From 90a9548ea0ce351b54f956e2c4ed27cca9631284 Mon Sep 17 00:00:00 2001
From: Marijn Haverbeke <marijn@haverbeke.nl>
Date: Sun, 1 Mar 2020 13:32:19 +0100
Subject: [PATCH] More rigorously check surrogate pairs in regexp validator

---
 acorn/src/regexp.js  | 8 +++++---
 test/tests-regexp.js | 1 +
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/acorn/src/regexp.js b/acorn/src/regexp.js
index ee19bcf55..2fe832b4b 100644
--- a/acorn/src/regexp.js
+++ b/acorn/src/regexp.js
@@ -50,7 +50,8 @@ export class RegExpValidationState {
     if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l) {
       return c
     }
-    return (c << 10) + s.charCodeAt(i + 1) - 0x35FDC00
+    const next = s.charCodeAt(i + 1)
+    return next >= 0xDC00 && next <= 0xDFFF ? (c << 10) + next - 0x35FDC00 : c
   }
 
   nextIndex(i) {
@@ -59,8 +60,9 @@ export class RegExpValidationState {
     if (i >= l) {
       return l
     }
-    const c = s.charCodeAt(i)
-    if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l) {
+    let c = s.charCodeAt(i), next
+    if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l ||
+        (next = s.charCodeAt(i + 1)) < 0xDC00 || next > 0xDFFF) {
       return i + 1
     }
     return i + 2
diff --git a/test/tests-regexp.js b/test/tests-regexp.js
index 6c4719486..804e00a59 100644
--- a/test/tests-regexp.js
+++ b/test/tests-regexp.js
@@ -1049,6 +1049,7 @@ test("/[\\d][\\12-\\14]{1,}[^\\d]/", {}, { ecmaVersion: 2015 })
 testFail("/[\\d][\\12-\\14]{1,}[^\\d]/u", "Invalid regular expression flag (1:1)", { ecmaVersion: 5 })
 testFail("/[\\d][\\12-\\14]{1,}[^\\d]/u", "Invalid regular expression: /[\\d][\\12-\\14]{1,}[^\\d]/: Invalid class escape (1:1)", { ecmaVersion: 2015 })
 test("/([a ]\\b)*\\b/", {}, { ecmaVersion: 5 })
+test("/[x-*]/u".replace("*", String.fromCharCode(0xd800)), {}, {ecmaVersion: 6})
 
 /*
 // This is test case generator.