[libxml2/2.9] Fix range quantifier on subregex

[Nick Wellnhofer <nwellnhof src gnome org>]

commit 19cfb29598bc8ce14039103c9b022e2f679e3aca
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Mon Dec 20 00:31:41 2021 +0100

    Fix range quantifier on subregex
    
    Make sure to add counted exit transitions before other counter
    transitions. Otherwise, we won't backtrack correctly.
    
    Fixes #65.

 result/regexp/issue65 | 2 ++
 test/regexp/issue65   | 2 ++
 xmlregexp.c           | 6 +++---
 3 files changed, 7 insertions(+), 3 deletions(-)
---
diff --git a/result/regexp/issue65 b/result/regexp/issue65
new file mode 100644
index 00000000..46bacd3f
--- /dev/null
+++ b/result/regexp/issue65
@@ -0,0 +1,2 @@
+Regexp: ( (a|bc{0,2})){0,2} d
+ b d: Ok
diff --git a/test/regexp/issue65 b/test/regexp/issue65
new file mode 100644
index 00000000..b71bc073
--- /dev/null
+++ b/test/regexp/issue65
@@ -0,0 +1,2 @@
+=>( (a|bc{0,2})){0,2} d
+ b d
diff --git a/xmlregexp.c b/xmlregexp.c
index 8d01c2ba..95aebf1f 100644
--- a/xmlregexp.c
+++ b/xmlregexp.c
@@ -1693,12 +1693,12 @@ xmlFAGenerateTransitions(xmlRegParserCtxtPtr ctxt, xmlRegStatePtr from,
                    counter = xmlRegGetCounter(ctxt);
                    ctxt->counters[counter].min = atom->min - 1;
                    ctxt->counters[counter].max = atom->max - 1;
-                   /* count the number of times we see it again */
-                   xmlFAGenerateCountedEpsilonTransition(ctxt, atom->stop,
-                                                  atom->start, counter);
                    /* allow a way out based on the count */
                    xmlFAGenerateCountedTransition(ctxt, atom->stop,
                                                   newstate, counter);
+                   /* count the number of times we see it again */
+                   xmlFAGenerateCountedEpsilonTransition(ctxt, atom->stop,
+                                                  atom->start, counter);
                    /* and if needed allow a direct exit for 0 */
                    if (atom->min == 0)
                        xmlFAGenerateEpsilonTransition(ctxt, atom->start0,