* Fixed bug in calling native irregexp.

src/jsregexp.cc

Index: src/jsregexp.cc
diff --git a/src/jsregexp.cc b/src/jsregexp.cc
index 3fecb75ca1634c88b5035247ec07d4659a204fd5..01a411074c7bf16e95c924cd797eb2bf3d7b53f6 100644
--- a/src/jsregexp.cc
+++ b/src/jsregexp.cc
@@ -507,19 +507,18 @@ Handle<Object> RegExpImpl::IrregexpExecOnce(Handle<JSRegExp> regexp,
   switch (tag) {
     case RegExpMacroAssembler::kIA32Implementation: {
       Code* code = Code::cast(irregexp->get(kIrregexpCodeIndex));
-      SmartPointer<int> captures(NewArray<int>((num_captures + 1) * 2));
       Address start_addr =
           Handle<SeqTwoByteString>::cast(two_byte_subject)->GetCharsAddress();
-      int start_offset =
+      int string_offset =
           start_addr - reinterpret_cast<Address>(*two_byte_subject);
-      int end_offset =
-          start_offset + (two_byte_subject->length() - previous_index) * 2;
+      int start_offset = string_offset + previous_index * 2;
+      int end_offset = string_offset + two_byte_subject->length() * 2;
       typedef bool testfunc(String**, int, int, int*);
       testfunc* test = FUNCTION_CAST<testfunc*>(code->entry());
       rc = test(two_byte_subject.location(),
                 start_offset,
                 end_offset,
-                *captures);
+                offsets_vector);
       if (rc) {
         // Capture values are relative to start_offset only.
         for (int i = 0; i < offsets_vector_length; i++) {