s/.../$_++/ge assertion failure

The code that updated pos() on a match string assumed that it was SvPOK().
Cunning code like the following converted $_ to SvIOK only:

    $_ = 0;
    s/.?/$_++/ge;

pp_ctl.c

@@ -312,10 +312,16 @@ PP(pp_substcont)
 	SV * const sv
 	    = (pm->op_pmflags & PMf_NONDESTRUCT) ? cx->sb_dstr : cx->sb_targ;
 	MAGIC *mg;
+
+        /* the string being matched against may no longer be a string,
+         * e.g. $_=0; s/.../$_++/ge */
+
+        if (!SvPOK(sv))
+            SvPV_force_nomg_nolen(sv);
+
 	if (!(mg = mg_find_mglob(sv))) {
 	    mg = sv_magicext_mglob(sv);
 	}
-	assert(SvPOK(sv));
 	MgBYTEPOS_set(mg, sv, SvPVX(sv), m - orig);
     }
     if (old != rx)

t/re/subst.t

@@ -8,7 +8,7 @@ BEGIN {
     require './charset_tools.pl';
 }
 
-plan( tests => 260 );
+plan( tests => 261 );
 
 $_ = 'david';
 $a = s/david/rules/r;
@@ -1052,3 +1052,12 @@ SKIP: {
 }
 
 }
+
+{
+    # RT #123954 if the string getting matched against got converted during
+    # s///e so that it was no longer SvPOK, an assertion would fail when
+    # setting pos.
+    my $s1 = 0;
+    $s1 =~ s/.?/$s1++/ge;
+    is($s1, "01","RT #123954 s1");
+}