Avoid infinite loop in RegExp.prototype[Symbol.split]

src/js/regexp.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 'use strict';
 
 %CheckIsBootstrapping();
 
@@ skipping 495 matching lines @@
   var stringIndex = prevStringIndex;
   while (stringIndex < size) {
     splitter.lastIndex = stringIndex;
     result = RegExpSubclassExec(splitter, string, exec);
     // Ensure exec will be read again on the next loop through.
     exec = UNDEFINED;
     if (IS_NULL(result)) {
       stringIndex += AdvanceStringIndex(string, stringIndex, unicode);
     } else {
       var end = MinSimple(TO_LENGTH(splitter.lastIndex), size);
-      if (end === stringIndex) {
+      if (end === prevStringIndex) {
         stringIndex += AdvanceStringIndex(string, stringIndex, unicode);
       } else {
         %AddElement(
             array, arrayIndex,
             %_SubString(string, prevStringIndex, stringIndex));
         arrayIndex++;
         if (arrayIndex === lim) return array;
         prevStringIndex = end;
         var numberOfCaptures = MaxSimple(TO_LENGTH(result.length), 0);
         for (var i = 1; i < numberOfCaptures; i++) {
@@ skipping 710 matching lines @@
   to.RegExpSubclassExecJS = RegExpSubclassExecJS;
   to.RegExpSubclassMatch = RegExpSubclassMatch;
   to.RegExpSubclassReplace = RegExpSubclassReplace;
   to.RegExpSubclassSearch = RegExpSubclassSearch;
   to.RegExpSubclassSplit = RegExpSubclassSplit;
   to.RegExpSubclassTest = RegExpSubclassTest;
   to.RegExpTest = RegExpTest;
 });
 
 })