[regexp] quantifier refers to the surrogate pair in unicode regexp.

test/mjsunit/harmony/unicode-escapes-in-regexps.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // ES6 extends the \uxxxx escape and also allows \u{xxxxx}.
 
 // Flags: --harmony-unicode-regexps --harmony-regexps
 
 function testRegexpHelper(r) {
   assertTrue(r.test("foo"));
@@ skipping 229 matching lines @@
 assertFalse(new RegExp("\u{12345}|\u{23456}", "u").test("a\udf45\ud84db"));
 assertFalse(/\u{12345}|\u{23456}/u.test("b\udf45\ud808c"));
 
 // Capture.
 assertTrue(new RegExp("(\u{12345}|\u{23456}).\\1", "u").test(
     "\u{12345}b\u{12345}"));
 assertTrue(/(\u{12345}|\u{23456}).\1/u.test("\u{12345}b\u{12345}"));
 assertFalse(new RegExp("(\u{12345}|\u{23456}).\\1", "u").test(
     "\u{12345}b\u{23456}"));
 assertFalse(/(\u{12345}|\u{23456}).\1/u.test("\u{12345}b\u{23456}"));
+
+// Quantifier.
+assertTrue(new RegExp("\u{12345}{3}", "u").test("\u{12345}\u{12345}\u{12345}"));
+assertTrue(/\u{12345}{3}/u.test("\u{12345}\u{12345}\u{12345}"));
+assertTrue(new RegExp("\u{12345}{3}").test("\u{12345}\udf45\udf45"));
+assertTrue(/\ud808\udf45{3}/u.test("\u{12345}\udf45\udf45"));
+assertFalse(new RegExp("\u{12345}{3}", "u").test("\u{12345}\udf45\udf45"));
+assertFalse(/\u{12345}{3}/u.test("\u{12345}\udf45\udf45"));