[PATCH v4] libio: Fix ungetwc operating on byte stream [BZ #33998]

[Rocket Ma]

> > +  TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr);
>
> You could check that the null character can be read back with fgetwc.
> And call xfclose at the end.

In my regression test, the buffer in FILE (byte stream) is "A\0\0\0",
and the buffer in wide FILE (wide stream) is L"A\0\0\0\0", in this
case we can reproduce the error easily, instead of crafting a
complicated test case.[1] In this case, read_ptr of wide stream is 1
out of 4 (A | \0\0\0), leading to next fgetwc returns L'\0' (no new
buffer allocated, read_ptr in byte stream is decreased by 1, no change
on read_ptr in wide stream). If the fix is applied, read_ptr will be
set to the buffer allocated by pbackfail, so L'\0' is returned. The
value returned by fgetwc is always L'\0', so we can not distinguish if
the fix is applied.

[1]: If the buffer in byte stream is "A" instead, then read_ptr[-1] is
'A', like wide stream. Then we can not verify if the bug exists any
more as the bug code path is not entered. Or we set up a locale and
find a character that could be verified if the bug still exists, but
that's a bit hard.

So I still think verifying `fp->_IO_read_ptr == old_read_ptr` is suitable.

Rocket