s/.(?=.\G)/X/g: refuse to go backwards

On something like:

    $_ = "123456789";
    pos = 6;
    s/.(?=.\G)/X/g;

each iteration could in theory start with pos one character to the left
of the previous position, and with the substitution replacing bits that
it has already replaced.  Since that way madness lies, ban any attempt by
s/// to substitute to the left of a previous position.

To implement this, add a new flag to regexec(), REXEC_FAIL_ON_UNDERFLOW.
This tells regexec() to return failure even if the match itself succeeded,
but where the start of $& is before the passed stringarg point.

This change caused one existing test to fail (which was added about a year
ago):

    $_="abcdef";
    s/bc|(.)\G(.)/$1 ? "[$1-$2]" : "XX"/ge;
    print; # used to print "aXX[c-d][d-e][e-f]"; now prints "aXXdef"

I think that that test relies on ambiguous behaviour, and that my change
makes things saner.

Note that s/// with \G is generally very under-tested.

1 files changed, 3 insertions, 2 deletions

diff --git a/pp_hot.c b/pp_hot.c
index ee8267303b..95a3bcd900 100644
--- a/pp_hot.c
+++ b/pp_hot.c
@@ -2233,7 +2233,7 @@ PP(pp_subst)
 	    } while (CALLREGEXEC(rx, s, strend, orig, s == m,
 				 TARG, NULL,
 				 /* don't match same null twice */
-				 REXEC_NOT_FIRST|REXEC_IGNOREPOS));
+                     REXEC_NOT_FIRST|REXEC_IGNOREPOS|REXEC_FAIL_ON_UNDERFLOW));
 	    if (s != d) {
                 I32 i = strend - s;
 		SvCUR_set(TARG, d - SvPVX_const(TARG) + i);
@@ -2321,7 +2321,8 @@ PP(pp_subst)
 	    if (once)
 		break;
 	} while (CALLREGEXEC(rx, s, strend, orig, s == m,
-			     TARG, NULL, REXEC_NOT_FIRST|REXEC_IGNOREPOS));
+			     TARG, NULL,
+                    REXEC_NOT_FIRST|REXEC_IGNOREPOS|REXEC_FAIL_ON_UNDERFLOW));
 	sv_catpvn_nomg_maybeutf8(dstr, s, strend - s, DO_UTF8(TARG));
 
 	if (rpm->op_pmflags & PMf_NONDESTRUCT) {