qmake: fix hypothetical raw data leak in $$replace()

the replacement value may well constitute the whole output string - this
is in fact common, given this rather typical usage pattern:

  BAR = $$replace(FOO, -flag, -otherflag)

this must be considered when constructing the return value.
compare 3c8134958c.

as of now, this is irrelevant, as QString::replace(QRegExp, QString) will
always memcpy the replacement into a detached copy of the target, but one
never knows.

Change-Id: Ia1f271f45023746040fc28ce6d88a6609e05e5c2
Reviewed-by: Joerg Bornemann <joerg.bornemann@qt.io>

qmake/library/qmakebuiltins.cpp

@@ -1111,7 +1111,11 @@ QMakeEvaluator::VisitReturn QMakeEvaluator::evaluateBuiltinExpand(
                 QString rstr = val.toQString(m_tmp1);
                 QString copy = rstr; // Force a detach on modify
                 rstr.replace(before, after);
-                ret << (rstr.isSharedWith(m_tmp1) ? val : ProString(rstr).setSource(val));
+                ret << (rstr.isSharedWith(m_tmp1)
+                            ? val
+                            : rstr.isSharedWith(m_tmp2)
+                                ? args.at(2)
+                                : ProString(rstr).setSource(val));
             }
         }
         break;