[regexp] Fix matching of regexps that are both sticky and anchored at…

… end.

V8 was applying incorrect optimization to them advancing the start position.

This would cause /foo$/y too match "barfoo", which it should not.

BUG=

Review-Url: https://codereview.chromium.org/2510743003
Cr-Commit-Position: refs/heads/master@{#41077}

src/regexp/jsregexp.cc

@@ -6742,8 +6742,7 @@ RegExpEngine::CompilationResult RegExpEngine::Compile(
   // Inserted here, instead of in Assembler, because it depends on information
   // in the AST that isn't replicated in the Node structure.
   static const int kMaxBacksearchLimit = 1024;
-  if (is_end_anchored &&
-      !is_start_anchored &&
+  if (is_end_anchored && !is_start_anchored && !is_sticky &&
       max_length < kMaxBacksearchLimit) {
     macro_assembler.SetCurrentPositionFromEnd(max_length);
   }

test/mjsunit/es6/regexp-sticky.js

@@ -128,3 +128,10 @@ mhat.lastIndex = 2;
 assertFalse(mhat.test("..foo"));
 mhat.lastIndex = 2;
 assertTrue(mhat.test(".\nfoo"));
+
+// Check that we don't apply incorrect optimization to sticky regexps that
+// are anchored at end.
+var stickyanchored = /bar$/y;
+assertFalse(stickyanchored.test("foobar"));
+stickyanchored.lastIndex = 3;
+assertTrue(stickyanchored.test("foobar"));