regexp: slice bounds out of range

[dvyukov]

The following program crashes with the panic:

package main

import "regexp"

func main() {
    regexp.MustCompile("((0(0){0}))").ReplaceAllString("00000", "00$00")
}

panic: runtime error: slice bounds out of range

goroutine 1 [running]:
regexp.(*machine).backtrack(0xc2080b2120, 0x7f6c00256050, 0xc2080b21f8, 0x0, 0x5, 0x8, 0x0)
    src/regexp/backtrack.go:326 +0x3c6
regexp.(*Regexp).doExecute(0xc2080b6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4be260, 0x5, 0x0, 0x8, ...)
    src/regexp/exec.go:449 +0x423
regexp.(*Regexp).replaceAll(0xc2080b6000, 0x0, 0x0, 0x0, 0x4be260, 0x5, 0x8, 0xc20807ded8, 0x0, 0x0, ...)
    src/regexp/regexp.go:486 +0xf8
regexp.(*Regexp).ReplaceAllString(0xc2080b6000, 0x4be260, 0x5, 0x4be240, 0x5, 0x0, 0x0)
    src/regexp/regexp.go:449 +0x107
main.main()
    regexp.go:6 +0x64

go version devel +b0532a9 Mon Jun 8 05:13:15 2015 +0000 linux/amd64

[gopherbot]

CL https://golang.org/cl/14013 mentions this issue.