patch 9.1.0438: Wrong Ex command executed when :g uses '?' as delimiter

Problem:  Wrong Ex command executed when :g uses '?' as delimiter and
          pattern contains escaped '?'.
Solution: Don't use "*newp" when it's not allocated (zeertzjq).

closes: #14837

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/regexp.c b/src/regexp.c
index 147452a..ff201d9 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -620,7 +620,7 @@
 {
     magic_T	mymagic;
     char_u	*p = startp;
-    size_t	startplen = STRLEN(startp);
+    size_t	startplen = 0;
 
     if (magic)
 	mymagic = MAGIC_ON;
@@ -644,16 +644,21 @@
 	    if (dirc == '?' && newp != NULL && p[1] == '?')
 	    {
 		// change "\?" to "?", make a copy first.
+		if (startplen == 0)
+		    startplen = STRLEN(startp);
 		if (*newp == NULL)
 		{
 		    *newp = vim_strnsave(startp, startplen);
 		    if (*newp != NULL)
+		    {
 			p = *newp + (p - startp);
+			startp = *newp;
+		    }
 		}
 		if (dropped != NULL)
 		    ++*dropped;
 		if (*newp != NULL)
-		    mch_memmove(p, p + 1, (startplen - ((p + 1) - *newp)) + 1);
+		    mch_memmove(p, p + 1, startplen - ((p + 1) - startp) + 1);
 		else
 		    ++p;
 	    }