[regexp] Fix off-by-one in CharacterRange::Negate.

src/regexp/jsregexp.cc

Index: src/regexp/jsregexp.cc
diff --git a/src/regexp/jsregexp.cc b/src/regexp/jsregexp.cc
index 720a60aa94e41702f5871ab08c1a259f025aba79..74b5da0042f6ef4179e2848715942d7a5f295c26 100644
--- a/src/regexp/jsregexp.cc
+++ b/src/regexp/jsregexp.cc
@@ -6097,17 +6097,17 @@ void CharacterRange::Negate(ZoneList<CharacterRange>* ranges,
   uc32 from = 0;
   int i = 0;
   if (range_count > 0 && ranges->at(0).from() == 0) {
-    from = ranges->at(0).to();
+    from = ranges->at(0).to() + 1;
     i = 1;
   }
   while (i < range_count) {
     CharacterRange range = ranges->at(i);
-    negated_ranges->Add(CharacterRange(from + 1, range.from() - 1), zone);
-    from = range.to();
+    negated_ranges->Add(CharacterRange(from, range.from() - 1), zone);
+    from = range.to() + 1;
     i++;
   }
   if (from < String::kMaxCodePoint) {
-    negated_ranges->Add(CharacterRange(from + 1, String::kMaxCodePoint), zone);
+    negated_ranges->Add(CharacterRange(from, String::kMaxCodePoint), zone);
   }
 }