[regexp] fix off-by-one in UnicodeRangeSplitter.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1681873002

Cr-Commit-Position: refs/heads/master@{#33837}

src/regexp/jsregexp.cc

@@ -4905,7 +4905,7 @@ UnicodeRangeSplitter::UnicodeRangeSplitter(Zone* zone,
                   kLeadSurrogates, zone_);
   table_.AddRange(CharacterRange(kTrailSurrogateStart, kTrailSurrogateEnd),
                   kTrailSurrogates, zone_);
-  table_.AddRange(CharacterRange(kTrailSurrogateEnd, kNonBmpStart - 1),
+  table_.AddRange(CharacterRange(kTrailSurrogateEnd + 1, kNonBmpStart - 1),
                   kBmpCodePoints, zone_);
   table_.AddRange(CharacterRange(kNonBmpStart, kNonBmpEnd), kNonBmpCodePoints,
                   zone_);

test/mjsunit/harmony/unicode-character-ranges.js

@@ -96,6 +96,8 @@ execl(["0abc"], /[^]abc/u, "0abc");
 execl(["\u1234abc"], /[^]abc/u, "\u1234abc");
 execl(["\u{12345}abc"], /[^]abc/u, "\u{12345}abc");
 
+execl(null, /[\u{0}-\u{1F444}]/u, "\ud83d\udfff");
+
 // Backward matches of lone surrogates.
 execl(["B", "\ud803A"], /(?<=([\ud800-\ud900]A))B/u,
       "\ud801\udc00AB\udc00AB\ud802\ud803AB");