Merge branch 'busybox' into mergeFRP

44 files changed, 241 insertions, 222 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 8cc3f0872..578904478 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -666,8 +666,6 @@ out2str(const char *p)
 #define CTLVAR       ((unsigned char)'\202')    /* variable defn */
 #define CTLENDVAR    ((unsigned char)'\203')
 #define CTLBACKQ     ((unsigned char)'\204')
-#define CTLQUOTE 01             /* ored with CTLBACKQ code if in quotes */
-/*      CTLBACKQ | CTLQUOTE == '\205' */
 #define CTLARI       ((unsigned char)'\206')    /* arithmetic expression */
 #define CTLENDARI    ((unsigned char)'\207')
 #define CTLQUOTEMARK ((unsigned char)'\210')
@@ -676,7 +674,6 @@ out2str(const char *p)
 /* variable substitution byte (follows CTLVAR) */
 #define VSTYPE  0x0f            /* type of variable substitution */
 #define VSNUL   0x10            /* colon--treat the empty string as unset */
-#define VSQUOTE 0x80            /* inside double quotes--suppress splitting */
 
 /* values of VSTYPE field */
 #define VSNORMAL        0x1     /* normal variable:  $var or ${var} */
@@ -696,8 +693,9 @@ out2str(const char *p)
 #endif
 
 static const char dolatstr[] ALIGN1 = {
-        CTLVAR, VSNORMAL|VSQUOTE, '@', '=', '\0'
+        CTLQUOTEMARK, CTLVAR, VSNORMAL, '@', '=', CTLQUOTEMARK, '\0'
 };
+#define DOLATSTRLEN 6
 
 #define NCMD      0
 #define NPIPE     1
@@ -933,9 +931,7 @@ trace_puts_quoted(char *s)
                 case '\\': c = '\\'; goto backslash;
                 case CTLESC: c = 'e'; goto backslash;
                 case CTLVAR: c = 'v'; goto backslash;
-                case CTLVAR+CTLQUOTE: c = 'V'; goto backslash;
                 case CTLBACKQ: c = 'q'; goto backslash;
-                case CTLBACKQ+CTLQUOTE: c = 'Q'; goto backslash;
  backslash:
                         putc('\\', tracefile);
                         putc(c, tracefile);
@@ -1098,7 +1094,6 @@ sharg(union node *arg, FILE *fp)
                         putc('}', fp);
                         break;
                 case CTLBACKQ:
-                case CTLBACKQ|CTLQUOTE:
                         putc('$', fp);
                         putc('(', fp);
                         shtree(bqlist->n, -1, NULL, fp);
@@ -2098,7 +2093,7 @@ varcmp(const char *p, const char *q)
         int c, d;
 
         while ((c = *p) == (d = *q)) {
-                if (!c || c == '=')
+                if (c == '\0' || c == '=')
                         goto out;
                 p++;
                 q++;
@@ -2315,7 +2310,7 @@ setvar(const char *name, const char *val, int flags)
 }
 
 static void FAST_FUNC
-setvar2(const char *name, const char *val)
+setvar0(const char *name, const char *val)
 {
         setvar(name, val, 0);
 }
@@ -2378,7 +2373,7 @@ unsetvar(const char *s)
                         free(vp);
                         INT_ON;
                 } else {
-                        setvar2(s, 0);
+                        setvar0(s, NULL);
                         vp->flags &= ~VEXPORT;
                 }
  ok:
@@ -4689,11 +4684,7 @@ cmdputs(const char *s)
                                 str = "${#";
                         else
                                 str = "${";
-                        if (!(subtype & VSQUOTE) == !(quoted & 1))
-                                goto dostr;
-                        quoted ^= 1;
-                        c = '"';
-                        break;
+                        goto dostr;
                 case CTLENDVAR:
                         str = "\"}" + !(quoted & 1);
                         quoted >>= 1;
@@ -4702,9 +4693,6 @@ cmdputs(const char *s)
                 case CTLBACKQ:
                         str = "$(...)";
                         goto dostr;
-                case CTLBACKQ+CTLQUOTE:
-                        str = "\"$(...)\"";
-                        goto dostr;
 #if ENABLE_SH_MATH_SUPPORT
                 case CTLARI:
                         str = "$((";
@@ -5822,7 +5810,7 @@ ash_arith(const char *s)
         arith_t result;
 
         math_state.lookupvar = lookupvar;
-        math_state.setvar    = setvar2;
+        math_state.setvar    = setvar0;
         //math_state.endofname = endofname;
 
         INT_OFF;
@@ -5843,18 +5831,23 @@ ash_arith(const char *s)
 #define EXP_VARTILDE    0x4     /* expand tildes in an assignment */
 #define EXP_REDIR       0x8     /* file glob for a redirection (1 match only) */
 #define EXP_CASE        0x10    /* keeps quotes around for CASE pattern */
-#define EXP_RECORD      0x20    /* need to record arguments for ifs breakup */
+#define EXP_QPAT        0x20    /* pattern in quoted parameter expansion */
 #define EXP_VARTILDE2   0x40    /* expand tildes after colons only */
 #define EXP_WORD        0x80    /* expand word in parameter expansion */
-#define EXP_QWORD       0x100   /* expand word in quoted parameter expansion */
+#define EXP_QUOTED      0x100   /* expand word in double quotes */
 /*
  * rmescape() flags
  */
 #define RMESCAPE_ALLOC  0x1     /* Allocate a new string */
 #define RMESCAPE_GLOB   0x2     /* Add backslashes for glob */
-#define RMESCAPE_QUOTED 0x4     /* Remove CTLESC unless in quotes */
 #define RMESCAPE_GROW   0x8     /* Grow strings instead of stalloc */
 #define RMESCAPE_HEAP   0x10    /* Malloc strings instead of stalloc */
+#define RMESCAPE_SLASH  0x20    /* Stop globbing after slash */
+
+/* Add CTLESC when necessary. */
+#define QUOTES_ESC     (EXP_FULL | EXP_CASE | EXP_QPAT | EXP_REDIR)
+/* Do not skip NUL characters. */
+#define QUOTES_KEEPNUL EXP_TILDE
 
 /*
  * Structure specifying which parts of the string should be searched
@@ -5919,14 +5912,16 @@ esclen(const char *start, const char *p)
 static char *
 rmescapes(char *str, int flag)
 {
-        static const char qchars[] ALIGN1 = { CTLESC, CTLQUOTEMARK, '\0' };
+        static const char qchars[] ALIGN1 = {
+                IF_ASH_BASH_COMPAT('/',) CTLESC, CTLQUOTEMARK, '\0' };
 
         char *p, *q, *r;
         unsigned inquotes;
         unsigned protect_against_glob;
         unsigned globbing;
+        IF_ASH_BASH_COMPAT(unsigned slash = flag & RMESCAPE_SLASH;)
 
-        p = strpbrk(str, qchars);
+        p = strpbrk(str, qchars IF_ASH_BASH_COMPAT(+ !slash));
         if (!p)
                 return str;
 
@@ -5953,13 +5948,11 @@ rmescapes(char *str, int flag)
                 }
         }
 
-        inquotes = (flag & RMESCAPE_QUOTED) ^ RMESCAPE_QUOTED;
+        inquotes = 0;
         globbing = flag & RMESCAPE_GLOB;
         protect_against_glob = globbing;
         while (*p) {
                 if ((unsigned char)*p == CTLQUOTEMARK) {
-// TODO: if no RMESCAPE_QUOTED in flags, inquotes never becomes 0
-// (alternates between RMESCAPE_QUOTED and ~RMESCAPE_QUOTED). Is it ok?
 // Note: both inquotes and protect_against_glob only affect whether
 // CTLESC,<ch> gets converted to <ch> or to \<ch>
                         inquotes = ~inquotes;
@@ -5967,17 +5960,23 @@ rmescapes(char *str, int flag)
                         protect_against_glob = globbing;
                         continue;
                 }
-                if (*p == '\\') {
-                        /* naked back slash */
-                        protect_against_glob = 0;
-                        goto copy;
-                }
                 if ((unsigned char)*p == CTLESC) {
                         p++;
-                        if (protect_against_glob && inquotes && *p != '/') {
+                        if (protect_against_glob) {
                                 *q++ = '\\';
                         }
+                } else if (*p == '\\' && !inquotes) {
+                        /* naked back slash */
+                        protect_against_glob = 0;
+                        goto copy;
+                }
+#if ENABLE_ASH_BASH_COMPAT
+                else if (*p == '/' && slash) {
+                        /* stop handling globbing and mark location of slash */
+                        globbing = slash = 0;
+                        *p = CTLESC;
                 }
+#endif
                 protect_against_glob = globbing;
  copy:
                 *q++ = *p++;
@@ -5997,13 +5996,9 @@ rmescapes(char *str, int flag)
  * Returns an stalloced string.
  */
 static char *
-preglob(const char *pattern, int quoted, int flag)
+preglob(const char *pattern, int flag)
 {
-        flag |= RMESCAPE_GLOB;
-        if (quoted) {
-                flag |= RMESCAPE_QUOTED;
-        }
-        return rmescapes((char *)pattern, flag);
+        return rmescapes((char *)pattern, flag | RMESCAPE_GLOB);
 }
 
 /*
@@ -6012,29 +6007,36 @@ preglob(const char *pattern, int quoted, int flag)
 static void
 memtodest(const char *p, size_t len, int syntax, int quotes)
 {
-        char *q = expdest;
+        char *q;
+
+        if (!len)
+                return;
 
-        q = makestrspace(quotes ? len * 2 : len, q);
+        q = makestrspace((quotes & QUOTES_ESC) ? len * 2 : len, expdest);
 
-        while (len--) {
+        do {
                 unsigned char c = *p++;
-                if (c == '\0')
-                        continue;
-                if (quotes) {
+                if (c) {
                         int n = SIT(c, syntax);
-                        if (n == CCTL || n == CBACK)
+                        if ((quotes & QUOTES_ESC) &&
+                                        ((n == CCTL) ||
+                                        (((quotes & EXP_FULL) || syntax != BASESYNTAX) &&
+                                        n == CBACK)))
                                 USTPUTC(CTLESC, q);
-                }
+                } else if (!(quotes & QUOTES_KEEPNUL))
+                        continue;
                 USTPUTC(c, q);
-        }
+        } while (--len);
 
         expdest = q;
 }
 
-static void
+static size_t
 strtodest(const char *p, int syntax, int quotes)
 {
-        memtodest(p, strlen(p), syntax, quotes);
+        size_t len = strlen(p);
+        memtodest(p, len, syntax, quotes);
+        return len;
 }
 
 /*
@@ -6107,7 +6109,7 @@ exptilde(char *startp, char *p, int flags)
         char *name;
         struct passwd *pw;
         const char *home;
-        int quotes = flags & (EXP_FULL | EXP_CASE | EXP_REDIR);
+        int quotes = flags & QUOTES_ESC;
 
         name = p + 1;
 
@@ -6223,7 +6225,7 @@ evalbackcmd(union node *n, struct backcmd *result)
  * Expand stuff in backwards quotes.
  */
 static void
-expbackq(union node *cmd, int quoted, int quotes)
+expbackq(union node *cmd, int flag)
 {
         struct backcmd in;
         int i;
@@ -6231,7 +6233,7 @@ expbackq(union node *cmd, int quoted, int quotes)
         char *p;
         char *dest;
         int startloc;
-        int syntax = quoted ? DQSYNTAX : BASESYNTAX;
+        int syntax = flag & EXP_QUOTED ? DQSYNTAX : BASESYNTAX;
         struct stackmark smark;
 
         INT_OFF;
@@ -6247,11 +6249,11 @@ expbackq(union node *cmd, int quoted, int quotes)
         if (i == 0)
                 goto read;
         for (;;) {
-                memtodest(p, i, syntax, quotes);
+                memtodest(p, i, syntax, flag & QUOTES_ESC);
  read:
                 if (in.fd < 0)
                         break;
-                i = nonblock_immune_read(in.fd, buf, sizeof(buf), /*loop_on_EINTR:*/ 1);
+                i = nonblock_immune_read(in.fd, buf, sizeof(buf));
                 TRACE(("expbackq: read returns %d\n", i));
                 if (i <= 0)
                         break;
@@ -6272,7 +6274,7 @@ expbackq(union node *cmd, int quoted, int quotes)
                 STUNPUTC(dest);
         expdest = dest;
 
-        if (quoted == 0)
+        if (!(flag & EXP_QUOTED))
                 recordregion(startloc, dest - (char *)stackblock(), 0);
         TRACE(("evalbackq: size:%d:'%.*s'\n",
                 (int)((dest - (char *)stackblock()) - startloc),
@@ -6286,11 +6288,10 @@ expbackq(union node *cmd, int quoted, int quotes)
  * evaluate, place result in (backed up) result, adjust string position.
  */
 static void
-expari(int quotes)
+expari(int flag)
 {
         char *p, *start;
         int begoff;
-        int flag;
         int len;
 
         /* ifsfree(); */
@@ -6328,16 +6329,14 @@ expari(int quotes)
 
         removerecordregions(begoff);
 
-        flag = p[1];
-
         expdest = p;
 
-        if (quotes)
-                rmescapes(p + 2, 0);
+        if (flag & QUOTES_ESC)
+                rmescapes(p + 1, 0);
 
-        len = cvtnum(ash_arith(p + 2));
+        len = cvtnum(ash_arith(p + 1));
 
-        if (flag != '"')
+        if (!(flag & EXP_QUOTED))
                 recordregion(begoff, begoff + len, 0);
 }
 #endif
@@ -6365,15 +6364,13 @@ argstr(char *p, int flags, struct strlist *var_str_list)
                 CTLESC,
                 CTLVAR,
                 CTLBACKQ,
-                CTLBACKQ | CTLQUOTE,
 #if ENABLE_SH_MATH_SUPPORT
                 CTLENDARI,
 #endif
                 '\0'
         };
         const char *reject = spclchars;
-        int quotes = flags & (EXP_FULL | EXP_CASE | EXP_REDIR); /* do CTLESC */
-        int breakall = flags & EXP_WORD;
+        int breakall = (flags & (EXP_WORD | EXP_QUOTED)) == EXP_WORD;
         int inquotes;
         size_t length;
         int startloc;
@@ -6391,8 +6388,6 @@ argstr(char *p, int flags, struct strlist *var_str_list)
                 flags &= ~EXP_TILDE;
  tilde:
                 q = p;
-                if ((unsigned char)*q == CTLESC && (flags & EXP_QWORD))
-                        q++;
                 if (*q == '~')
                         p = exptilde(p, q, flags);
         }
@@ -6449,19 +6444,14 @@ argstr(char *p, int flags, struct strlist *var_str_list)
                 case CTLENDVAR: /* ??? */
                         goto breakloop;
                 case CTLQUOTEMARK:
+                        inquotes ^= EXP_QUOTED;
                         /* "$@" syntax adherence hack */
-                        if (!inquotes
-                         && memcmp(p, dolatstr, 4) == 0
-                         && (  p[4] == (char)CTLQUOTEMARK
-                            || (p[4] == (char)CTLENDVAR && p[5] == (char)CTLQUOTEMARK)
-                            )
-                        ) {
-                                p = evalvar(p + 1, flags, /* var_str_list: */ NULL) + 1;
+                        if (inquotes && !memcmp(p, dolatstr + 1, DOLATSTRLEN - 1)) {
+                                p = evalvar(p + 1, flags | inquotes, /* var_str_list: */ NULL) + 1;
                                 goto start;
                         }
-                        inquotes = !inquotes;
  addquote:
-                        if (quotes) {
+                        if (flags & QUOTES_ESC) {
                                 p--;
                                 length++;
                                 startloc++;
@@ -6470,22 +6460,30 @@ argstr(char *p, int flags, struct strlist *var_str_list)
                 case CTLESC:
                         startloc++;
                         length++;
+
+                        /*
+                         * Quoted parameter expansion pattern: remove quote
+                         * unless inside inner quotes or we have a literal
+                         * backslash.
+                         */
+                        if (((flags | inquotes) & (EXP_QPAT | EXP_QUOTED)) ==
+                            EXP_QPAT && *p != '\\')
+                                break;
+
                         goto addquote;
                 case CTLVAR:
                         TRACE(("argstr: evalvar('%s')\n", p));
-                        p = evalvar(p, flags, var_str_list);
+                        p = evalvar(p, flags | inquotes, var_str_list);
                         TRACE(("argstr: evalvar:'%s'\n", (char *)stackblock()));
                         goto start;
                 case CTLBACKQ:
-                        c = '\0';
-                case CTLBACKQ|CTLQUOTE:
-                        expbackq(argbackq->n, c, quotes);
+                        expbackq(argbackq->n, flags | inquotes);
                         argbackq = argbackq->next;
                         goto start;
 #if ENABLE_SH_MATH_SUPPORT
                 case CTLENDARI:
                         p--;
-                        expari(quotes);
+                        expari(flags | inquotes);
                         goto start;
 #endif
                 }
@@ -6615,60 +6613,17 @@ varunset(const char *end, const char *var, const char *umsg, int varflags)
         ash_msg_and_raise_error("%.*s: %s%s", (int)(end - var - 1), var, msg, tail);
 }
 
-#if ENABLE_ASH_BASH_COMPAT
-static char *
-parse_sub_pattern(char *arg, int varflags)
-{
-        char *idx, *repl = NULL;
-        unsigned char c;
-
-        //char *org_arg = arg;
-        //bb_error_msg("arg:'%s' varflags:%x", arg, varflags);
-        idx = arg;
-        while (1) {
-                c = *arg;
-                if (!c)
-                        break;
-                if (c == '/') {
-                        /* Only the first '/' seen is our separator */
-                        if (!repl) {
-                                repl = idx + 1;
-                                c = '\0';
-                        }
-                }
-                *idx++ = c;
-                arg++;
-                /*
-                 * Example: v='ab\c'; echo ${v/\\b/_\\_\z_}
-                 * The result is a_\_z_c (not a\_\_z_c)!
-                 *
-                 * Enable debug prints in this function and you'll see:
-                 * ash: arg:'\\b/_\\_z_' varflags:d
-                 * ash: pattern:'\\b' repl:'_\_z_'
-                 * That is, \\b is interpreted as \\b, but \\_ as \_!
-                 * IOW: search pattern and replace string treat backslashes
-                 * differently! That is the reason why we check repl below:
-                 */
-                if (c == '\\' && *arg == '\\' && repl && !(varflags & VSQUOTE))
-                        arg++; /* skip both '\', not just first one */
-        }
-        *idx = c; /* NUL */
-        //bb_error_msg("pattern:'%s' repl:'%s'", org_arg, repl);
-
-        return repl;
-}
-#endif /* ENABLE_ASH_BASH_COMPAT */
-
 static const char *
 subevalvar(char *p, char *varname, int strloc, int subtype,
-                int startloc, int varflags, int quotes, struct strlist *var_str_list)
+                int startloc, int varflags, int flag, struct strlist *var_str_list)
 {
         struct nodelist *saveargbackq = argbackq;
+        int quotes = flag & QUOTES_ESC;
         char *startp;
         char *loc;
         char *rmesc, *rmescend;
         char *str;
-        IF_ASH_BASH_COMPAT(const char *repl = NULL;)
+        IF_ASH_BASH_COMPAT(char *repl = NULL;)
         IF_ASH_BASH_COMPAT(int pos, len, orig_len;)
         int saveherefd = herefd;
         int amount, resetloc;
@@ -6680,7 +6635,8 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
         //              p, varname, strloc, subtype, startloc, varflags, quotes);
 
         herefd = -1;
-        argstr(p, (subtype != VSASSIGN && subtype != VSQUESTION) ? EXP_CASE : 0,
+        argstr(p, EXP_TILDE | (subtype != VSASSIGN && subtype != VSQUESTION ?
+                        (flag & (EXP_QUOTED | EXP_QPAT) ? EXP_QPAT : EXP_CASE) : 0),
                         var_str_list);
         STPUTC('\0', expdest);
         herefd = saveherefd;
@@ -6689,7 +6645,7 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
 
         switch (subtype) {
         case VSASSIGN:
-                setvar2(varname, startp);
+                setvar0(varname, startp);
                 amount = startp - expdest;
                 STADJUST(amount, expdest);
                 return startp;
@@ -6792,7 +6748,17 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
         }
         rmescend--;
         str = (char *)stackblock() + strloc;
-        preglob(str, varflags & VSQUOTE, 0);
+        /*
+         * Example: v='a\bc'; echo ${v/\\b/_\\_\z_}
+         * The result is a_\_z_c (not a\_\_z_c)!
+         *
+         * The search pattern and replace string treat backslashes differently!
+         * RMESCAPE_SLASH causes preglob to work differently on the pattern
+         * and string.  It's only used on the first call.
+         */
+        preglob(str, IF_ASH_BASH_COMPAT(
+                (subtype == VSREPLACE || subtype == VSREPLACEALL) && !repl ?
+                        RMESCAPE_SLASH :) 0);
 
 #if ENABLE_ASH_BASH_COMPAT
         workloc = expdest - (char *)stackblock();
@@ -6800,11 +6766,12 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
                 char *idx, *end;
 
                 if (!repl) {
-                        repl = parse_sub_pattern(str, varflags);
-                        //bb_error_msg("repl:'%s'", repl);
-                        if (!repl)
+                        if ((repl=strchr(str, CTLESC)))
+                                *repl++ = '\0';
+                        else
                                 repl = nullstr;
                 }
+                //bb_error_msg("str:'%s' repl:'%s'", str, repl);
 
                 /* If there's no pattern to match, return the expansion unmolested */
                 if (str[0] == '\0')
@@ -6937,13 +6904,16 @@ varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
         const char *p;
         int num;
         int i;
-        int sepq = 0;
         ssize_t len = 0;
+        int sep;
+        int quoted = flags & EXP_QUOTED;
         int subtype = varflags & VSTYPE;
-        int quotes = flags & (EXP_FULL | EXP_CASE | EXP_REDIR);
-        int quoted = varflags & VSQUOTE;
+        int discard = subtype == VSPLUS || subtype == VSLENGTH;
+        int quotes = (discard ? 0 : (flags & QUOTES_ESC)) | QUOTES_KEEPNUL;
         int syntax = quoted ? DQSYNTAX : BASESYNTAX;
 
+        sep = quoted ? ((flags & EXP_FULL) << CHAR_BIT) : 0;
+
         switch (*name) {
         case '$':
                 num = rootpid;
@@ -6978,7 +6948,7 @@ varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
                 break;
         case '@': {
                 char **ap;
-                int sep;
+                char sepc;
 
                 if (quoted && (flags & EXP_FULL)) {
                         /* note: this is not meant as PEOF value */
@@ -6988,39 +6958,20 @@ varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
                 /* fall through */
         case '*':
                 sep = ifsset() ? (unsigned char)(ifsval()[0]) : ' ';
-                i = SIT(sep, syntax);
-                if (quotes && (i == CCTL || i == CBACK))
-                        sepq = 1;
  param:
                 ap = shellparam.p;
+                sepc = sep;
                 if (!ap)
                         return -1;
                 while ((p = *ap++) != NULL) {
-                        size_t partlen;
-
-                        partlen = strlen(p);
-                        len += partlen;
-
-                        if (!(subtype == VSPLUS || subtype == VSLENGTH))
-                                memtodest(p, partlen, syntax, quotes);
+                        len += strtodest(p, syntax, quotes);
 
                         if (*ap && sep) {
-                                char *q;
-
                                 len++;
-                                if (subtype == VSPLUS || subtype == VSLENGTH) {
-                                        continue;
-                                }
-                                q = expdest;
-                                if (sepq)
-                                        STPUTC(CTLESC, q);
-                                /* note: may put NUL despite sep != 0
-                                 * (see sep = 1 << CHAR_BIT above) */
-                                STPUTC(sep, q);
-                                expdest = q;
+                                memtodest(&sepc, 1, syntax, quotes);
                         }
                 }
-                return len;
+                break;
         } /* case '@' and '*' */
         case '0':
         case '1':
@@ -7069,9 +7020,7 @@ varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
                 if (!p)
                         return -1;
 
-                len = strlen(p);
-                if (!(subtype == VSPLUS || subtype == VSLENGTH))
-                        memtodest(p, len, syntax, quotes);
+                len = strtodest(p, syntax, quotes);
 #if ENABLE_UNICODE_SUPPORT
                 if (subtype == VSLENGTH && len > 0) {
                         reinit_unicode_for_ash();
@@ -7080,10 +7029,10 @@ varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
                         }
                 }
 #endif
-                return len;
+                break;
         }
 
-        if (subtype == VSPLUS || subtype == VSLENGTH)
+        if (discard)
                 STADJUST(-len, expdest);
         return len;
 }
@@ -7097,7 +7046,7 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
 {
         char varflags;
         char subtype;
-        char quoted;
+        int quoted;
         char easy;
         char *var;
         int patloc;
@@ -7106,7 +7055,7 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
 
         varflags = (unsigned char) *p++;
         subtype = varflags & VSTYPE;
-        quoted = varflags & VSQUOTE;
+        quoted = flags & EXP_QUOTED;
         var = p;
         easy = (!quoted || (*var == '@' && shellparam.nparam));
         startloc = expdest - (char *)stackblock();
@@ -7127,7 +7076,7 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
                 if (varlen < 0) {
                         argstr(
                                 p,
-                                flags | (quoted ? EXP_TILDE|EXP_QWORD : EXP_TILDE|EXP_WORD),
+                                flags | EXP_TILDE | EXP_WORD,
                                 var_str_list
                         );
                         goto end;
@@ -7141,7 +7090,7 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
                 if (varlen < 0) {
                         if (subevalvar(p, var, /* strloc: */ 0,
                                         subtype, startloc, varflags,
-                                        /* quotes: */ 0,
+                                        /* quotes: */ flags & ~QUOTES_ESC,
                                         var_str_list)
                         ) {
                                 varflags &= ~VSNUL;
@@ -7198,10 +7147,7 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
                 STPUTC('\0', expdest);
                 patloc = expdest - (char *)stackblock();
                 if (NULL == subevalvar(p, /* varname: */ NULL, patloc, subtype,
-                                startloc, varflags,
-                                /* quotes: */ flags & (EXP_FULL | EXP_CASE | EXP_REDIR),
-                                var_str_list)
-                ) {
+                                startloc, varflags, flags, var_str_list)) {
                         int amount = expdest - (
                                 (char *)stackblock() + patloc - 1
                         );
@@ -7220,7 +7166,7 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
                         unsigned char c = *p++;
                         if (c == CTLESC)
                                 p++;
-                        else if (c == CTLBACKQ || c == (CTLBACKQ|CTLQUOTE)) {
+                        else if (c == CTLBACKQ) {
                                 if (varlen >= 0)
                                         argbackq = argbackq->next;
                         } else if (c == CTLVAR) {
@@ -7556,7 +7502,7 @@ expandmeta(struct strlist *str /*, int flag*/)
                 savelastp = exparg.lastp;
 
                 INT_OFF;
-                p = preglob(str->text, 0, RMESCAPE_ALLOC | RMESCAPE_HEAP);
+                p = preglob(str->text, RMESCAPE_ALLOC | RMESCAPE_HEAP);
                 {
                         int i = strlen(str->text);
                         expdir = ckmalloc(i < 2048 ? 2048 : i); /* XXX */
@@ -7646,7 +7592,7 @@ static void
 expandhere(union node *arg, int fd)
 {
         herefd = fd;
-        expandarg(arg, (struct arglist *)NULL, 0);
+        expandarg(arg, (struct arglist *)NULL, EXP_QUOTED);
         full_write(fd, stackblock(), expdest - (char *)stackblock());
 }
 
@@ -7656,7 +7602,7 @@ expandhere(union node *arg, int fd)
 static int
 patmatch(char *pattern, const char *string)
 {
-        return pmatch(preglob(pattern, 0, 0), string);
+        return pmatch(preglob(pattern, 0), string);
 }
 
 /*
@@ -8956,7 +8902,7 @@ evalfor(union node *n, int flags)
         arglist.list = NULL;
         arglist.lastp = &arglist.list;
         for (argp = n->nfor.args; argp; argp = argp->narg.next) {
-                expandarg(argp, &arglist, EXP_FULL | EXP_TILDE | EXP_RECORD);
+                expandarg(argp, &arglist, EXP_FULL | EXP_TILDE);
                 /* XXX */
                 if (evalskip)
                         goto out;
@@ -8967,7 +8913,7 @@ evalfor(union node *n, int flags)
         loopnest++;
         flags &= EV_TESTED;
         for (sp = arglist.list; sp; sp = sp->next) {
-                setvar2(n->nfor.var, sp->text);
+                setvar0(n->nfor.var, sp->text);
                 evaltree(n->nfor.body, flags);
                 if (evalskip) {
                         if (evalskip == SKIPCONT && --skipcount <= 0) {
@@ -9362,7 +9308,8 @@ parse_command_args(char **argv, const char **path)
  * Make a variable a local variable.  When a variable is made local, it's
  * value and flags are saved in a localvar structure.  The saved values
  * will be restored when the shell function returns.  We handle the name
- * "-" as a special case.
+ * "-" as a special case: it makes changes to "set +-options" local
+ * (options will be restored on return from the function).
  */
 static void
 mklocal(char *name)
@@ -9370,21 +9317,37 @@ mklocal(char *name)
         struct localvar *lvp;
         struct var **vpp;
         struct var *vp;
+        char *eq = strchr(name, '=');
 
         INT_OFF;
-        lvp = ckzalloc(sizeof(struct localvar));
+        /* Cater for duplicate "local". Examples:
+         * x=0; f() { local x=1; echo $x; local x; echo $x; }; f; echo $x
+         * x=0; f() { local x=1; echo $x; local x=2; echo $x; }; f; echo $x
+         */
+        lvp = localvars;
+        while (lvp) {
+                if (lvp->vp && varcmp(lvp->vp->var_text, name) == 0) {
+                        if (eq)
+                                setvareq(name, 0);
+                        /* else:
+                         * it's a duplicate "local VAR" declaration, do nothing
+                         */
+                        return;
+                }
+                lvp = lvp->next;
+        }
+
+        lvp = ckzalloc(sizeof(*lvp));
         if (LONE_DASH(name)) {
                 char *p;
                 p = ckmalloc(sizeof(optlist));
                 lvp->text = memcpy(p, optlist, sizeof(optlist));
                 vp = NULL;
         } else {
-                char *eq;
-
                 vpp = hashvar(name);
                 vp = *findvar(vpp, name);
-                eq = strchr(name, '=');
                 if (vp == NULL) {
+                        /* variable did not exist yet */
                         if (eq)
                                 setvareq(name, VSTRFIXED);
                         else
@@ -9394,12 +9357,15 @@ mklocal(char *name)
                 } else {
                         lvp->text = vp->var_text;
                         lvp->flags = vp->flags;
+                        /* make sure neither "struct var" nor string gets freed
+                         * during (un)setting:
+                         */
                         vp->flags |= VSTRFIXED|VTEXTFIXED;
                         if (eq)
                                 setvareq(name, 0);
                         else
                                 /* "local VAR" unsets VAR: */
-                                setvar(name, NULL, 0);
+                                setvar0(name, NULL);
                 }
         }
         lvp->vp = vp;
@@ -9914,7 +9880,7 @@ evalcommand(union node *cmd, int flags)
                  * '_' in 'vi' command mode during line editing...
                  * However I implemented that within libedit itself.
                  */
-                setvar2("_", lastarg);
+                setvar0("_", lastarg);
         }
         popstackmark(&smark);
 }
@@ -10100,7 +10066,7 @@ preadfd(void)
 #if ENABLE_FEATURE_EDITING
  retry:
         if (!iflag || g_parsefile->pf_fd != STDIN_FILENO)
-                nr = nonblock_immune_read(g_parsefile->pf_fd, buf, IBUFSIZ - 1, /*loop_on_EINTR:*/ 1);
+                nr = nonblock_immune_read(g_parsefile->pf_fd, buf, IBUFSIZ - 1);
         else {
                 int timeout = -1;
 # if ENABLE_ASH_IDLE_TIMEOUT
@@ -10142,7 +10108,7 @@ preadfd(void)
                 }
         }
 #else
-        nr = nonblock_immune_read(g_parsefile->pf_fd, buf, IBUFSIZ - 1, /*loop_on_EINTR:*/ 1);
+        nr = nonblock_immune_read(g_parsefile->pf_fd, buf, IBUFSIZ - 1);
 #endif
 
 #if 0 /* disabled: nonblock_immune_read() handles this problem */
@@ -11675,11 +11641,9 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                                  && c != '$'
                                  && (c != '"' || eofmark != NULL)
                                 ) {
-                                        USTPUTC(CTLESC, out);
                                         USTPUTC('\\', out);
                                 }
-                                if (SIT(c, SQSYNTAX) == CCTL)
-                                        USTPUTC(CTLESC, out);
+                                USTPUTC(CTLESC, out);
                                 USTPUTC(c, out);
                                 quotef = 1;
                         }
@@ -11697,9 +11661,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                         goto quotemark;
                 case CENDQUOTE:
                         IF_ASH_BASH_COMPAT(bash_dollar_squote = 0;)
-                        if (eofmark != NULL && arinest == 0
-                         && varnest == 0
-                        ) {
+                        if (eofmark != NULL && varnest == 0) {
                                 USTPUTC(c, out);
                         } else {
                                 if (dqvarnest == 0) {
@@ -11733,10 +11695,9 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                                 parenlevel--;
                         } else {
                                 if (pgetc() == ')') {
+                                        c = CTLENDARI;
                                         if (--arinest == 0) {
                                                 syntax = prevsyntax;
-                                                dblquote = (syntax == DQSYNTAX);
-                                                c = CTLENDARI;
                                         }
                                 } else {
                                         /*
@@ -12055,12 +12016,10 @@ parsesub: {
  do_pungetc:
                         pungetc();
                 }
-                if (dblquote || arinest)
-                        flags |= VSQUOTE;
                 ((unsigned char *)stackblock())[typeloc] = subtype | flags;
                 if (subtype != VSNORMAL) {
                         varnest++;
-                        if (dblquote || arinest) {
+                        if (dblquote) {
                                 dqvarnest++;
                         }
                 }
@@ -12210,10 +12169,7 @@ parsebackq: {
         }
         parsebackquote = savepbq;
         exception_handler = savehandler;
-        if (arinest || dblquote)
-                USTPUTC(CTLBACKQ | CTLQUOTE, out);
-        else
-                USTPUTC(CTLBACKQ, out);
+        USTPUTC(CTLBACKQ, out);
         if (oldstyle)
                 goto parsebackq_oldreturn;
         goto parsebackq_newreturn;
@@ -12227,18 +12183,8 @@ parsearith: {
         if (++arinest == 1) {
                 prevsyntax = syntax;
                 syntax = ARISYNTAX;
-                USTPUTC(CTLARI, out);
-                if (dblquote)
-                        USTPUTC('"', out);
-                else
-                        USTPUTC(' ', out);
-        } else {
-                /*
-                 * we collapse embedded arithmetic expansion to
-                 * parenthesis, which should be equivalent
-                 */
-                USTPUTC('(', out);
         }
+        USTPUTC(CTLARI, out);
         goto parsearith_return;
 }
 #endif
@@ -12553,7 +12499,7 @@ expandstr(const char *ps)
         n.narg.text = wordtext;
         n.narg.backquote = backquotelist;
 
-        expandarg(&n, NULL, 0);
+        expandarg(&n, NULL, EXP_QUOTED);
         return stackblock();
 }
 #endif
@@ -13348,7 +13294,7 @@ readcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
          * to jump out of it.
          */
         INT_OFF;
-        r = shell_builtin_read(setvar2,
+        r = shell_builtin_read(setvar0,
                 argptr,
                 bltinlookup("IFS"), /* can be NULL */
                 read_flags,
@@ -13560,14 +13506,14 @@ init(void)
                         }
                 }
 
-                setvar2("PPID", utoa(getppid()));
+                setvar0("PPID", utoa(getppid()));
 #if ENABLE_ASH_BASH_COMPAT
                 p = lookupvar("SHLVL");
                 setvar("SHLVL", utoa((p ? atoi(p) : 0) + 1), VEXPORT);
                 if (!lookupvar("HOSTNAME")) {
                         struct utsname uts;
                         uname(&uts);
-                        setvar2("HOSTNAME", uts.nodename);
+                        setvar0("HOSTNAME", uts.nodename);
                 }
 #endif
                 p = lookupvar("PWD");
@@ -13848,7 +13794,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                                 hp = lookupvar("HOME");
                                 if (hp) {
                                         hp = concat_path_file(hp, ".ash_history");
-                                        setvar2("HISTFILE", hp);
+                                        setvar0("HISTFILE", hp);
                                         free((char*)hp);
                                         hp = lookupvar("HISTFILE");
                                 }
diff --git a/shell/ash_test/ash-heredoc/heredoc1.right b/shell/ash_test/ash-heredoc/heredoc1.right
index 895f5ee80..40aa5a5fe 100644
--- a/shell/ash_test/ash-heredoc/heredoc1.right
+++ b/shell/ash_test/ash-heredoc/heredoc1.right
@@ -1 +1 @@
-heredoc1.tests: line 3: syntax error: unexpected "then"
+./heredoc1.tests: line 3: syntax error: unexpected "then"
diff --git a/shell/ash_test/ash-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.right b/shell/ash_test/ash-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.right
new file mode 100644
index 000000000..81a15855c
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.right
@@ -0,0 +1,2 @@
+12
+9
diff --git a/shell/ash_test/ash-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.tests b/shell/ash_test/ash-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.tests
new file mode 100755
index 000000000..e97a08a57
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.tests
@@ -0,0 +1,3 @@
+unset a
+echo $((3 + ${a:=$((4 + 5))}))
+echo $a
diff --git a/shell/ash_test/ash-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.right b/shell/ash_test/ash-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.right
new file mode 100644
index 000000000..4b9b4f038
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.right
@@ -0,0 +1 @@
+~root
diff --git a/shell/ash_test/ash-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.tests b/shell/ash_test/ash-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.tests
new file mode 100755
index 000000000..d8eb8fc1b
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.tests
@@ -0,0 +1,2 @@
+unset a
+echo "${a:-~root}"
diff --git a/shell/ash_test/ash-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.right b/shell/ash_test/ash-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.right
new file mode 100644
index 000000000..030ebdeb6
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.right
@@ -0,0 +1 @@
+/b/c/
diff --git a/shell/ash_test/ash-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.tests b/shell/ash_test/ash-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.tests
new file mode 100755
index 000000000..fb9371467
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.tests
@@ -0,0 +1,3 @@
+a=/b/c/*
+b=\\
+echo ${a%$b*}
diff --git a/shell/ash_test/ash-vars/var-expand-tilde-in-parameter-expansion.right b/shell/ash_test/ash-vars/var-expand-tilde-in-parameter-expansion.right
new file mode 100644
index 000000000..2357750c5
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-expand-tilde-in-parameter-expansion.right
@@ -0,0 +1 @@
+:/root
diff --git a/shell/ash_test/ash-vars/var-expand-tilde-in-parameter-expansion.tests b/shell/ash_test/ash-vars/var-expand-tilde-in-parameter-expansion.tests
new file mode 100755
index 000000000..6605315d0
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-expand-tilde-in-parameter-expansion.tests
@@ -0,0 +1,2 @@
+a=~root:~root
+echo ${a#~root}
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-1.right b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-1.right
new file mode 100644
index 000000000..2da327222
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-1.right
@@ -0,0 +1 @@
+a_\_z_c
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-1.tests b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-1.tests
new file mode 100755
index 000000000..e4529c631
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-1.tests
@@ -0,0 +1,2 @@
+v="a\bc"
+echo ${v/\\b/_\\_\z_}
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-2.right b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-2.right
new file mode 100644
index 000000000..7447c0a04
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-2.right
@@ -0,0 +1 @@
+ax/yc
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-2.tests b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-2.tests
new file mode 100755
index 000000000..2db1db897
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-2.tests
@@ -0,0 +1,2 @@
+v="abc"
+echo ${v/b/x/y}
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-3.right b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-3.right
new file mode 100644
index 000000000..5ea5ff892
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-3.right
@@ -0,0 +1 @@
+axcabc
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-3.tests b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-3.tests
new file mode 100755
index 000000000..0935e4509
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-3.tests
@@ -0,0 +1,2 @@
+v="abcabc"
+echo ${v/b/x}
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-4.right b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-4.right
new file mode 100644
index 000000000..46dd750c1
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-4.right
@@ -0,0 +1 @@
+axcaxc
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-4.tests b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-4.tests
new file mode 100755
index 000000000..d8de84347
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-4.tests
@@ -0,0 +1,2 @@
+v="abcabc"
+echo ${v//b/x}
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-5.right b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-5.right
new file mode 100644
index 000000000..699b27b0c
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-5.right
@@ -0,0 +1 @@
+axc
diff --git a/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-5.tests b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-5.tests
new file mode 100755
index 000000000..552388877
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-pattern-replacement-in-parameter-expansion-5.tests
@@ -0,0 +1,2 @@
+v="ab/c"
+echo ${v/b\//x}
diff --git a/shell/ash_test/ash-vars/var-runtime-quote-detection.right b/shell/ash_test/ash-vars/var-runtime-quote-detection.right
new file mode 100644
index 000000000..b554d9e46
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-runtime-quote-detection.right
@@ -0,0 +1 @@
+<>
diff --git a/shell/ash_test/ash-vars/var-runtime-quote-detection.tests b/shell/ash_test/ash-vars/var-runtime-quote-detection.tests
new file mode 100755
index 000000000..e570631fd
--- /dev/null
+++ b/shell/ash_test/ash-vars/var-runtime-quote-detection.tests
@@ -0,0 +1 @@
+foo=\\ echo "<${foo#[\\]}>"
diff --git a/shell/ash_test/ash-vars/var3.right b/shell/ash_test/ash-vars/var3.right
new file mode 100644
index 000000000..8eb0e3337
--- /dev/null
+++ b/shell/ash_test/ash-vars/var3.right
@@ -0,0 +1,5 @@
+1
+1
+
+
+0
diff --git a/shell/ash_test/ash-vars/var3.tests b/shell/ash_test/ash-vars/var3.tests
new file mode 100755
index 000000000..97b102cbe
--- /dev/null
+++ b/shell/ash_test/ash-vars/var3.tests
@@ -0,0 +1 @@
+x=0; f() { local x=1; echo $x; local x; echo $x; unset x; echo $x; local x; echo $x; }; f; echo $x
diff --git a/shell/hush_test/hush-bugs/var3.right b/shell/hush_test/hush-bugs/var3.right
new file mode 100644
index 000000000..8eb0e3337
--- /dev/null
+++ b/shell/hush_test/hush-bugs/var3.right
@@ -0,0 +1,5 @@
+1
+1
+
+
+0
diff --git a/shell/hush_test/hush-bugs/var3.tests b/shell/hush_test/hush-bugs/var3.tests
new file mode 100755
index 000000000..97b102cbe
--- /dev/null
+++ b/shell/hush_test/hush-bugs/var3.tests
@@ -0,0 +1 @@
+x=0; f() { local x=1; echo $x; local x; echo $x; unset x; echo $x; local x; echo $x; }; f; echo $x
diff --git a/shell/hush_test/hush-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.right b/shell/hush_test/hush-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.right
new file mode 100644
index 000000000..81a15855c
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.right
@@ -0,0 +1,2 @@
+12
+9
diff --git a/shell/hush_test/hush-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.tests b/shell/hush_test/hush-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.tests
new file mode 100755
index 000000000..e97a08a57
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-do-not-collapse-arithmetic-expansion-at-parse-time.tests
@@ -0,0 +1,3 @@
+unset a
+echo $((3 + ${a:=$((4 + 5))}))
+echo $a
diff --git a/shell/hush_test/hush-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.right b/shell/hush_test/hush-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.right
new file mode 100644
index 000000000..4b9b4f038
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.right
@@ -0,0 +1 @@
+~root
diff --git a/shell/hush_test/hush-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.tests b/shell/hush_test/hush-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.tests
new file mode 100755
index 000000000..d8eb8fc1b
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-do-not-expand-tilde-in-parameter-expansion-in-quotes.tests
@@ -0,0 +1,2 @@
+unset a
+echo "${a:-~root}"
diff --git a/shell/hush_test/hush-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.right b/shell/hush_test/hush-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.right
new file mode 100644
index 000000000..030ebdeb6
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.right
@@ -0,0 +1 @@
+/b/c/
diff --git a/shell/hush_test/hush-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.tests b/shell/hush_test/hush-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.tests
new file mode 100755
index 000000000..fb9371467
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-do-not-quote-backslashes-in-parameter-expansions-outside-quotes.tests
@@ -0,0 +1,3 @@
+a=/b/c/*
+b=\\
+echo ${a%$b*}
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-1.right b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-1.right
new file mode 100644
index 000000000..2da327222
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-1.right
@@ -0,0 +1 @@
+a_\_z_c
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-1.tests b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-1.tests
new file mode 100755
index 000000000..e4529c631
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-1.tests
@@ -0,0 +1,2 @@
+v="a\bc"
+echo ${v/\\b/_\\_\z_}
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-2.right b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-2.right
new file mode 100644
index 000000000..7447c0a04
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-2.right
@@ -0,0 +1 @@
+ax/yc
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-2.tests b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-2.tests
new file mode 100755
index 000000000..2db1db897
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-2.tests
@@ -0,0 +1,2 @@
+v="abc"
+echo ${v/b/x/y}
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-3.right b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-3.right
new file mode 100644
index 000000000..5ea5ff892
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-3.right
@@ -0,0 +1 @@
+axcabc
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-3.tests b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-3.tests
new file mode 100755
index 000000000..0935e4509
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-3.tests
@@ -0,0 +1,2 @@
+v="abcabc"
+echo ${v/b/x}
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-4.right b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-4.right
new file mode 100644
index 000000000..46dd750c1
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-4.right
@@ -0,0 +1 @@
+axcaxc
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-4.tests b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-4.tests
new file mode 100755
index 000000000..d8de84347
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-4.tests
@@ -0,0 +1,2 @@
+v="abcabc"
+echo ${v//b/x}
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-5.right b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-5.right
new file mode 100644
index 000000000..699b27b0c
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-5.right
@@ -0,0 +1 @@
+axc
diff --git a/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-5.tests b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-5.tests
new file mode 100755
index 000000000..552388877
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-pattern-replacement-in-parameter-expansion-5.tests
@@ -0,0 +1,2 @@
+v="ab/c"
+echo ${v/b\//x}
diff --git a/shell/hush_test/hush-vars/var-runtime-quote-detection.right b/shell/hush_test/hush-vars/var-runtime-quote-detection.right
new file mode 100644
index 000000000..b554d9e46
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-runtime-quote-detection.right
@@ -0,0 +1 @@
+<>
diff --git a/shell/hush_test/hush-vars/var-runtime-quote-detection.tests b/shell/hush_test/hush-vars/var-runtime-quote-detection.tests
new file mode 100755
index 000000000..e570631fd
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-runtime-quote-detection.tests
@@ -0,0 +1 @@
+foo=\\ echo "<${foo#[\\]}>"