[regexp] Fix off-by-one in CharacterRange::Negate.

test/mjsunit/regress/regress-crbug-592343.js

Index: test/mjsunit/regress/regress-crbug-592343.js
diff --git a/test/mjsunit/regress/regress-crbug-592343.js b/test/mjsunit/regress/regress-crbug-592343.js
new file mode 100644
index 0000000000000000000000000000000000000000..c98e921b0039221fc4667ff2e1967a2da84ce3fb
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-592343.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var r = /[^\u{1}-\u{1000}\u{1002}-\u{2000}]/u;
+assertTrue(r.test("\u{0}"));
+assertFalse(r.test("\u{1}"));
+assertFalse(r.test("\u{1000}"));
+assertTrue(r.test("\u{1001}"));
+assertFalse(r.test("\u{1002}"));
+assertFalse(r.test("\u{2000}"));
+assertTrue(r.test("\u{2001}"));