Fix wrong indexing in global regexp.

src/jsregexp.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 735 matching lines @@
     register_array_ = isolate->jsregexp_static_offsets_vector();
   }
 
   // Set state so that fetching the results the first time triggers a call
   // to the compiled regexp.
   current_match_index_ = max_matches_;
   num_matches_ = max_matches_;
   ASSERT(registers_per_match_ >= 2);  // Each match has at least one capture.
   ASSERT_GE(register_array_size_, registers_per_match_);
   int32_t* last_match =
-      &register_array_[register_array_size_ - registers_per_match_];
+      &register_array_[(current_match_index_ - 1) * registers_per_match_];
   last_match[0] = -1;
   last_match[1] = 0;
 }
 
 
 RegExpImpl::GlobalCache::~GlobalCache() {
   // Deallocate the register array if we allocated it in the constructor
   // (as opposed to using the existing jsregexp_static_offsets_vector).
   if (register_array_size_ > Isolate::kJSRegexpStaticOffsetsVectorSize) {
     DeleteArray(register_array_);
   }
 }
 
 
 int32_t* RegExpImpl::GlobalCache::FetchNext() {
   current_match_index_++;
   if (current_match_index_ >= num_matches_) {
     // Current batch of results exhausted.
     // Fail if last batch was not even fully filled.
     if (num_matches_ < max_matches_) {
       num_matches_ = 0;  // Signal failed match.
       return NULL;
     }
 
     int32_t* last_match =
-        &register_array_[register_array_size_ - registers_per_match_];
+        &register_array_[(current_match_index_ - 1) * registers_per_match_];
     int last_end_index = last_match[1];
 
     if (regexp_->TypeTag() == JSRegExp::ATOM) {
       num_matches_ = RegExpImpl::AtomExecRaw(regexp_,
                                              subject_,
                                              last_end_index,
                                              register_array_,
                                              register_array_size_);
     } else {
       int last_start_index = last_match[0];
@@ skipping 5365 matching lines @@
   }
 
   return compiler.Assemble(&macro_assembler,
                            node,
                            data->capture_count,
                            pattern);
 }
 
 
 }}  // namespace v8::internal