[regexp] Fix incorrect range checks in AtSurrogatePair

R=littledan@chromium.org
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2337763003
Cr-Commit-Position: refs/heads/master@{#39403}

src/js/regexp.js

@@ -293,7 +293,7 @@ function AtSurrogatePair(subject, index) {
   var first = %_StringCharCodeAt(subject, index);
   if (first < 0xD800 || first > 0xDBFF) return false;
   var second = %_StringCharCodeAt(subject, index + 1);
-  return second >= 0xDC00 || second <= 0xDFFF;
+  return second >= 0xDC00 && second <= 0xDFFF;
 }
 
 

test/mjsunit/regexp.js

@@ -726,3 +726,8 @@ assertEquals(["a", "", ""], /(\2).(\1)/.exec("aba"));
 assertEquals(["aba", "a", "a"], /(.\2).(\1)/.exec("aba"));
 assertEquals(["acbc", "c", "c"], /a(.\2)b(\1)$/.exec("acbc"));
 assertEquals(["acbc", "c", "c"], /a(.\2)b(\1)/.exec("aabcacbc"));
+
+// Test surrogate pair detection in split.
+// \u{daff}\u{e000} is not a surrogate pair, while \u{daff}\u{dfff} is.
+assertEquals(["\u{daff}", "\u{e000}"], "\u{daff}\u{e000}".split(/[a-z]{0,1}/u));
+assertEquals(["\u{daff}\u{dfff}"], "\u{daff}\u{dfff}".split(/[a-z]{0,1}/u));