[regexp] fix zero-length matches for RegExp.prototype.@@split.

BUG=v8:4717
LOG=N

Review URL: https://codereview.chromium.org/1663543003

Cr-Commit-Position: refs/heads/master@{#33706}

src/js/regexp.js

@@ -296,6 +296,15 @@ function RegExpToString() {
 }
 
 
+function AtSurrogatePair(subject, index) {
+  if (index + 1 >= subject.length) return false;
+  var first = %_StringCharCodeAt(subject, index);
+  if (first < 0xD800 || first > 0xDBFF) return false;
+  var second = %_StringCharCodeAt(subject, index + 1);
+  return second >= 0xDC00 || second <= 0xDFFF;
+}
+
+
 // ES6 21.2.5.11.
 function RegExpSplit(string, limit) {
   // TODO(yangguo): allow non-regexp receivers.
@@ -337,7 +346,11 @@ function RegExpSplit(string, limit) {
 
     // We ignore a zero-length match at the currentIndex.
     if (startIndex === endIndex && endIndex === currentIndex) {
-      startIndex++;
+      if (REGEXP_UNICODE(this) && AtSurrogatePair(subject, startIndex)) {
+        startIndex += 2;
+      } else {
+        startIndex++;
+      }
       continue;
     }
 

test/mjsunit/harmony/unicode-regexp-zero-length.js

@@ -53,3 +53,6 @@ assertEquals(["","",""], (L + T + L + T).match(u));
 var expected = [];
 for (var i = 0; i <= 1000; i++) expected.push("");
 assertEquals(expected, (L + T).repeat(1000).match(u));
+
+// Also test RegExp.prototype.@@split.
+assertEquals(["\u{12345}"], "\u{12345}".split(/(?:)/u));