Correctly advance the scanner when scanning unicode regexp flag.

test/mjsunit/regress/regress-136048.js

Index: test/mjsunit/regress/regress-136048.js
diff --git a/test/mjsunit/regress/regress-113924.js b/test/mjsunit/regress/regress-136048.js
similarity index 91%
copy from test/mjsunit/regress/regress-113924.js
copy to test/mjsunit/regress/regress-136048.js
index 3ecdec48f219b9ea545702ebf3a396debe7a93f8..c9972e96fc062b4618f8bf40ee83c15f185ff17c 100644
--- a/test/mjsunit/regress/regress-113924.js
+++ b/test/mjsunit/regress/regress-136048.js
@@ -25,7 +25,10 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-var count=12000;
-while(count--) {
-  eval("var a = new Object(10); a[2] += 7;");
+try {
+  /foo/\u0069
+} catch (e) {
+  assertEquals(
+      "SyntaxError: Invalid flags supplied to RegExp constructor '\\u0069'",
+      e.toString());
 }