[regexp] Disallow '\' in capture names

IdentifierStart::Is and IdentifierContinue::Is both return true for '\'.
The reason for this is lost to history.

Special-case '\' in the regexp parser to handle this.

BUG=v8:5437,v8:5868

Review-Url: https://codereview.chromium.org/2795093003
Cr-Commit-Position: refs/heads/master@{#44396}

src/regexp/regexp-parser.cc

@@ -789,6 +789,12 @@ const ZoneVector<uc16>* RegExpParser::ParseCaptureGroupName() {
       }
     }
 
+    // The backslash char is misclassified as both ID_Start and ID_Continue.
+    if (c == '\\') {
+      ReportError(CStrVector("Invalid capture group name"));
+      return nullptr;
+    }
+
     if (at_start) {
       if (!IdentifierStart::Is(c)) {
         ReportError(CStrVector("Invalid capture group name"));

test/mjsunit/harmony/regexp-named-captures.js

@@ -177,6 +177,10 @@ assertEquals(["fst", "snd"],
 assertEquals(undefined, /(?<a>.)/u.exec("a").groups.__proto__);
 assertEquals("a", /(?<__proto__>a)/u.exec("a").groups.__proto__);
 
+// Backslash as ID_Start and ID_Continue (v8:5868).
+assertThrows("/(?<\\>.)/", SyntaxError);   // '\' misclassified as ID_Start.
+assertThrows("/(?<a\\>.)/", SyntaxError);  // '\' misclassified as ID_Continue.
+
 // Backreference before the group (exercises the capture mini-parser).
 assertThrows("/\\1(?:.)/u", SyntaxError);
 assertThrows("/\\1(?<=a)./u", SyntaxError);