[regexp] Fix off-by-one in CharacterRange::Negate.

src/regexp/regexp-ast.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_REGEXP_REGEXP_AST_H_
 #define V8_REGEXP_REGEXP_AST_H_
 
 #include "src/objects.h"
 #include "src/utils.h"
 #include "src/zone.h"
@@ skipping 60 matching lines @@
 };
 
 
 // Represents code units in the range from from_ to to_, both ends are
 // inclusive.
 class CharacterRange {
  public:
   CharacterRange() : from_(0), to_(0) {}
   // For compatibility with the CHECK_OK macro
   CharacterRange(void* null) { DCHECK_NULL(null); }  // NOLINT
-  CharacterRange(uc32 from, uc32 to) : from_(from), to_(to) {}
+  CharacterRange(uc32 from, uc32 to) : from_(from), to_(to) {
+    DCHECK(from <= to);
+  }
   static void AddClassEscape(uc16 type, ZoneList<CharacterRange>* ranges,
                              Zone* zone);
   static Vector<const int> GetWordBounds();
   static inline CharacterRange Singleton(uc32 value) {
     return CharacterRange(value, value);
   }
   static inline CharacterRange Range(uc32 from, uc32 to) {
     DCHECK(0 <= from && to <= String::kMaxCodePoint);
     DCHECK(static_cast<uint32_t>(from) <= static_cast<uint32_t>(to));
     return CharacterRange(from, to);
@@ skipping 418 matching lines @@
   RegExpEmpty* AsEmpty() override;
   bool IsEmpty() override;
   int min_match() override { return 0; }
   int max_match() override { return 0; }
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_REGEXP_REGEXP_AST_H_