Regexp in MatchData can be nil

`String#sub` with a string pattern defers creating a `Regexp`
until `MatchData#regexp` creates a `Regexp` from the matched
string.  `Regexp#last_match(group_name)` accessed its content
without creating the `Regexp` though.  [Bug #16508]

re.c

@@ -1912,6 +1912,7 @@ match_captures(VALUE match)
 static int
 name_to_backref_number(struct re_registers *regs, VALUE regexp, const char* name, const char* name_end)
 {
+    if (NIL_P(regexp)) return -1;
     return onig_name_to_backref_number(RREGEXP_PTR(regexp),
 	(const unsigned char *)name, (const unsigned char *)name_end, regs);
 }

test/ruby/test_regexp.rb

@@ -161,6 +161,10 @@ class TestRegexp < Test::Unit::TestCase
     s = "foo"
     s[/(?<bar>o)/, "bar"] = "baz"
     assert_equal("fbazo", s)
+
+    /.*/ =~ "abc"
+    "a".sub("a", "")
+    assert_raise(IndexError) {Regexp.last_match(:_id)}
   end
 
   def test_named_capture_with_nul