Fix slicing panic in path completion variable expansion

The regexes in `expand_impl` may match multiple times on a single
variable like `${HOME:-$HOME}`: once for the `${HOME:-` part and
again for its default value `$HOME`. This could cause a panic because
of an invalid slice `&bytes[pos..range.start]`: `pos` is set to
`range.end` which corresponds to the closing `}` in the first iteration
of the loop, so it's greater than `range.start` in the second iteration.

helix-stdx/src/env.rs

@@ -103,6 +103,12 @@ fn expand_impl(src: &OsStr, mut resolve: impl FnMut(&OsStr) -> Option<OsString>)
         let mat = captures.get_match().unwrap();
         let pattern_id = mat.pattern().as_usize();
         let mut range = mat.range();
+        // A pattern may match multiple times on a single variable, for example `${HOME:-$HOME}`:
+        // `${HOME:-` matches and also the default value (`$HOME`). Skip past any variables which
+        // have already been expanded.
+        if range.start < pos {
+            continue;
+        }
         let var = &bytes[captures.get_group(1).unwrap().range()];
         let default = if pattern_id != 5 {
             let Some(bracket_pos) = find_brace_end(&bytes[range.end..]) else {
@@ -203,6 +209,7 @@ mod tests {
         assert_env_expand!(env, "bar/$FOO/baz", "bar/foo/baz");
         assert_env_expand!(env, "bar/${FOO}/baz", "bar/foo/baz");
         assert_env_expand!(env, "baz/${BAR:-bar}/foo", "baz/bar/foo");
+        assert_env_expand!(env, "baz/${FOO:-$FOO}/foo", "baz/foo/foo");
         assert_env_expand!(env, "baz/${BAR:=bar}/foo", "baz/bar/foo");
         assert_env_expand!(env, "baz/${BAR-bar}/foo", "baz/bar/foo");
         assert_env_expand!(env, "baz/${BAR=bar}/foo", "baz/bar/foo");