[regexp] fix off-by-one in UnicodeRangeSplitter.

src/regexp/jsregexp.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/regexp/jsregexp.h"
 
 #include "src/ast/ast.h"
 #include "src/base/platform/platform.h"
 #include "src/compilation-cache.h"
 #include "src/compiler.h"
@@ skipping 4887 matching lines @@
   for (int i = 0; i < base->length(); i++) {
     table_.AddRange(base->at(i), kBase, zone_);
   }
   // Add overlay ranges.
   table_.AddRange(CharacterRange(0, kLeadSurrogateStart - 1), kBmpCodePoints,
                   zone_);
   table_.AddRange(CharacterRange(kLeadSurrogateStart, kLeadSurrogateEnd),
                   kLeadSurrogates, zone_);
   table_.AddRange(CharacterRange(kTrailSurrogateStart, kTrailSurrogateEnd),
                   kTrailSurrogates, zone_);
-  table_.AddRange(CharacterRange(kTrailSurrogateEnd, kNonBmpStart - 1),
+  table_.AddRange(CharacterRange(kTrailSurrogateEnd + 1, kNonBmpStart - 1),
                   kBmpCodePoints, zone_);
   table_.AddRange(CharacterRange(kNonBmpStart, kNonBmpEnd), kNonBmpCodePoints,
                   zone_);
   table_.ForEach(this);
 }
 
 
 void UnicodeRangeSplitter::Call(uc32 from, DispatchTable::Entry entry) {
   OutSet* outset = entry.out_set();
   if (!outset->Get(kBase)) return;
@@ skipping 1956 matching lines @@
 
 
 void RegExpResultsCache::Clear(FixedArray* cache) {
   for (int i = 0; i < kRegExpResultsCacheSize; i++) {
     cache->set(i, Smi::FromInt(0));
   }
 }
 
 }  // namespace internal
 }  // namespace v8