Simplify the fix for bug #41530

We don’t need to upgrade the target string and redo the pattern match
if the replacement is in utf8.  We can simply convert during concate-
nation, using the more recently added SV_CATUTF8 and SV_CATBYTES flags
to sv_catpvn_flags.

This should make things faster, too, as sv_catpvn_flags does not need
to allocate extra SVs or string buffers.

This happened to trigger an existing COW bug, causing test failures.
SvIsCOW and sv_force_normal_flags were being called on TARG before
get-magic.  So a magical scalar returning a COW could have that COW
modified in place.

I added a test for something I nearly broke.
pp_hot.c:pp_subst: add comment
Define RXf_SPLIT and RXf_SKIPWHITE as 0

They are on longer used in core, and we need room for more flags.

The only CPAN modules that use them check whether RXf_SPLIT is set
(which no longer happens) before setting RXf_SKIPWHITE (which is
ignored).
RXf_MODIFIES_VARS

regcomp.c sets this new flag whenever regops that could modify
$REGMARK or $REGERROR have been seen.  pp_subst will use this
to tell whether it should repeatedly stringify the replacement.
[perl #49190] Stringify repl repeatedly in s///g

pm_runtime in op.c examines the rhs of s/// to see whether it is safe
to execute that set of ops just once.  If it sees a match var or an
expression with side effects, it creates a pp_substcont op, which
results in the rhs being executed multiple times.

If the rhs seems constant enough, pp_subst does the substitution in a
tight loop.

This unfortunately causes s/a/$a/ to fail if *a has been aliased to
*1.  Furthermore, $REGMARK and $REGERROR did not count as match vars.

pp_subst actually has two separate loops.  One of them modifies the
target in place.  The other appends to a new scalar and then copies it
back to the target.  The first loop is used if it seems safe.

This commit makes $REGMARK, $REGERROR and aliases to match vars work=
when the replacement consists solely of the variable.

It does this by setting PL_curpm before stringifying the replacement,
so that $1 et al. see the right pattern.  It also stringifies the
variable for each iteration of the second loop, so that $1 and
$REGMARK update.

The first loop, which requires the rhs to be constant, is skipped if
the regexp contains the special backtracking control verbs that mod-
ify $REGMARK and $REGERROR.
Remove PMf_MAYBE_CONST

It was added in ce862d02d but has never been used.
Don’t taint return value of s///e based on replacement

According to the comments about how taint works above pp_subst in
pp_hot.c, the return value of s/// should not be tainted based on
the taintedness of the replacement.  That makes sense, because the
replacement does not affect how many iterations there were.  (The
return value is the number of iterations).

It only applies, however, to the cases where the ‘constant replace-
ment’ optimisation applies.

That means /e taints its return value:

$ perl5.16.0 -MDevel::Peek -Te '$_ = "abcd"; $x = s//$^X/; Dump $x'
SV = PVMG(0x822ff4) at 0x824dc0
  REFCNT = 1
  FLAGS = (pIOK)
  IV = 1
  NV = 0
  PV = 0
$ perl5.16.0 -MDevel::Peek -Te '$_ = "abcd"; $x = s//$^X/e; Dump $x'
SV = PVMG(0x823010) at 0x824dc0
  REFCNT = 1
  FLAGS = (GMG,SMG,pIOK)
  IV = 1
  NV = 0
  PV = 0
  MAGIC = 0x201940
    MG_VIRTUAL = &PL_vtbl_taint
    MG_TYPE = PERL_MAGIC_taint(t)
    MG_LEN = 1

The number pushed on to the stack was becoming tainted due to the set-
ting of PL_tainted.  PL_tainted is assigned to and the return value
explicitly tainted if appropriate shortly after the mPUSHi (which
implies sv_setiv, which taints when PL_tainted is true), so setting
PL_tainted to 0 just before the mPUSHi is safe.
[perl #49190] Don’t prematurely optimise s/foo/bar$baz/

$baz could be aliased to a package variable, so we do need to recon-
catenate for every iteration of s///g.  For s/// without /g, only one
more op will be executed, so the speed difference is negligible.

The only cases we can optimise in terms of skipping the evaluation of
the ops on the rhs (by eliminating the substconst op) are s//constant/
and s//$single_variable/.  Anything more complicated causes bugs.

A recent commit made s/foo/$bar/g re-stringify $bar for each iteration
(though without having to reevaluate the ops that return $bar).  So we
no longer have to special-case match vars at compile time.

This means that s/foo/bar$baz/g will be slower (and less buggy), but
s/foo/$1/g will be faster.

This also caused an existing taint but in pp_subst to surface.  If
get-magic turns off taint on a replacement string, it should not be
considered tainted.  So the taint check on the replacement should come
*after* the stringification.  This applies to the constant replacement
optimisation.  pp_substcont was already doing this correctly.
perl5180delta: B::Generate is fixed
Use const repl optimisation with s///e where possible

In those cases where s///e contains a single variable or a sequence
that is folded to a const op, we can do away with substcont.

PMf_EVAL means that there was an /e.  But we don’t actually need to
check that; instead we can just examine the op tree, which we have to
do anyway.

The op tree that s//$x/e and s//"constant"/e compile down to have a
null (a do-block) containing a scope op (block with a single state-
ment, as opposed to op_leave which represents multiple statements)
containing a null followed by the constant or variable.
Move tests from t/op/while_readdir.t to t/op/defins.t

It turns out that some of what t/op/while_readdir.t was testing
was also tested by t/op/defins.t
defins.t: Suppress uninit warning

and make the no-warnings test pass.
Disable const repl optimisation for empty pattern

s//$a/ cannot assume that the $a expression is going to return the
same value at each iteration, because the last-used pattern may con-
tain code blocks that clobber *a.