Bug in nested parameter expansion.

[Mark Edgar]

I've boiled the problem down to this:

 A=
 B=q
 echo "x${A+${B#q*}}x" | sed -nel

Excluding the newline, the output I expect is "xx", but instead there
is a delete character \177 between the two "x" characters.

After much experimenting, the important triggers are:

* The entire ${A...} substitution expression must be quoted and the
quotes must include some other expression -- the behavior disappears
when it is left unquoted or separately quoted, e.g. x"${A+${B#q*}}"x.

* The right-hand side of the A expression must be evaluated, e.g.
${A:-} will work too in this case. More generally, any operator ( - :-
+ :+ ) which results in the right side being substituted will trigger
the behavior.

* B must be non-empty and the expression involving it must evaluate to
the empty string, e.g. ${B:0:0}, ${B##*}, ${B%$B}, ${B//*}, etc.

The behavior manifests on BASH_VERSION="4.1.5(1)-release" and
the latest Bash release BASH_VERSION="4.2.0(1)-release", but not
on BASH_VERSION="3.2.48(1)-release".

    -Mark