Segfault when calling string repeat with negative argument

[ogham]

I was writing some code to pad strings, and if I pass in a negative number of spaces to add, it compiles fine but segmentation faults at runtime. The following code is enough to trigger it:

fn main() {
    "goodbye".to_string().repeat(-1);
}

[schmee]

Since uint wraps around, the example above is equivalent to "goodbye".to_string().repeat(18446744073709551615);. The problem is in Vec::with_capacity. Since uint wraps around this doesn't get caught by checked_mul and it then tries to allocate 18446744073709551609 bytes of memory.

[thestinger]

I don't think this is a bug, it's just a run of the mill out-of-memory error.

#14165 covers adding a warning for this case.

[bluss]

It's actually a dup of #15123