[regexp] correctly advance zero length matches for global/unicode.

src/regexp/jsregexp-inl.h

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 
 #ifndef V8_REGEXP_JSREGEXP_INL_H_
 #define V8_REGEXP_JSREGEXP_INL_H_
 
 #include "src/allocation.h"
 #include "src/handles.h"
@@ skipping 29 matching lines @@
     int last_end_index = last_match[1];
 
     if (regexp_->TypeTag() == JSRegExp::ATOM) {
       num_matches_ = RegExpImpl::AtomExecRaw(regexp_,
                                              subject_,
                                              last_end_index,
                                              register_array_,
                                              register_array_size_);
     } else {
       int last_start_index = last_match[0];
-      if (last_start_index == last_end_index) last_end_index++;
+      if (last_start_index == last_end_index) {
+        // Zero-length match. Advance by one code point.
+        last_end_index = AdvanceZeroLength(last_end_index);
+      }
       if (last_end_index > subject_->length()) {
         num_matches_ = 0;  // Signal failed match.
         return NULL;
       }
       num_matches_ = RegExpImpl::IrregexpExecRaw(regexp_,
                                                  subject_,
                                                  last_end_index,
                                                  register_array_,
                                                  register_array_size_);
     }
@@ skipping 14 matching lines @@
     index -= registers_per_match_;
   }
   return &register_array_[index];
 }
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_REGEXP_JSREGEXP_INL_H_