[regexp] Fix off-by-one in CharacterRange::Negate.

src/regexp/jsregexp.h

Index: src/regexp/jsregexp.h
diff --git a/src/regexp/jsregexp.h b/src/regexp/jsregexp.h
index 1d152dcfb2536e1a7c5f65a33d5b468787fea8d1..e55d650fab14316e10c34e75fc9f3b4a79be2169 100644
--- a/src/regexp/jsregexp.h
+++ b/src/regexp/jsregexp.h
@@ -268,7 +268,9 @@ class DispatchTable : public ZoneObject {
    public:
     Entry() : from_(0), to_(0), out_set_(NULL) { }
     Entry(uc32 from, uc32 to, OutSet* out_set)
-        : from_(from), to_(to), out_set_(out_set) {}
+        : from_(from), to_(to), out_set_(out_set) {
+      DCHECK(from <= to);
+    }
     uc32 from() { return from_; }
     uc32 to() { return to_; }
     void set_to(uc32 value) { to_ = value; }