Ranges: a numeric first address that has already been passed never latches

[sylvestre]

Found by the differential fuzzer (fuzz/fuzz_targets/fuzz_sed.rs).

GNU sed activates a range whose numeric first address lies before the current
line, as soon as the command is first evaluated. We only ever latch the range on
an exact match of the first address, so the range never becomes active.

Any command that can skip a cycle puts us in that situation: a block, but also
n, N, d, D or a branch.

$ printf '1\n2\n3\n4\n5\n6\n7\n' | sed -n '3,6{ 1,4p }'
3
4
$ printf '1\n2\n3\n4\n5\n6\n7\n' | ./target/release/sed -n '3,6{ 1,4p }'
$

GNU's rules, as observed on sed 4.9 (input 1..7, the inner command first
evaluated on line 3):

script	GNU	note
3,6{ 1,4p }	3 4	started late, second address still ahead
3,6{ 2,4p }	3 4	same
3,6{ 3,4p }	3 4	exact start
3,6{ 1,3p }	3	second address equals the current line: one line only
3,6{ 1,2p }	–	second address already passed: no match at all
3,6{ 1,~3p }	3 4 5 6	non-numeric second address, range stays active
3,2p (top level)	3	exact start ignores the second address check

So, for a numeric first address:

• line == addr1: match; one-line range if addr2 is numeric and <= line.
• line > addr1: match only if addr2 is not numeric, or addr2 >= line;
  one-line range when addr2 == line.

Until this is fixed the fuzzer skips these scenarios; see KNOWN_ISSUES in
fuzz/fuzz_targets/fuzz_sed.rs.

[sylvestre]

Also reachable through c, which ends the cycle before the following commands are evaluated:

$ printf 'a\nb\nc\nd\ne\n' | sed -e '1,3c\txt' -e '4,5r /dev/null'