Showing with 7 additions and 4 deletions.

+1 −1 acorn/package.json

+5 −3 acorn/src/regexp.js

+1 −0 test/tests-regexp.js
diff --git a/acorn/package.json b/acorn/package.json
@@ -4,7 +4,7 @@
   "homepage": "https://github.com/acornjs/acorn",
   "main": "dist/acorn.js",
   "module": "dist/acorn.mjs",
-  "version": "6.4.0",
+  "version": "6.4.1",
   "engines": {"node": ">=0.4.0"},
   "maintainers": [
     {

diff --git a/acorn/src/regexp.js b/acorn/src/regexp.js
@@ -50,7 +50,8 @@ export class RegExpValidationState {
     if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l) {
       return c
     }
-    return (c << 10) + s.charCodeAt(i + 1) - 0x35FDC00
+    const next = s.charCodeAt(i + 1)
+    return next >= 0xDC00 && next <= 0xDFFF ? (c << 10) + next - 0x35FDC00 : c
   }
 
   nextIndex(i) {
@@ -59,8 +60,9 @@ export class RegExpValidationState {
     if (i >= l) {
       return l
     }
-    const c = s.charCodeAt(i)
-    if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l) {
+    let c = s.charCodeAt(i), next
+    if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l ||
+        (next = s.charCodeAt(i + 1)) < 0xDC00 || next > 0xDFFF) {
       return i + 1
     }
     return i + 2

diff --git a/test/tests-regexp.js b/test/tests-regexp.js
@@ -1049,6 +1049,7 @@ test("/[\\d][\\12-\\14]{1,}[^\\d]/", {}, { ecmaVersion: 2015 })
 testFail("/[\\d][\\12-\\14]{1,}[^\\d]/u", "Invalid regular expression flag (1:1)", { ecmaVersion: 5 })
 testFail("/[\\d][\\12-\\14]{1,}[^\\d]/u", "Invalid regular expression: /[\\d][\\12-\\14]{1,}[^\\d]/: Invalid class escape (1:1)", { ecmaVersion: 2015 })
 test("/([a ]\\b)*\\b/", {}, { ecmaVersion: 5 })
+test("/[x-*]/u".replace("*", String.fromCharCode(0xd800)), {}, {ecmaVersion: 6})
 
 /*
 // This is test case generator.