[regexp] Fix incorrect range checks in AtSurrogatePair

test/mjsunit/regexp.js

Index: test/mjsunit/regexp.js
diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js
index 1a5de2addf7d6a47e7c411ca7aa6d8f5eedc6615..47be97ded9e3a82795f3aaeae840162ea2a6d0f3 100644
--- a/test/mjsunit/regexp.js
+++ b/test/mjsunit/regexp.js
@@ -726,3 +726,8 @@ assertEquals(["a", "", ""], /(\2).(\1)/.exec("aba"));
 assertEquals(["aba", "a", "a"], /(.\2).(\1)/.exec("aba"));
 assertEquals(["acbc", "c", "c"], /a(.\2)b(\1)$/.exec("acbc"));
 assertEquals(["acbc", "c", "c"], /a(.\2)b(\1)/.exec("aabcacbc"));
+
+// Test surrogate pair detection in split.
+// \u{daff}\u{e000} is not a surrogate pair, while \u{daff}\u{dfff} is.
+assertEquals(["\u{daff}", "\u{e000}"], "\u{daff}\u{e000}".split(/[a-z]{0,1}/u));
+assertEquals(["\u{daff}\u{dfff}"], "\u{daff}\u{dfff}".split(/[a-z]{0,1}/u));