[regexp] Fix incorrect range checks in AtSurrogatePair

src/js/regexp.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
@@ skipping 278 matching lines @@
   }
   return '/' + TO_STRING(this.source) + '/' + TO_STRING(this.flags);
 }
 
 
 function AtSurrogatePair(subject, index) {
   if (index + 1 >= subject.length) return false;
   var first = %_StringCharCodeAt(subject, index);
   if (first < 0xD800 || first > 0xDBFF) return false;
   var second = %_StringCharCodeAt(subject, index + 1);
-  return second >= 0xDC00 || second <= 0xDFFF;
+  return second >= 0xDC00 && second <= 0xDFFF;
 }
 
 
 // Fast path implementation of RegExp.prototype[Symbol.split] which
 // doesn't properly call the underlying exec, @@species methods
 function RegExpSplit(string, limit) {
   if (!IS_REGEXP(this)) {
     throw %make_type_error(kIncompatibleMethodReceiver,
                         "RegExp.prototype.@@split", this);
   }
@@ skipping 827 matching lines @@
 utils.Export(function(to) {
   to.InternalRegExpMatch = InternalRegExpMatch;
   to.InternalRegExpReplace = InternalRegExpReplace;
   to.IsRegExp = IsRegExp;
   to.RegExpExec = DoRegExpExec;
   to.RegExpInitialize = RegExpInitialize;
   to.RegExpLastMatchInfo = RegExpLastMatchInfo;
 });
 
 })