Merge v8 bleeding_edge revision 3689 to trunk.  This fixes issue with
character ranges in regexp engine.


Review URL: http://codereview.chromium.org/548138

git-svn-id: http://v8.googlecode.com/svn/trunk@3690 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/jsregexp.cc b/src/jsregexp.cc
index 8af472d..505cf03 100644
--- a/src/jsregexp.cc
+++ b/src/jsregexp.cc
@@ -4462,10 +4462,13 @@
   while (i1 < n1 || i2 < n2) {
     CharacterRange next_range;
     int range_source;
-    if (i2 == n2 || first_set->at(i1).from() < second_set->at(i2).from()) {
+    if (i2 == n2 ||
+        (i1 < n1 && first_set->at(i1).from() < second_set->at(i2).from())) {
+      // Next smallest element is in first set.
       next_range = first_set->at(i1++);
       range_source = kInsideFirst;
     } else {
+      // Next smallest element is in second set.
       next_range = second_set->at(i2++);
       range_source = kInsideSecond;
     }