regexp: fix index panic in Replace

When using subexpressions ($1) as replacements, when they either don't exist or values weren't found causes a panic.
This patch ensures that the match location isn't -1, to prevent out of bounds errors.
Fixes #3816.

R=franciscossouza, rsc
CC=golang-dev
https://golang.org/cl/6931049

src/pkg/regexp/all_test.go

@@ -196,6 +196,10 @@ var replaceTests = []ReplaceTest{
 	{"a+", "${oops", "aaa", "${oops"},
 	{"a+", "$$", "aaa", "$"},
 	{"a+", "$", "aaa", "$"},
+
+	// Substitution when subexpression isn't found
+	{"(x)?", "$1", "123", "123"},
+	{"abc", "$1", "123", "123"},
 }
 
 var replaceLiteralTests = []ReplaceTest{

src/pkg/regexp/regexp.go

@@ -767,7 +767,7 @@ func (re *Regexp) expand(dst []byte, template string, bsrc []byte, src string, m
 		}
 		template = rest
 		if num >= 0 {
-			if 2*num+1 < len(match) {
+			if 2*num+1 < len(match) && match[2*num] >= 0 {
 				if bsrc != nil {
 					dst = append(dst, bsrc[match[2*num]:match[2*num+1]]...)
 				} else {