bug in gsub

[roberto@... (Roberto Ierusalimschy)]

Florian Berger just found a bug in gsub. It happens only when it is called
wrongly (without its 3rd argument) and with a sufficiently large subject
(not that large on Windows):

  x = string.rep('a', 20000) .. 'b'
  print(#x, #string.gsub(x, 'b'))

The culprit is that the Lua buffer building the result is taken as the
missing 3rd argument. The fix is either to check that argument or to set
the stack top to 3 before starting the substitutions.

-- Roberto