter than 255 chars, this would result in an incorrect failure
result.

Bug: v8:11616
Change-Id: I4b2b1b78f0cea8f59e4beb1037ee46035d83c927
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807596Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73848}

src/regexp/regexp-compiler.cc

@@ -1435,9 +1435,11 @@ EatsAtLeastInfo LoopChoiceNode::EatsAtLeastFromLoopEntry() {
   DCHECK_EQ(alternatives_->length(), 2);  // There's just loop and continue.
 
   if (read_backward()) {
-    // Can't do anything special for a backward loop, so return the basic values
-    // that we got during analysis.
-    return *eats_at_least_info();
+    // The eats_at_least value is not used if reading backward. The
+    // EatsAtLeastPropagator should've zeroed it as well.
+    DCHECK_EQ(eats_at_least_info()->eats_at_least_from_possibly_start, 0);
+    DCHECK_EQ(eats_at_least_info()->eats_at_least_from_not_start, 0);
+    return {};
   }
 
   // Figure out how much the loop body itself eats, not including anything in
@@ -3560,7 +3562,10 @@ class EatsAtLeastPropagator : public AllStatic {
   }
 
   static void VisitLoopChoiceContinueNode(LoopChoiceNode* that) {
-    that->set_eats_at_least_info(*that->continue_node()->eats_at_least_info());
+    if (!that->read_backward()) {
+      that->set_eats_at_least_info(
+          *that->continue_node()->eats_at_least_info());
+    }
   }
 
   static void VisitLoopChoiceLoopNode(LoopChoiceNode* that) {}

test/mjsunit/regress/regress-v8-11616.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("x".repeat(3).match(/x(?<=^x{3})/), ["x"]);
+assertEquals("x".repeat(4).match(/x(?<=^x{4})/), ["x"]);
+assertEquals("x".repeat(7).match(/x(?<=^x{7})/), ["x"]);
+assertEquals("x".repeat(17).match(/x(?<=^x{17})/), ["x"]);