Fix prepareElementsForSort crash bug=117879 . This is a back

src/regexp.js

Index: src/regexp.js
===================================================================
--- src/regexp.js	(revision 11608)
+++ src/regexp.js	(working copy)
@@ -347,8 +347,7 @@
   } else {
     var override = lastMatchInfoOverride;
     subject = override[override.length - 1];
-    var pattern = override[override.length - 3];
-    start_index = override[override.length - 2] + pattern.length;
+    start_index = override[override.length - 2] + subject.length;
   }
   return SubString(subject, start_index, subject.length);
 }