Port bugfix in revision 4449 to 2.1 branch.

src/string.js

Index: src/string.js
diff --git a/src/string.js b/src/string.js
index 77c54c20823ae68f507920ec88231ef3b56aadde..e11fbf598840e1d54e780f7bbc0944c5bcbe9205 100644
--- a/src/string.js
+++ b/src/string.js
@@ -912,10 +912,10 @@ ReplaceResultBuilder.prototype.add = function(str) {
 
 ReplaceResultBuilder.prototype.addSpecialSlice = function(start, end) {
   var len = end - start;
-  if (len == 0) return;
+  if (start < 0 || len <= 0) return;
   var elements = this.elements;
   if (start < 0x80000 && len < 0x800) {
-    elements[elements.length] = (start << 11) + len;
+    elements[elements.length] = (start << 11) | len;
   } else {
     // 0 < len <= String::kMaxLength and Smi::kMaxValue >= String::kMaxLength,
     // so -len is a smi.