Copy regex unnamed captures to cloned subrequests. Previously, unnamed regex captures matched in the parent request, were not available in a cloned subrequest. Now 3 fields related to unnamed captures are copied to a cloned subrequest: r->ncaptures, r->captures and r->captures_data. Since r->captures cannot be changed by either request after creating a clone, a new flag r->realloc_captures is introduced to force reallocation of r->captures. The issue was reported as a proxy_cache_background_update misbehavior in http://mailman.nginx.org/pipermail/nginx/2018-December/057251.html.

--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -2504,7 +2504,9 @@ ngx_http_regex_exec(ngx_http_request_t *
     if (re->ncaptures) {
         len = cmcf->ncaptures;
 
-        if (r->captures == NULL) {
+        if (r->captures == NULL || r->realloc_captures) {
+            r->realloc_captures = 0;
+
             r->captures = ngx_palloc(r->pool, len * sizeof(int));
             if (r->captures == NULL) {
                 return NGX_ERROR;