Fix pattern attribute handling for invalid regular expressions.

If BaseTextInputType::patternMismatch() was called twice, the second call
skipped ScriptRegexp::isValid() check.

BUG=639324

Review-Url: https://codereview.chromium.org/2366803002
Cr-Commit-Position: refs/heads/master@{#420604}

third_party/WebKit/LayoutTests/fast/forms/ValidityState-patternMismatch-expected.txt

@@ -72,6 +72,7 @@ PASS patternMismatchFor("invalid-06") is false
 PASS patternMismatchFor("disabled") is false
 PASS patternMismatchFor("unicode-invalid-01") is false
 PASS patternMismatchFor("unicode-invalid-02") is false
+PASS patternMismatchFor("unicode-invalid-02") is false
 PASS patternMismatchFor("unicode-match-01") is false
 PASS patternMismatchFor("unicode-match-02") is false
 PASS patternMismatchFor("unicode-match-03") is false

third_party/WebKit/LayoutTests/fast/forms/ValidityState-patternMismatch.html

@@ -153,6 +153,8 @@ shouldBeFalse('patternMismatchFor("invalid-06")');
 shouldBeFalse('patternMismatchFor("disabled")');
 
 shouldBeFalse('patternMismatchFor("unicode-invalid-01")');
+// Intentionally check twice.  crbug.com/639324.
+shouldBeFalse('patternMismatchFor("unicode-invalid-02")');
 shouldBeFalse('patternMismatchFor("unicode-invalid-02")');
 shouldBeFalse('patternMismatchFor("unicode-match-01")');
 shouldBeFalse('patternMismatchFor("unicode-match-02")');

third_party/WebKit/Source/core/html/forms/BaseTextInputType.cpp

@@ -101,6 +101,8 @@ bool BaseTextInputType::patternMismatch(const String& value) const
         String pattern = "^(?:" + rawPattern + ")$";
         m_regexp.reset(new ScriptRegexp(pattern, TextCaseSensitive, MultilineDisabled, ScriptRegexp::UTF16));
         m_patternForRegexp = rawPattern;
+    } else if (!m_regexp->isValid()) {
+        return false;
     }
 
     int matchLength = 0;