Fix bug in character-set merging. Add test case.

src/jsregexp.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4444 matching lines @@
   int n2 = second_set->length();
   // Current range. May be invalid if state is kInsideNone.
   int from = 0;
   int to = -1;
   // Where current range comes from.
   int state = kInsideNone;
 
   while (i1 < n1 || i2 < n2) {
     CharacterRange next_range;
     int range_source;
-    if (i2 == n2 || first_set->at(i1).from() < second_set->at(i2).from()) {
+    if (i2 == n2 ||
+        (i1 < n1 && first_set->at(i1).from() < second_set->at(i2).from())) {
+      // Next smallest element is in first set.
       next_range = first_set->at(i1++);
       range_source = kInsideFirst;
     } else {
+      // Next smallest element is in second set.
       next_range = second_set->at(i2++);
       range_source = kInsideSecond;
     }
     if (to < next_range.from()) {
       // Ranges disjoint: |current|  |next|
       AddRangeToSelectedSet(state,
                             first_set_only_out,
                             second_set_only_out,
                             both_sets_out,
                             CharacterRange(from, to));
@@ skipping 743 matching lines @@
                            node,
                            data->capture_count,
                            pattern);
 }
 
 
 int OffsetsVector::static_offsets_vector_[
     OffsetsVector::kStaticOffsetsVectorSize];
 
 }}  // namespace v8::internal