[regexp] Fix off-by-one in CharacterRange::Negate.

Character ranges starting at 1 are not correctly negated.

R=jkummerow@chromium.org
BUG=chromium:592343
LOG=Y

Review URL: https://codereview.chromium.org/1768093002

Cr-Commit-Position: refs/heads/master@{#34528}

src/regexp/jsregexp.cc

@@ -6097,17 +6097,17 @@ void CharacterRange::Negate(ZoneList<CharacterRange>* ranges,
   uc32 from = 0;
   int i = 0;
   if (range_count > 0 && ranges->at(0).from() == 0) {
-    from = ranges->at(0).to();
+    from = ranges->at(0).to() + 1;
     i = 1;
   }
   while (i < range_count) {
     CharacterRange range = ranges->at(i);
-    negated_ranges->Add(CharacterRange(from + 1, range.from() - 1), zone);
-    from = range.to();
+    negated_ranges->Add(CharacterRange(from, range.from() - 1), zone);
+    from = range.to() + 1;
     i++;
   }
   if (from < String::kMaxCodePoint) {
-    negated_ranges->Add(CharacterRange(from + 1, String::kMaxCodePoint), zone);
+    negated_ranges->Add(CharacterRange(from, String::kMaxCodePoint), zone);
   }
 }
 

src/regexp/jsregexp.h

@@ -268,7 +268,9 @@ class DispatchTable : public ZoneObject {
    public:
     Entry() : from_(0), to_(0), out_set_(NULL) { }
     Entry(uc32 from, uc32 to, OutSet* out_set)
-        : from_(from), to_(to), out_set_(out_set) {}
+        : from_(from), to_(to), out_set_(out_set) {
+      DCHECK(from <= to);
+    }
     uc32 from() { return from_; }
     uc32 to() { return to_; }
     void set_to(uc32 value) { to_ = value; }

src/regexp/regexp-ast.h

@@ -78,7 +78,9 @@ class CharacterRange {
   CharacterRange() : from_(0), to_(0) {}
   // For compatibility with the CHECK_OK macro
   CharacterRange(void* null) { DCHECK_NULL(null); }  // NOLINT
-  CharacterRange(uc32 from, uc32 to) : from_(from), to_(to) {}
+  CharacterRange(uc32 from, uc32 to) : from_(from), to_(to) {
+    DCHECK(from <= to);
+  }
   static void AddClassEscape(uc16 type, ZoneList<CharacterRange>* ranges,
                              Zone* zone);
   static Vector<const int> GetWordBounds();

test/mjsunit/regress/regress-crbug-592343.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var r = /[^\u{1}-\u{1000}\u{1002}-\u{2000}]/u;
+assertTrue(r.test("\u{0}"));
+assertFalse(r.test("\u{1}"));
+assertFalse(r.test("\u{1000}"));
+assertTrue(r.test("\u{1001}"));
+assertFalse(r.test("\u{1002}"));
+assertFalse(r.test("\u{2000}"));
+assertTrue(r.test("\u{2001}"));