[regexp] fix zero-length matches for RegExp.prototype.@@split.

src/js/regexp.js

Index: src/js/regexp.js
diff --git a/src/js/regexp.js b/src/js/regexp.js
index 2ad7e336ea8c30a7cc3c22dd35fad345f0864d09..d3a5dac573fff62e91c6e1b8f83ea7d5c7cdac10 100644
--- a/src/js/regexp.js
+++ b/src/js/regexp.js
@@ -296,6 +296,15 @@ function RegExpToString() {
 }
 
 
+function AtSurrogatePair(subject, index) {
+  if (index + 1 > subject.length) return false;

[Toon Verwaest, 2016/02/03 13:11:32]

if (index + 1 >= subject.length)

+  var first = %_StringCharCodeAt(subject, index);
+  if (first < 0xD800 || first > 0xDBFF) return false;
+  var second = %_StringCharCodeAt(subject, index + 1);
+  return second >= 0xDC00 || second <= 0xDFFF;
+}
+
+
 // ES6 21.2.5.11.
 function RegExpSplit(string, limit) {
   // TODO(yangguo): allow non-regexp receivers.
@@ -337,7 +346,11 @@ function RegExpSplit(string, limit) {
 
     // We ignore a zero-length match at the currentIndex.
     if (startIndex === endIndex && endIndex === currentIndex) {
-      startIndex++;
+      if (REGEXP_UNICODE(this) && AtSurrogatePair(subject, startIndex)) {
+        startIndex += 2;
+      } else {
+        startIndex++;
+      }
       continue;
     }