63 files changed, 1575 insertions, 464 deletions

diff --git a/shell/Config.src b/shell/Config.src
index 81c4ec874..959d3cb42 100644
--- a/shell/Config.src
+++ b/shell/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Shells"
diff --git a/shell/ash.c b/shell/ash.c
index 7fa9dae21..4bd1c2c9d 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -8929,7 +8929,8 @@ describe_command(char *command, const char *path, int describe_command_verbose)
 
         case CMDFUNCTION:
                 if (describe_command_verbose) {
-                        out1str(" is a shell function");
+                        /*out1str(" is a shell function");*/
+                        out1str(" is a function"); /* bash says this */
                 } else {
                         out1str(command);
                 }
diff --git a/shell/ash_test/ash-glob/glob_altvalue1.right b/shell/ash_test/ash-glob/glob_altvalue1.right
new file mode 100644
index 000000000..bd3592229
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_altvalue1.right
@@ -0,0 +1,7 @@
+1u: glob_altvalue1.tests
+2u: glob_altvalue1.t*
+3u: glob_altvalue1.t*
+4u: glob_altvalue1.t*
+1q: glob_altvalue1.t*
+2q: 'glob_altvalue1.t*'
+3q: glob_altvalue1.t*
diff --git a/shell/ash_test/ash-glob/glob_altvalue1.tests b/shell/ash_test/ash-glob/glob_altvalue1.tests
new file mode 100755
index 000000000..5483d63e6
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_altvalue1.tests
@@ -0,0 +1,13 @@
+x=x
+
+echo 1u: ${x:+glob_altvalue1.t*}
+echo 2u: ${x:+'glob_altvalue1.t*'}
+echo 3u: ${x:+"glob_altvalue1.t*"}
+echo 4u: ${x:+glob_altvalue1.t\*}
+##echo 5u: ${x:+"glob_altvalue1.t\*"}
+
+echo 1q: "${x:+glob_altvalue1.t*}"
+echo 2q: "${x:+'glob_altvalue1.t*'}"
+echo 3q: "${x:+"glob_altvalue1.t*"}"
+##echo 4q: "${x:+glob_altvalue1.t\*}"
+##echo 5q: "${x:+"glob_altvalue1.t\*"}"
diff --git a/shell/ash_test/ash-heredoc/heredoc.right b/shell/ash_test/ash-heredoc/heredoc.right
index baf115166..85d36dae9 100644
--- a/shell/ash_test/ash-heredoc/heredoc.right
+++ b/shell/ash_test/ash-heredoc/heredoc.right
@@ -16,6 +16,6 @@ tab 3
 abc
 def ghi
 jkl mno
-fff is a shell function
+fff is a function
 hi
 there
diff --git a/shell/ash_test/ash-heredoc/heredocA.right b/shell/ash_test/ash-heredoc/heredocA.right
new file mode 100644
index 000000000..7326d9603
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredocA.right
@@ -0,0 +1 @@
+Ok
diff --git a/shell/ash_test/ash-heredoc/heredocA.tests b/shell/ash_test/ash-heredoc/heredocA.tests
new file mode 100755
index 000000000..440aaf906
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredocA.tests
@@ -0,0 +1,4 @@
+{ cat <<EOF ;
+Ok
+EOF
+}
diff --git a/shell/ash_test/ash-heredoc/heredocB.right b/shell/ash_test/ash-heredoc/heredocB.right
new file mode 100644
index 000000000..43ba0b4f9
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredocB.right
@@ -0,0 +1,3 @@
+one - alpha
+two - beta
+three - gamma
diff --git a/shell/ash_test/ash-heredoc/heredocB.tests b/shell/ash_test/ash-heredoc/heredocB.tests
new file mode 100755
index 000000000..45ea4687f
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredocB.tests
@@ -0,0 +1,12 @@
+while read line1; do
+        read line2 <&3
+        echo $line1 - $line2
+done <<EOF1 3<<EOF2
+one
+two
+three
+EOF1
+alpha
+beta
+gamma
+EOF2
diff --git a/shell/ash_test/ash-heredoc/heredoc_after_compound1.right b/shell/ash_test/ash-heredoc/heredoc_after_compound1.right
new file mode 100644
index 000000000..9052f7d1f
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_after_compound1.right
@@ -0,0 +1,2 @@
+Ok1
+Ok2
diff --git a/shell/ash_test/ash-heredoc/heredoc_after_compound1.tests b/shell/ash_test/ash-heredoc/heredoc_after_compound1.tests
new file mode 100755
index 000000000..e7cfb5be1
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_after_compound1.tests
@@ -0,0 +1,3 @@
+{ cat <<EOF; }; echo Ok2
+Ok1
+EOF
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.right b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.tests b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.tests
new file mode 100755
index 000000000..1d2a26504
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+Ok1
+EO\
+F
diff --git a/shell/ash_test/ash-heredoc/heredoc_empty3.right b/shell/ash_test/ash-heredoc/heredoc_empty3.right
new file mode 100644
index 000000000..0b54a9c93
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_empty3.right
@@ -0,0 +1,2 @@
+
+Ok
diff --git a/shell/ash_test/ash-heredoc/heredoc_empty3.tests b/shell/ash_test/ash-heredoc/heredoc_empty3.tests
new file mode 100755
index 000000000..828c2dd89
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_empty3.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+
+Ok
+EOF
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue1.right b/shell/ash_test/ash-quoting/dollar_altvalue1.right
new file mode 100644
index 000000000..5cd495d3b
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue1.right
@@ -0,0 +1,16 @@
+Unquoted b c d
+|b|
+|c|
+|d|
+Unquoted 'b c' d
+|b c|
+|d|
+Unquoted "b c" d
+|b c|
+|d|
+Quoted b c d
+|b c d|
+Quoted 'b c' d
+|'b c' d|
+Quoted "b c" d
+|b c d|
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue1.tests b/shell/ash_test/ash-quoting/dollar_altvalue1.tests
new file mode 100755
index 000000000..f4dc8caec
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue1.tests
@@ -0,0 +1,16 @@
+f() { for i; do echo "|$i|"; done; }
+x=a
+
+echo Unquoted b c d
+f ${x:+b c d}
+echo Unquoted "'b c' d"
+f ${x:+'b c' d}
+echo Unquoted '"b c" d'
+f ${x:+"b c" d}
+
+echo Quoted b c d
+f "${x:+b c d}"
+echo Quoted "'b c' d"
+f "${x:+'b c' d}"
+echo Quoted '"b c" d'
+f "${x:+"b c" d}"
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue2.right b/shell/ash_test/ash-quoting/dollar_altvalue2.right
new file mode 100644
index 000000000..7cf37e379
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue2.right
@@ -0,0 +1,69 @@
+Unquoted '':
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+||
+end
+
+Unquoted "":
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+||
+end
+
+Quoted '':
+start:
+|''|
+end
+start:
+|'' |
+end
+start:
+| ''|
+end
+start:
+| '' |
+end
+start:
+|'' ''|
+end
+
+Quoted "":
+start:
+||
+end
+start:
+| |
+end
+start:
+| |
+end
+start:
+|  |
+end
+start:
+| |
+end
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue2.tests b/shell/ash_test/ash-quoting/dollar_altvalue2.tests
new file mode 100755
index 000000000..3377eb27f
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue2.tests
@@ -0,0 +1,33 @@
+f() { echo start:; for i; do echo "|$i|"; done; echo end; }
+x=a
+
+echo "Unquoted '':"
+f ${x:+''}
+f ${x:+'' }
+f ${x:+ ''}
+f ${x:+ '' }
+f ${x:+'' ''}
+
+echo
+echo 'Unquoted "":'
+f ${x:+""}
+f ${x:+"" }
+f ${x:+ ""}
+f ${x:+ "" }
+f ${x:+"" ""}
+
+echo
+echo "Quoted '':"
+f "${x:+''}"
+f "${x:+'' }"
+f "${x:+ ''}"
+f "${x:+ '' }"
+f "${x:+'' ''}"
+
+echo
+echo 'Quoted "":'
+f "${x:+""}"
+f "${x:+"" }"
+f "${x:+ ""}"
+f "${x:+ "" }"
+f "${x:+"" ""}"
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue9.right b/shell/ash_test/ash-quoting/dollar_altvalue9.right
new file mode 100644
index 000000000..39342fe7c
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue9.right
@@ -0,0 +1,26 @@
+Unquoted 1:
+|a|
+|x y|
+|1|
+|2|
+||
+|1 2|
+|A|
+|B|
+|C D|
+|zb|
+Quoted 1:
+|a 'x y' 1 2 ''  1 2 A B C D zb|
+Unquoted 2:
+|ax y|
+|1|
+|2|
+||
+|1 2|
+|A|
+|B|
+|C D|
+|z|
+|b|
+Quoted 2:
+|a 'x y' 1 2 ''  1 2 A B C D z b|
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue9.tests b/shell/ash_test/ash-quoting/dollar_altvalue9.tests
new file mode 100755
index 000000000..27a6f4f3c
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue9.tests
@@ -0,0 +1,17 @@
+f() { for i; do echo "|$i|"; done; }
+
+echo Unquoted 1:
+x='1 2'; f a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z}b
+echo Quoted 1:
+x='1 2'; f "a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z}b"
+
+echo Unquoted 2:
+x='1 2'; f a${x:+'x y' $x ''  "$x" `echo A B` "`echo C D`" z }b
+echo Quoted 2:
+x='1 2'; f "a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z }b"
+
+#echo Unquoted 3:
+#e=
+#x='1 2'; f a${x:+'x y' $x ''  "$x" $e $e "$e" $e `echo A B` "`echo C D`" z }b
+#echo Quoted 3:
+#x='1 2'; f "a${x:+ 'x y' $x ''  "$x" $e $e "$e" $e `echo A B` "`echo C D`" z }b"
diff --git a/shell/ash_test/ash-quoting/dollar_repl_bash1.right b/shell/ash_test/ash-quoting/dollar_repl_bash1.right
new file mode 100644
index 000000000..f5e9309f4
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_repl_bash1.right
@@ -0,0 +1,14 @@
+|y|
+|zx|
+|y|
+|zx|
+|y zx|
+|y zx|
+|y|
+|zy|
+|z|
+|y|
+|zy|
+|z|
+|y zy z|
+|y zy z|
diff --git a/shell/ash_test/ash-quoting/dollar_repl_bash1.tests b/shell/ash_test/ash-quoting/dollar_repl_bash1.tests
new file mode 100755
index 000000000..912635925
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_repl_bash1.tests
@@ -0,0 +1,12 @@
+f() { for i; do echo "|$i|"; done; }
+v=xx
+
+f ${v/'x'/"y z"}
+f ${v/"x"/'y z'}
+f "${v/'x'/"y z"}"
+f "${v/"x"/'y z'}"
+
+f ${v//'x'/"y z"}
+f ${v//"x"/'y z'}
+f "${v//'x'/"y z"}"
+f "${v//"x"/'y z'}"
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp.right b/shell/ash_test/ash-quoting/squote_in_varexp.right
index a75c0bfd6..4a457021b 100644
--- a/shell/ash_test/ash-quoting/squote_in_varexp.right
+++ b/shell/ash_test/ash-quoting/squote_in_varexp.right
@@ -1,5 +1,9 @@
 z
 z
+z
+z
+y
+y
 y
 y
 Ok:0
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp.tests b/shell/ash_test/ash-quoting/squote_in_varexp.tests
index a2d05a246..4afc52107 100755
--- a/shell/ash_test/ash-quoting/squote_in_varexp.tests
+++ b/shell/ash_test/ash-quoting/squote_in_varexp.tests
@@ -1,6 +1,10 @@
 x=yz
 echo ${x#'y'}
 echo "${x#'y'}"
+echo ${x#"y"}
+echo "${x#"y"}"
 echo ${x%'z'}
 echo "${x%'z'}"
+echo ${x%"z"}
+echo "${x%"z"}"
 echo Ok:$?
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp2.right b/shell/ash_test/ash-quoting/squote_in_varexp2.right
index 9d0add3c5..d03047024 100644
--- a/shell/ash_test/ash-quoting/squote_in_varexp2.right
+++ b/shell/ash_test/ash-quoting/squote_in_varexp2.right
@@ -1,3 +1,5 @@
 Nothing:
 Nothing:
+Nothing:
+Nothing:
 Ok:0
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp2.tests b/shell/ash_test/ash-quoting/squote_in_varexp2.tests
index 806ad12b9..2797725cc 100755
--- a/shell/ash_test/ash-quoting/squote_in_varexp2.tests
+++ b/shell/ash_test/ash-quoting/squote_in_varexp2.tests
@@ -1,4 +1,6 @@
 x='\\\\'
 printf Nothing:'%s\n' ${x#'\\\\'}
 printf Nothing:'%s\n' "${x#'\\\\'}"
+printf Nothing:'%s\n' ${x#"\\\\\\\\"}
+printf Nothing:'%s\n' "${x#"\\\\\\\\"}"
 echo Ok:$?
diff --git a/shell/ash_test/ash-redir/redir_script.tests b/shell/ash_test/ash-redir/redir_script.tests
index 740daa461..a8d93ce4f 100755
--- a/shell/ash_test/ash-redir/redir_script.tests
+++ b/shell/ash_test/ash-redir/redir_script.tests
@@ -27,6 +27,10 @@ test x"$fds1" = x"$fds" \
 test x"$fds1" = x" 10>&- 3>&-" && \
 test x"$fds"  = x" 11>&- 3>&-" \
 && { echo "Ok: script fd is not closed"; exit 0; }
+# or we see that fd 3 moved to fd 10:
+test x"$fds1" = x" 3>&- 4>&-" && \
+test x"$fds"  = x" 10>&- 3>&-" \
+&& { echo "Ok: script fd is not closed"; exit 0; }
 
 echo "Bug: script fd is closed"
 echo "fds1:$fds1"
diff --git a/shell/ash_test/ash-z_slow/many_ifs.tests b/shell/ash_test/ash-z_slow/many_ifs.tests
index 1f5b1b3a6..cf9a89874 100755
--- a/shell/ash_test/ash-z_slow/many_ifs.tests
+++ b/shell/ash_test/ash-z_slow/many_ifs.tests
@@ -229,8 +229,8 @@ do
                                                 '')     split "$d0$f1$d1$f2$d2$f3$d3" "[2]($f1)($f2)" "($f1)($f2)" ;;
                                                 ' ')    ;;
                                                 *)      x=$f2$d2$f3$d3
-                                                        x=${x# } #was x=${x#' '} hush needs fixing for this to work
-                                                        x=${x% } #was x=${x%' '}
+                                                        x=${x#' '}
+                                                        x=${x%' '}
                                                         split "$d0$f1$d1$f2$d2$f3$d3" "[3]($f1)($f2)($f3)" "($f1)($x)"
                                                         ;;
                                                 esac
diff --git a/shell/hush.c b/shell/hush.c
index c77700175..e3c6e2de9 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -357,6 +357,9 @@
 #else
 # define CLEAR_RANDOM_T(rnd) ((void)0)
 #endif
+#ifndef O_CLOEXEC
+# define O_CLOEXEC 0
+#endif
 #ifndef F_DUPFD_CLOEXEC
 # define F_DUPFD_CLOEXEC F_DUPFD
 #endif
@@ -439,21 +442,22 @@
 
 /* If you comment out one of these below, it will be #defined later
  * to perform debug printfs to stderr: */
-#define debug_printf(...)        do {} while (0)
+#define debug_printf(...)         do {} while (0)
 /* Finer-grained debug switches */
-#define debug_printf_parse(...)  do {} while (0)
-#define debug_print_tree(a, b)   do {} while (0)
-#define debug_printf_exec(...)   do {} while (0)
-#define debug_printf_env(...)    do {} while (0)
-#define debug_printf_jobs(...)   do {} while (0)
-#define debug_printf_expand(...) do {} while (0)
-#define debug_printf_varexp(...) do {} while (0)
-#define debug_printf_glob(...)   do {} while (0)
-#define debug_printf_redir(...)  do {} while (0)
-#define debug_printf_list(...)   do {} while (0)
-#define debug_printf_subst(...)  do {} while (0)
-#define debug_printf_prompt(...) do {} while (0)
-#define debug_printf_clean(...)  do {} while (0)
+#define debug_printf_parse(...)   do {} while (0)
+#define debug_printf_heredoc(...) do {} while (0)
+#define debug_print_tree(a, b)    do {} while (0)
+#define debug_printf_exec(...)    do {} while (0)
+#define debug_printf_env(...)     do {} while (0)
+#define debug_printf_jobs(...)    do {} while (0)
+#define debug_printf_expand(...)  do {} while (0)
+#define debug_printf_varexp(...)  do {} while (0)
+#define debug_printf_glob(...)    do {} while (0)
+#define debug_printf_redir(...)   do {} while (0)
+#define debug_printf_list(...)    do {} while (0)
+#define debug_printf_subst(...)   do {} while (0)
+#define debug_printf_prompt(...)  do {} while (0)
+#define debug_printf_clean(...)   do {} while (0)
 
 #define ERR_PTR ((void*)(long)1)
 
@@ -534,6 +538,7 @@ typedef struct o_string {
          * possibly empty one: word"", wo''rd etc. */
         smallint has_quoted_part;
         smallint has_empty_slot;
+        smallint ended_in_ifs;
 } o_string;
 enum {
         EXP_FLAG_SINGLEWORD     = 0x80, /* must be 0x80 */
@@ -554,11 +559,27 @@ static const char *const assignment_flag[] = {
 };
 #endif
 
+/* We almost can use standard FILE api, but we need an ability to move
+ * its fd when redirects coincide with it. No api exists for that
+ * (RFE for it at https://sourceware.org/bugzilla/show_bug.cgi?id=21902).
+ * HFILE is our internal alternative. Only supports reading.
+ * Since we now can, we incorporate linked list of all opened HFILEs
+ * into the struct (used to be a separate mini-list).
+ */
+typedef struct HFILE {
+        char *cur;
+        char *end;
+        struct HFILE *next_hfile;
+        int is_stdin;
+        int fd;
+        char buf[1024];
+} HFILE;
+
 typedef struct in_str {
         const char *p;
         int peek_buf[2];
         int last_char;
-        FILE *file;
+        HFILE *file;
 } in_str;
 
 /* The descrip member of this structure is only used to make
@@ -812,14 +833,6 @@ enum {
         NUM_OPT_O
 };
 
-
-struct FILE_list {
-        struct FILE_list *next;
-        FILE *fp;
-        int fd;
-};
-
-
 /* "Globals" within this file */
 /* Sorted roughly by size (smaller offsets == smaller code) */
 struct globals {
@@ -952,7 +965,7 @@ struct globals {
         unsigned lineno;
         char *lineno_var;
 #endif
-        struct FILE_list *FILE_list;
+        HFILE *HFILE_list;
         /* Which signals have non-DFL handler (even with no traps set)?
          * Set at the start to:
          * (SIGQUIT + maybe SPECIAL_INTERACTIVE_SIGS + maybe SPECIAL_JOBSTOP_SIGS)
@@ -1218,6 +1231,10 @@ static const struct built_in_command bltins2[] = {
 # define debug_printf_parse(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
+#ifndef debug_printf_heredoc
+# define debug_printf_heredoc(...) (indent(), fdprintf(2, __VA_ARGS__))
+#endif
+
 #ifndef debug_printf_exec
 #define debug_printf_exec(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
@@ -1557,83 +1574,115 @@ static int xdup_CLOEXEC_and_close(int fd, int avoid_fd)
 }
 
 
-/* Manipulating the list of open FILEs */
-static FILE *remember_FILE(FILE *fp)
+/* Manipulating HFILEs */
+static HFILE *hfopen(const char *name)
 {
-        if (fp) {
-                struct FILE_list *n = xmalloc(sizeof(*n));
-                n->next = G.FILE_list;
-                G.FILE_list = n;
-                n->fp = fp;
-                n->fd = fileno(fp);
-                close_on_exec_on(n->fd);
+        HFILE *fp;
+        int fd;
+
+        fd = STDIN_FILENO;
+        if (name) {
+                fd = open(name, O_RDONLY | O_CLOEXEC);
+                if (fd < 0)
+                        return NULL;
+                if (O_CLOEXEC == 0) /* ancient libc */
+                        close_on_exec_on(fd);
         }
+
+        fp = xmalloc(sizeof(*fp));
+        fp->is_stdin = (name == NULL);
+        fp->fd = fd;
+        fp->cur = fp->end = fp->buf;
+        fp->next_hfile = G.HFILE_list;
+        G.HFILE_list = fp;
         return fp;
 }
-static void fclose_and_forget(FILE *fp)
+static void hfclose(HFILE *fp)
 {
-        struct FILE_list **pp = &G.FILE_list;
+        HFILE **pp = &G.HFILE_list;
         while (*pp) {
-                struct FILE_list *cur = *pp;
-                if (cur->fp == fp) {
-                        *pp = cur->next;
-                        free(cur);
+                HFILE *cur = *pp;
+                if (cur == fp) {
+                        *pp = cur->next_hfile;
                         break;
                 }
-                pp = &cur->next;
+                pp = &cur->next_hfile;
         }
-        fclose(fp);
+        if (fp->fd >= 0)
+                close(fp->fd);
+        free(fp);
 }
-static int save_FILEs_on_redirect(int fd, int avoid_fd)
+static int refill_HFILE_and_getc(HFILE *fp)
 {
-        struct FILE_list *fl = G.FILE_list;
+        int n;
+
+        if (fp->fd < 0) {
+                /* Already saw EOF */
+                return EOF;
+        }
+        /* Try to buffer more input */
+        fp->cur = fp->buf;
+        n = safe_read(fp->fd, fp->buf, sizeof(fp->buf));
+        if (n < 0) {
+                bb_perror_msg("read error");
+                n = 0;
+        }
+        fp->end = fp->buf + n;
+        if (n == 0) {
+                /* EOF/error */
+                close(fp->fd);
+                fp->fd = -1;
+                return EOF;
+        }
+        return (unsigned char)(*fp->cur++);
+}
+/* Inlined for common case of non-empty buffer.
+ */
+static ALWAYS_INLINE int hfgetc(HFILE *fp)
+{
+        if (fp->cur < fp->end)
+                return (unsigned char)(*fp->cur++);
+        /* Buffer empty */
+        return refill_HFILE_and_getc(fp);
+}
+static int move_HFILEs_on_redirect(int fd, int avoid_fd)
+{
+        HFILE *fl = G.HFILE_list;
         while (fl) {
                 if (fd == fl->fd) {
                         /* We use it only on script files, they are all CLOEXEC */
                         fl->fd = xdup_CLOEXEC_and_close(fd, avoid_fd);
                         debug_printf_redir("redirect_fd %d: matches a script fd, moving it to %d\n", fd, fl->fd);
-                        return 1;
+                        return 1; /* "found and moved" */
                 }
-                fl = fl->next;
-        }
-        return 0;
-}
-static void restore_redirected_FILEs(void)
-{
-        struct FILE_list *fl = G.FILE_list;
-        while (fl) {
-                int should_be = fileno(fl->fp);
-                if (fl->fd != should_be) {
-                        debug_printf_redir("restoring script fd from %d to %d\n", fl->fd, should_be);
-                        xmove_fd(fl->fd, should_be);
-                        fl->fd = should_be;
-                }
-                fl = fl->next;
+                fl = fl->next_hfile;
         }
+        return 0; /* "not in the list" */
 }
 #if ENABLE_FEATURE_SH_STANDALONE && BB_MMU
-static void close_all_FILE_list(void)
+static void close_all_HFILE_list(void)
 {
-        struct FILE_list *fl = G.FILE_list;
+        HFILE *fl = G.HFILE_list;
         while (fl) {
-                /* fclose would also free FILE object.
+                /* hfclose would also free HFILE object.
                  * It is disastrous if we share memory with a vforked parent.
                  * I'm not sure we never come here after vfork.
                  * Therefore just close fd, nothing more.
                  */
-                /*fclose(fl->fp); - unsafe */
-                close(fl->fd);
-                fl = fl->next;
+                /*hfclose(fl); - unsafe */
+                if (fl->fd >= 0)
+                        close(fl->fd);
+                fl = fl->next_hfile;
         }
 }
 #endif
-static int fd_in_FILEs(int fd)
+static int fd_in_HFILEs(int fd)
 {
-        struct FILE_list *fl = G.FILE_list;
+        HFILE *fl = G.HFILE_list;
         while (fl) {
                 if (fl->fd == fd)
                         return 1;
-                fl = fl->next;
+                fl = fl->next_hfile;
         }
         return 0;
 }
@@ -2333,6 +2382,7 @@ static void set_pwd_var(unsigned flag)
         set_local_var(xasprintf("PWD=%s", get_cwd(/*force:*/ 1)), flag);
 }
 
+#if ENABLE_HUSH_UNSET || ENABLE_HUSH_GETOPTS
 static int unset_local_var_len(const char *name, int name_len)
 {
         struct variable *cur;
@@ -2366,14 +2416,14 @@ static int unset_local_var_len(const char *name, int name_len)
         return EXIT_SUCCESS;
 }
 
-#if ENABLE_HUSH_UNSET || ENABLE_HUSH_GETOPTS
 static int unset_local_var(const char *name)
 {
         return unset_local_var_len(name, strlen(name));
 }
 #endif
 
-#if BASH_HOSTNAME_VAR || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_READ || ENABLE_HUSH_GETOPTS
+#if BASH_HOSTNAME_VAR || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_READ || ENABLE_HUSH_GETOPTS \
+ || (ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT)
 static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
 {
         char *var = xasprintf("%s=%s", name, val);
@@ -2422,35 +2472,33 @@ static void set_vars_and_save_old(char **strings)
                 char *eq;
 
                 eq = strchr(*s, '=');
-                if (eq) {
-                        var_pp = get_ptr_to_local_var(*s, eq - *s);
-                        if (var_pp) {
-                                var_p = *var_pp;
-                                if (var_p->flg_read_only) {
-                                        char **p;
-                                        bb_error_msg("%s: readonly variable", *s);
-                                        /*
-                                         * "VAR=V BLTIN" unsets VARs after BLTIN completes.
-                                         * If VAR is readonly, leaving it in the list
-                                         * after asssignment error (msg above)
-                                         * causes doubled error message later, on unset.
-                                         */
-                                        debug_printf_env("removing/freeing '%s' element\n", *s);
-                                        free(*s);
-                                        p = s;
-                                        do { *p = p[1]; p++; } while (*p);
-                                        goto next;
-                                }
-                                /* below, set_local_var() with nest level will
-                                 * "shadow" (remove) this variable from
-                                 * global linked list.
-                                 */
-                        }
-                        debug_printf_env("%s: env override '%s'/%u\n", __func__, *s, G.var_nest_level);
-                        set_local_var(*s, (G.var_nest_level << SETFLAG_VARLVL_SHIFT) | SETFLAG_EXPORT);
-                } else if (HUSH_DEBUG) {
+                if (HUSH_DEBUG && !eq)
                         bb_error_msg_and_die("BUG in varexp4");
+                var_pp = get_ptr_to_local_var(*s, eq - *s);
+                if (var_pp) {
+                        var_p = *var_pp;
+                        if (var_p->flg_read_only) {
+                                char **p;
+                                bb_error_msg("%s: readonly variable", *s);
+                                /*
+                                 * "VAR=V BLTIN" unsets VARs after BLTIN completes.
+                                 * If VAR is readonly, leaving it in the list
+                                 * after asssignment error (msg above)
+                                 * causes doubled error message later, on unset.
+                                 */
+                                debug_printf_env("removing/freeing '%s' element\n", *s);
+                                free(*s);
+                                p = s;
+                                do { *p = p[1]; p++; } while (*p);
+                                goto next;
+                        }
+                        /* below, set_local_var() with nest level will
+                         * "shadow" (remove) this variable from
+                         * global linked list.
+                         */
                 }
+                debug_printf_env("%s: env override '%s'/%u\n", __func__, *s, G.var_nest_level);
+                set_local_var(*s, (G.var_nest_level << SETFLAG_VARLVL_SHIFT) | SETFLAG_EXPORT);
                 s++;
  next: ;
         }
@@ -2469,7 +2517,7 @@ static void reinit_unicode_for_hush(void)
          */
         if (ENABLE_FEATURE_CHECK_UNICODE_IN_ENV
          || ENABLE_UNICODE_USING_LOCALE
-        ) {
+        ) {
                 const char *s = get_local_var_value("LC_ALL");
                 if (!s) s = get_local_var_value("LC_CTYPE");
                 if (!s) s = get_local_var_value("LANG");
@@ -2575,7 +2623,7 @@ static int get_user_input(struct in_str *i)
                 }
                 fflush_all();
 //FIXME: here ^C or SIGINT will have effect only after <Enter>
-                r = fgetc(i->file);
+                r = hfgetc(i->file);
                 /* In !ENABLE_FEATURE_EDITING we don't use read_line_input,
                  * no ^C masking happens during fgetc, no special code for ^C:
                  * it generates SIGINT as usual.
@@ -2595,22 +2643,22 @@ static int fgetc_interactive(struct in_str *i)
 {
         int ch;
         /* If it's interactive stdin, get new line. */
-        if (G_interactive_fd && i->file == stdin) {
+        if (G_interactive_fd && i->file->is_stdin) {
                 /* Returns first char (or EOF), the rest is in i->p[] */
                 ch = get_user_input(i);
                 G.promptmode = 1; /* PS2 */
                 debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
         } else {
                 /* Not stdin: script file, sourced file, etc */
-                do ch = fgetc(i->file); while (ch == '\0');
+                do ch = hfgetc(i->file); while (ch == '\0');
         }
         return ch;
 }
 #else
-static inline int fgetc_interactive(struct in_str *i)
+static ALWAYS_INLINE int fgetc_interactive(struct in_str *i)
 {
         int ch;
-        do ch = fgetc(i->file); while (ch == '\0');
+        do ch = hfgetc(i->file); while (ch == '\0');
         return ch;
 }
 #endif  /* INTERACTIVE */
@@ -2725,7 +2773,7 @@ static int i_peek2(struct in_str *i)
         ch = i->peek_buf[1];
         if (ch == 0) {
                 /* We did not read it yet, get it now */
-                do ch = fgetc(i->file); while (ch == '\0');
+                do ch = hfgetc(i->file); while (ch == '\0');
                 i->peek_buf[1] = ch;
         }
 
@@ -2769,10 +2817,10 @@ static int i_peek_and_eat_bkslash_nl(struct in_str *input)
         }
 }
 
-static void setup_file_in_str(struct in_str *i, FILE *f)
+static void setup_file_in_str(struct in_str *i, HFILE *fp)
 {
         memset(i, 0, sizeof(*i));
-        i->file = f;
+        i->file = fp;
         /* i->p = NULL; */
 }
 
@@ -2797,13 +2845,13 @@ static void o_reset_to_empty_unquoted(o_string *o)
                 o->data[0] = '\0';
 }
 
-static void o_free(o_string *o)
+static void o_free_and_set_NULL(o_string *o)
 {
         free(o->data);
         memset(o, 0, sizeof(*o));
 }
 
-static ALWAYS_INLINE void o_free_unsafe(o_string *o)
+static ALWAYS_INLINE void o_free(o_string *o)
 {
         free(o->data);
 }
@@ -3342,7 +3390,6 @@ static char **o_finalize_list(o_string *o, int n)
         char **list;
         int string_start;
 
-        n = o_save_ptr(o, n); /* force growth for list[n] if necessary */
         if (DEBUG_EXPAND)
                 debug_print_list("finalized", o, n);
         debug_printf_expand("finalized n:%d\n", n);
@@ -3530,6 +3577,8 @@ static void debug_print_tree(struct pipe *pi, int lvl)
                                 fdprintf(2, " '%s'", *argv);
                                 argv++;
                         }
+                        if (command->redirects)
+                                fdprintf(2, " {redir}");
                         fdprintf(2, "\n");
                         prn++;
                 }
@@ -3853,7 +3902,7 @@ static const struct reserved_combo* reserved_word(struct parse_context *ctx)
                         int len = old->as_string.length;
                         /* Concatenate halves */
                         o_addstr(&old->as_string, ctx->as_string.data);
-                        o_free_unsafe(&ctx->as_string);
+                        o_free(&ctx->as_string);
                         /* Find where leading keyword starts in first half */
                         str = old->as_string.data + len;
                         if (str > old->as_string.data)
@@ -4227,6 +4276,14 @@ static char *fetch_till_str(o_string *as_string,
         int prev = 0; /* not \ */
         int ch;
 
+        /* Starting with "" is necessary for this case:
+         * cat <<EOF
+         *
+         * xxx
+         * EOF
+         */
+        heredoc.data = xzalloc(1); /* start as "", not as NULL */
+
         goto jump_in;
 
         while (1) {
@@ -4236,9 +4293,10 @@ static char *fetch_till_str(o_string *as_string,
                 if (ch == '\n' || ch == EOF) {
  check_heredoc_end:
                         if ((heredoc_flags & HEREDOC_QUOTED) || prev != '\\') {
+                                /* End-of-line, and not a line continuation */
                                 if (strcmp(heredoc.data + past_EOL, word) == 0) {
                                         heredoc.data[past_EOL] = '\0';
-                                        debug_printf_parse("parsed heredoc '%s'\n", heredoc.data);
+                                        debug_printf_heredoc("parsed '%s' heredoc '%s'\n", word, heredoc.data);
                                         return heredoc.data;
                                 }
                                 if (ch == '\n') {
@@ -4261,17 +4319,32 @@ static char *fetch_till_str(o_string *as_string,
                                         if (ch == '\n')
                                                 goto check_heredoc_end;
                                 }
+                        } else {
+                                /* Backslash-line continuation in an unquoted
+                                 * heredoc. This does not need special handling
+                                 * for heredoc body (unquoted heredocs are
+                                 * expanded on "execution" and that would take
+                                 * care of this case too), but not the case
+                                 * of line continuation *in terminator*:
+                                 *  cat <<EOF
+                                 *  Ok1
+                                 *  EO\
+                                 *  F
+                                 */
+                                heredoc.data[--heredoc.length] = '\0';
+                                prev = 0; /* not '\' */
+                                continue;
                         }
                 }
                 if (ch == EOF) {
-                        o_free_unsafe(&heredoc);
-                        return NULL;
+                        o_free(&heredoc);
+                        return NULL; /* error */
                 }
                 o_addchr(&heredoc, ch);
                 nommu_addchr(as_string, ch);
                 if (prev == '\\' && ch == '\\')
                         /* Correctly handle foo\\<eol> (not a line cont.) */
-                        prev = 0; /* not \ */
+                        prev = 0; /* not '\' */
                 else
                         prev = ch;
         }
@@ -4280,21 +4353,24 @@ static char *fetch_till_str(o_string *as_string,
 /* Look at entire parse tree for not-yet-loaded REDIRECT_HEREDOCs
  * and load them all. There should be exactly heredoc_cnt of them.
  */
-static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_str *input)
+#if BB_MMU
+#define fetch_heredocs(as_string, pi, heredoc_cnt, input) \
+        fetch_heredocs(pi, heredoc_cnt, input)
+#endif
+static int fetch_heredocs(o_string *as_string, struct pipe *pi, int heredoc_cnt, struct in_str *input)
 {
-        struct pipe *pi = ctx->list_head;
-
         while (pi && heredoc_cnt) {
                 int i;
                 struct command *cmd = pi->cmds;
 
-                debug_printf_parse("fetch_heredocs: num_cmds:%d cmd argv0:'%s'\n",
+                debug_printf_heredoc("fetch_heredocs: num_cmds:%d cmd argv0:'%s'\n",
                                 pi->num_cmds,
-                                cmd->argv ? cmd->argv[0] : "NONE");
+                                cmd->argv ? cmd->argv[0] : "NONE"
+                );
                 for (i = 0; i < pi->num_cmds; i++) {
                         struct redir_struct *redir = cmd->redirects;
 
-                        debug_printf_parse("fetch_heredocs: %d cmd argv0:'%s'\n",
+                        debug_printf_heredoc("fetch_heredocs: %d cmd argv0:'%s'\n",
                                         i, cmd->argv ? cmd->argv[0] : "NONE");
                         while (redir) {
                                 if (redir->rd_type == REDIRECT_HEREDOC) {
@@ -4302,11 +4378,11 @@ static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_
 
                                         redir->rd_type = REDIRECT_HEREDOC2;
                                         /* redir->rd_dup is (ab)used to indicate <<- */
-                                        p = fetch_till_str(&ctx->as_string, input,
+                                        p = fetch_till_str(as_string, input,
                                                         redir->rd_filename, redir->rd_dup);
                                         if (!p) {
                                                 syntax_error("unexpected EOF in here document");
-                                                return 1;
+                                                return -1;
                                         }
                                         free(redir->rd_filename);
                                         redir->rd_filename = p;
@@ -4314,31 +4390,36 @@ static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_
                                 }
                                 redir = redir->next;
                         }
+                        if (cmd->group) {
+                                //bb_error_msg("%s:%u heredoc_cnt:%d", __func__, __LINE__, heredoc_cnt);
+                                heredoc_cnt = fetch_heredocs(as_string, cmd->group, heredoc_cnt, input);
+                                //bb_error_msg("%s:%u heredoc_cnt:%d", __func__, __LINE__, heredoc_cnt);
+                                if (heredoc_cnt < 0)
+                                        return heredoc_cnt; /* error */
+                        }
                         cmd++;
                 }
                 pi = pi->next;
         }
-#if 0
-        /* Should be 0. If it isn't, it's a parse error */
-        if (heredoc_cnt)
-                bb_error_msg_and_die("heredoc BUG 2");
-#endif
-        return 0;
+        return heredoc_cnt;
 }
 
 
 static int run_list(struct pipe *pi);
 #if BB_MMU
-#define parse_stream(pstring, input, end_trigger) \
-        parse_stream(input, end_trigger)
+#define parse_stream(pstring, heredoc_cnt_ptr, input, end_trigger) \
+        parse_stream(heredoc_cnt_ptr, input, end_trigger)
 #endif
 static struct pipe *parse_stream(char **pstring,
+                int *heredoc_cnt_ptr,
                 struct in_str *input,
                 int end_trigger);
 
-
+/* Returns number of heredocs not yet consumed,
+ * or -1 on error.
+ */
 static int parse_group(struct parse_context *ctx,
-        struct in_str *input, int ch)
+                struct in_str *input, int ch)
 {
         /* ctx->word contains characters seen prior to ( or {.
          * Typically it's empty, but for function defs,
@@ -4349,6 +4430,7 @@ static int parse_group(struct parse_context *ctx,
         char *as_string = NULL;
 #endif
         struct pipe *pipe_list;
+        int heredoc_cnt = 0;
         int endch;
         struct command *command = ctx->command;
 
@@ -4357,12 +4439,12 @@ static int parse_group(struct parse_context *ctx,
         if (ch == '(' && !ctx->word.has_quoted_part) {
                 if (ctx->word.length)
                         if (done_word(ctx))
-                                return 1;
+                                return -1;
                 if (!command->argv)
                         goto skip; /* (... */
                 if (command->argv[1]) { /* word word ... (... */
                         syntax_error_unexpected_ch('(');
-                        return 1;
+                        return -1;
                 }
                 /* it is "word(..." or "word (..." */
                 do
@@ -4370,7 +4452,7 @@ static int parse_group(struct parse_context *ctx,
                 while (ch == ' ' || ch == '\t');
                 if (ch != ')') {
                         syntax_error_unexpected_ch(ch);
-                        return 1;
+                        return -1;
                 }
                 nommu_addchr(&ctx->as_string, ch);
                 do
@@ -4378,7 +4460,7 @@ static int parse_group(struct parse_context *ctx,
                 while (ch == ' ' || ch == '\t' || ch == '\n');
                 if (ch != '{' && ch != '(') {
                         syntax_error_unexpected_ch(ch);
-                        return 1;
+                        return -1;
                 }
                 nommu_addchr(&ctx->as_string, ch);
                 command->cmd_type = CMD_FUNCDEF;
@@ -4392,9 +4474,9 @@ static int parse_group(struct parse_context *ctx,
          || ctx->word.has_quoted_part /* ""{... */
         ) {
                 syntax_error(NULL);
-                debug_printf_parse("parse_group return 1: "
+                debug_printf_parse("parse_group return -1: "
                         "syntax error, groups and arglists don't mix\n");
-                return 1;
+                return -1;
         }
 #endif
 
@@ -4412,7 +4494,7 @@ static int parse_group(struct parse_context *ctx,
                  && ch != '('   /* but "{(..." is allowed (without whitespace) */
                 ) {
                         syntax_error_unexpected_ch(ch);
-                        return 1;
+                        return -1;
                 }
                 if (ch != '(') {
                         ch = i_getch(input);
@@ -4420,7 +4502,9 @@ static int parse_group(struct parse_context *ctx,
                 }
         }
 
-        pipe_list = parse_stream(&as_string, input, endch);
+        debug_printf_heredoc("calling parse_stream, heredoc_cnt:%d\n", heredoc_cnt);
+        pipe_list = parse_stream(&as_string, &heredoc_cnt, input, endch);
+        debug_printf_heredoc("parse_stream returned: heredoc_cnt:%d\n", heredoc_cnt);
 #if !BB_MMU
         if (as_string)
                 o_addstr(&ctx->as_string, as_string);
@@ -4431,9 +4515,9 @@ static int parse_group(struct parse_context *ctx,
                 /* parse_stream already emitted error msg */
                 if (!BB_MMU)
                         free(as_string);
-                debug_printf_parse("parse_group return 1: "
+                debug_printf_parse("parse_group return -1: "
                         "parse_stream returned %p\n", pipe_list);
-                return 1;
+                return -1;
         }
 #if !BB_MMU
         as_string[strlen(as_string) - 1] = '\0'; /* plink ')' or '}' */
@@ -4464,15 +4548,14 @@ static int parse_group(struct parse_context *ctx,
 
         command->group = pipe_list;
 
-        debug_printf_parse("parse_group return 0\n");
-        return 0;
+        debug_printf_parse("parse_group return %d\n", heredoc_cnt);
+        return heredoc_cnt;
         /* command remains "open", available for possible redirects */
 #undef as_string
 }
 
 #if ENABLE_HUSH_TICK || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_DOLLAR_OPS
 /* Subroutines for copying $(...) and `...` things */
-static int add_till_backquote(o_string *dest, struct in_str *input, int in_dquote);
 /* '...' */
 static int add_till_single_quote(o_string *dest, struct in_str *input)
 {
@@ -4487,7 +4570,21 @@ static int add_till_single_quote(o_string *dest, struct in_str *input)
                 o_addchr(dest, ch);
         }
 }
+static int add_till_single_quote_dquoted(o_string *dest, struct in_str *input)
+{
+        while (1) {
+                int ch = i_getch(input);
+                if (ch == EOF) {
+                        syntax_error_unterm_ch('\'');
+                        return 0;
+                }
+                if (ch == '\'')
+                        return 1;
+                o_addqchr(dest, ch);
+        }
+}
 /* "...\"...`..`...." - do we need to handle "...$(..)..." too? */
+static int add_till_backquote(o_string *dest, struct in_str *input, int in_dquote);
 static int add_till_double_quote(o_string *dest, struct in_str *input)
 {
         while (1) {
@@ -4577,7 +4674,9 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
 # endif
         end_ch &= (DOUBLE_CLOSE_CHAR_FLAG - 1);
 
+#if ENABLE_HUSH_INTERACTIVE
         G.promptmode = 1; /* PS2 */
+#endif
         debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
 
         while (1) {
@@ -4885,34 +4984,15 @@ static int parse_dollar(o_string *as_string,
 }
 
 #if BB_MMU
-# if BASH_PATTERN_SUBST
-#define encode_string(as_string, dest, input, dquote_end, process_bkslash) \
-        encode_string(dest, input, dquote_end, process_bkslash)
-# else
-/* only ${var/pattern/repl} (its pattern part) needs additional mode */
-#define encode_string(as_string, dest, input, dquote_end, process_bkslash) \
+#define encode_string(as_string, dest, input, dquote_end) \
         encode_string(dest, input, dquote_end)
-# endif
 #define as_string NULL
-
-#else /* !MMU */
-
-# if BASH_PATTERN_SUBST
-/* all parameters are needed, no macro tricks */
-# else
-#define encode_string(as_string, dest, input, dquote_end, process_bkslash) \
-        encode_string(as_string, dest, input, dquote_end)
-# endif
 #endif
 static int encode_string(o_string *as_string,
                 o_string *dest,
                 struct in_str *input,
-                int dquote_end,
-                int process_bkslash)
+                int dquote_end)
 {
-#if !BASH_PATTERN_SUBST
-        const int process_bkslash = 1;
-#endif
         int ch;
         int next;
 
@@ -4935,7 +5015,7 @@ static int encode_string(o_string *as_string,
         }
         debug_printf_parse("\" ch=%c (%d) escape=%d\n",
                         ch, ch, !!(dest->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
-        if (process_bkslash && ch == '\\') {
+        if (ch == '\\') {
                 if (next == EOF) {
                         /* Testcase: in interactive shell a file with
                          *  echo "unterminated string\<eof>
@@ -4995,6 +5075,7 @@ static int encode_string(o_string *as_string,
  * or return ERR_PTR.
  */
 static struct pipe *parse_stream(char **pstring,
+                int *heredoc_cnt_ptr,
                 struct in_str *input,
                 int end_trigger)
 {
@@ -5013,8 +5094,7 @@ static struct pipe *parse_stream(char **pstring,
         /* If very first arg is "" or '', ctx.word.data may end up NULL.
          * Preventing this:
          */
-        o_addchr(&ctx.word, '\0');
-        ctx.word.length = 0;
+        ctx.word.data = xzalloc(1); /* start as "", not as NULL */
 
         /* We used to separate words on $IFS here. This was wrong.
          * $IFS is used only for word splitting when $var is expanded,
@@ -5052,7 +5132,7 @@ static struct pipe *parse_stream(char **pstring,
                         if (done_word(&ctx)) {
                                 goto parse_error;
                         }
-                        o_free(&ctx.word);
+                        o_free_and_set_NULL(&ctx.word);
                         done_pipe(&ctx, PIPE_SEQ);
                         pi = ctx.list_head;
                         /* If we got nothing... */
@@ -5069,9 +5149,13 @@ static struct pipe *parse_stream(char **pstring,
                         if (pstring)
                                 *pstring = ctx.as_string.data;
                         else
-                                o_free_unsafe(&ctx.as_string);
+                                o_free(&ctx.as_string);
 #endif
+                        // heredoc_cnt must be 0 here anyway
+                        //if (heredoc_cnt_ptr)
+                        //      *heredoc_cnt_ptr = heredoc_cnt;
                         debug_leave();
+                        debug_printf_heredoc("parse_stream return heredoc_cnt:%d\n", heredoc_cnt);
                         debug_printf_parse("parse_stream return %p\n", pi);
                         return pi;
                 }
@@ -5198,7 +5282,9 @@ static struct pipe *parse_stream(char **pstring,
                                  * "case ... in <newline> word) ..."
                                  */
                                 if (IS_NULL_CMD(ctx.command)
-                                 && ctx.word.length == 0 && !ctx.word.has_quoted_part
+                                 && ctx.word.length == 0
+                                 && !ctx.word.has_quoted_part
+                                 && heredoc_cnt == 0
                                 ) {
                                         /* This newline can be ignored. But...
                                          * Without check #1, interactive shell
@@ -5226,12 +5312,11 @@ static struct pipe *parse_stream(char **pstring,
                                 }
                                 /* Treat newline as a command separator. */
                                 done_pipe(&ctx, PIPE_SEQ);
-                                debug_printf_parse("heredoc_cnt:%d\n", heredoc_cnt);
+                                debug_printf_heredoc("heredoc_cnt:%d\n", heredoc_cnt);
                                 if (heredoc_cnt) {
-                                        if (fetch_heredocs(heredoc_cnt, &ctx, input)) {
+                                        heredoc_cnt = fetch_heredocs(&ctx.as_string, ctx.list_head, heredoc_cnt, input);
+                                        if (heredoc_cnt != 0)
                                                 goto parse_error;
-                                        }
-                                        heredoc_cnt = 0;
                                 }
                                 ctx.is_assignment = MAYBE_ASSIGNMENT;
                                 debug_printf_parse("ctx.is_assignment='%s'\n", assignment_flag[ctx.is_assignment]);
@@ -5280,19 +5365,6 @@ static struct pipe *parse_stream(char **pstring,
                     )
 #endif
                 ) {
-                        if (heredoc_cnt) {
-                                /* This is technically valid:
-                                 * { cat <<HERE; }; echo Ok
-                                 * heredoc
-                                 * heredoc
-                                 * HERE
-                                 * but we don't support this.
-                                 * We require heredoc to be in enclosing {}/(),
-                                 * if any.
-                                 */
-                                syntax_error_unterm_str("here document");
-                                goto parse_error;
-                        }
                         if (done_word(&ctx)) {
                                 goto parse_error;
                         }
@@ -5303,13 +5375,13 @@ static struct pipe *parse_stream(char **pstring,
                         if (!HAS_KEYWORDS
                         IF_HAS_KEYWORDS(|| (ctx.ctx_res_w == RES_NONE && ctx.old_flag == 0))
                         ) {
-                                o_free(&ctx.word);
+                                o_free_and_set_NULL(&ctx.word);
 #if !BB_MMU
                                 debug_printf_parse("as_string2 '%s'\n", ctx.as_string.data);
                                 if (pstring)
                                         *pstring = ctx.as_string.data;
                                 else
-                                        o_free_unsafe(&ctx.as_string);
+                                        o_free(&ctx.as_string);
 #endif
                                 if (ch != ';' && IS_NULL_PIPE(ctx.list_head)) {
                                         /* Example: bare "{ }", "()" */
@@ -5317,6 +5389,9 @@ static struct pipe *parse_stream(char **pstring,
                                         syntax_error_unexpected_ch(ch);
                                         goto parse_error2;
                                 }
+                                if (heredoc_cnt_ptr)
+                                        *heredoc_cnt_ptr = heredoc_cnt;
+                                debug_printf_heredoc("parse_stream return heredoc_cnt:%d\n", heredoc_cnt);
                                 debug_printf_parse("parse_stream return %p: "
                                                 "end_trigger char found\n",
                                                 ctx.list_head);
@@ -5360,7 +5435,7 @@ static struct pipe *parse_stream(char **pstring,
                         if (next == '<') {
                                 redir_style = REDIRECT_HEREDOC;
                                 heredoc_cnt++;
-                                debug_printf_parse("++heredoc_cnt=%d\n", heredoc_cnt);
+                                debug_printf_heredoc("++heredoc_cnt=%d\n", heredoc_cnt);
                                 ch = i_getch(input);
                                 nommu_addchr(&ctx.as_string, ch);
                         } else if (next == '>') {
@@ -5444,7 +5519,7 @@ static struct pipe *parse_stream(char **pstring,
                         }
                         if (ctx.is_assignment == NOT_ASSIGNMENT)
                                 ctx.word.o_expflags |= EXP_FLAG_ESC_GLOB_CHARS;
-                        if (!encode_string(&ctx.as_string, &ctx.word, input, '"', /*process_bkslash:*/ 1))
+                        if (!encode_string(&ctx.as_string, &ctx.word, input, '"'))
                                 goto parse_error;
                         ctx.word.o_expflags &= ~EXP_FLAG_ESC_GLOB_CHARS;
                         continue; /* get next char */
@@ -5538,16 +5613,22 @@ static struct pipe *parse_stream(char **pstring,
                                 continue; /* get next char */
                         }
 #endif
-                case '{':
-                        if (parse_group(&ctx, input, ch) != 0) {
+                        /* fall through */
+                case '{': {
+                        int n = parse_group(&ctx, input, ch);
+                        if (n < 0) {
                                 goto parse_error;
                         }
+                        debug_printf_heredoc("parse_group done, needs heredocs:%d\n", n);
+                        heredoc_cnt += n;
                         goto new_cmd;
+                }
                 case ')':
 #if ENABLE_HUSH_CASE
                         if (ctx.ctx_res_w == RES_MATCH)
                                 goto case_semi;
 #endif
+
                 case '}':
                         /* proper use of this character is caught by end_trigger:
                          * if we see {, we call parse_group(..., end_trigger='}')
@@ -5587,7 +5668,7 @@ static struct pipe *parse_stream(char **pstring,
                         free_pipe_list(pctx->list_head);
                         debug_printf_clean("freed list %p\n", pctx->list_head);
 #if !BB_MMU
-                        o_free_unsafe(&pctx->as_string);
+                        o_free(&pctx->as_string);
 #endif
                         IF_HAS_KEYWORDS(p2 = pctx->stack;)
                         if (pctx != &ctx) {
@@ -5618,6 +5699,7 @@ static char *expand_string_to_string(const char *str, int EXP_flags, int do_unba
 #if ENABLE_HUSH_TICK
 static int process_command_subs(o_string *dest, const char *s);
 #endif
+static int expand_vars_to_list(o_string *output, int n, char *arg);
 
 /* expand_strvec_to_strvec() takes a list of strings, expands
  * all variable references within and returns a pointer to
@@ -5662,10 +5744,10 @@ static void o_addblock_duplicate_backslash(o_string *o, const char *str, int len
 /* Store given string, finalizing the word and starting new one whenever
  * we encounter IFS char(s). This is used for expanding variable values.
  * End-of-string does NOT finalize word: think about 'echo -$VAR-'.
- * Return in *ended_with_ifs:
+ * Return in output->ended_in_ifs:
  * 1 - ended with IFS char, else 0 (this includes case of empty str).
  */
-static int expand_on_ifs(int *ended_with_ifs, o_string *output, int n, const char *str)
+static int expand_on_ifs(o_string *output, int n, const char *str)
 {
         int last_is_ifs = 0;
 
@@ -5728,8 +5810,7 @@ static int expand_on_ifs(int *ended_with_ifs, o_string *output, int n, const cha
                 }
         }
 
-        if (ended_with_ifs)
-                *ended_with_ifs = last_is_ifs;
+        output->ended_in_ifs = last_is_ifs;
         debug_print_list("expand_on_ifs[1]", output, n);
         return n;
 }
@@ -5741,45 +5822,288 @@ static int expand_on_ifs(int *ended_with_ifs, o_string *output, int n, const cha
  * Returns malloced string.
  * As an optimization, we return NULL if expansion is not needed.
  */
-#if !BASH_PATTERN_SUBST
-/* only ${var/pattern/repl} (its pattern part) needs additional mode */
-#define encode_then_expand_string(str, process_bkslash, do_unbackslash) \
-        encode_then_expand_string(str)
-#endif
-static char *encode_then_expand_string(const char *str, int process_bkslash, int do_unbackslash)
+static char *encode_then_expand_string(const char *str)
 {
-#if !BASH_PATTERN_SUBST
-        enum { do_unbackslash = 1 };
-#endif
         char *exp_str;
         struct in_str input;
         o_string dest = NULL_O_STRING;
+        const char *cp;
 
-        if (!strchr(str, '$')
-         && !strchr(str, '\\')
+        cp = str;
+        for (;;) {
+                if (!*cp) return NULL; /* string has no special chars */
+                if (*cp == '$') break;
+                if (*cp == '\\') break;
 #if ENABLE_HUSH_TICK
-         && !strchr(str, '`')
+                if (*cp == '`') break;
 #endif
-        ) {
-                return NULL;
+                cp++;
         }
 
         /* We need to expand. Example:
          * echo $(($a + `echo 1`)) $((1 + $((2)) ))
          */
         setup_string_in_str(&input, str);
-        encode_string(NULL, &dest, &input, EOF, process_bkslash);
+        encode_string(NULL, &dest, &input, EOF);
 //TODO: error check (encode_string returns 0 on error)?
         //bb_error_msg("'%s' -> '%s'", str, dest.data);
         exp_str = expand_string_to_string(dest.data,
+                        EXP_FLAG_ESC_GLOB_CHARS,
+                        /*unbackslash:*/ 1
+        );
+        //bb_error_msg("'%s' -> '%s'", dest.data, exp_str);
+        o_free(&dest);
+        return exp_str;
+}
+
+/* Expanding ARG in ${var#ARG}, ${var%ARG}, or ${var/ARG/ARG}.
+ * These can contain single- and double-quoted strings,
+ * and treated as if the ARG string is initially unquoted. IOW:
+ * ${var#ARG} and "${var#ARG}" treat ARG the same (ARG can even be
+ * a dquoted string: "${var#"zz"}"), the difference only comes later
+ * (word splitting and globbing of the ${var...} result).
+ */
+#if !BASH_PATTERN_SUBST
+#define encode_then_expand_vararg(str, handle_squotes, do_unbackslash) \
+        encode_then_expand_vararg(str, handle_squotes)
+#endif
+static char *encode_then_expand_vararg(const char *str, int handle_squotes, int do_unbackslash)
+{
+#if !BASH_PATTERN_SUBST
+        const int do_unbackslash = 0;
+#endif
+        char *exp_str;
+        struct in_str input;
+        o_string dest = NULL_O_STRING;
+        const char *cp;
+
+        cp = str;
+        for (;;) {
+                if (!*cp) return NULL; /* string has no special chars */
+                if (*cp == '$') break;
+                if (*cp == '\\') break;
+                if (*cp == '\'') break;
+                if (*cp == '"') break;
+#if ENABLE_HUSH_TICK
+                if (*cp == '`') break;
+#endif
+                cp++;
+        }
+
+        setup_string_in_str(&input, str);
+        dest.data = xzalloc(1); /* start as "", not as NULL */
+        exp_str = NULL;
+
+        for (;;) {
+                int ch;
+
+                ch = i_getch(&input);
+                debug_printf_parse("%s: ch=%c (%d) escape=%d\n",
+                                __func__, ch, ch, !!dest.o_expflags);
+
+                if (!dest.o_expflags) {
+                        if (ch == EOF)
+                                break;
+                        if (handle_squotes && ch == '\'') {
+                                if (!add_till_single_quote_dquoted(&dest, &input))
+                                        goto ret; /* error */
+                                continue;
+                        }
+                }
+                if (ch == EOF) {
+                        syntax_error_unterm_ch('"');
+                        goto ret; /* error */
+                }
+                if (ch == '"') {
+                        dest.o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
+                        continue;
+                }
+                if (ch == '\\') {
+                        ch = i_getch(&input);
+                        if (ch == EOF) {
+//example? error message?       syntax_error_unterm_ch('"');
+                                debug_printf_parse("%s: error: \\<eof>\n", __func__);
+                                goto ret;
+                        }
+                        o_addqchr(&dest, ch);
+                        continue;
+                }
+                if (ch == '$') {
+                        if (!parse_dollar(NULL, &dest, &input, /*quote_mask:*/ 0x80)) {
+                                debug_printf_parse("%s: error: parse_dollar returned 0 (error)\n", __func__);
+                                goto ret;
+                        }
+                        continue;
+                }
+#if ENABLE_HUSH_TICK
+                if (ch == '`') {
+                        //unsigned pos = dest->length;
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        o_addchr(&dest, 0x80 | '`');
+                        if (!add_till_backquote(&dest, &input,
+                                        /*in_dquote:*/ dest.o_expflags /* nonzero if EXP_FLAG_ESC_GLOB_CHARS set */
+                                )
+                        ) {
+                                goto ret; /* error */
+                        }
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        //debug_printf_subst("SUBST RES3 '%s'\n", dest->data + pos);
+                        continue;
+                }
+#endif
+                o_addQchr(&dest, ch);
+        } /* for (;;) */
+
+        debug_printf_parse("encode: '%s' -> '%s'\n", str, dest.data);
+        exp_str = expand_string_to_string(dest.data,
                         do_unbackslash ? EXP_FLAG_ESC_GLOB_CHARS : 0,
                         do_unbackslash
         );
-        //bb_error_msg("'%s' -> '%s'", dest.data, exp_str);
-        o_free_unsafe(&dest);
+ ret:
+        debug_printf_parse("expand: '%s' -> '%s'\n", dest.data, exp_str);
+        o_free(&dest);
         return exp_str;
 }
 
+/* Expanding ARG in ${var+ARG}, ${var-ARG}
+ */
+static int encode_then_append_var_plusminus(o_string *output, int n,
+                const char *str, int dquoted)
+{
+        struct in_str input;
+        o_string dest = NULL_O_STRING;
+
+#if 0 //todo?
+        const char *cp;
+        cp = str;
+        for (;;) {
+                if (!*cp) return NULL; /* string has no special chars */
+                if (*cp == '$') break;
+                if (*cp == '\\') break;
+                if (*cp == '\'') break;
+                if (*cp == '"') break;
+#if ENABLE_HUSH_TICK
+                if (*cp == '`') break;
+#endif
+                cp++;
+        }
+#endif
+
+        setup_string_in_str(&input, str);
+
+        for (;;) {
+                int ch;
+
+                ch = i_getch(&input);
+                debug_printf_parse("%s: ch=%c (%d) escape=%x\n",
+                                __func__, ch, ch, dest.o_expflags);
+
+                if (!dest.o_expflags) {
+                        if (ch == EOF)
+                                break;
+                        if (!dquoted && strchr(G.ifs, ch)) {
+                                /* PREFIX${x:d${e}f ...} and we met space: expand "d${e}f" and start new word.
+                                 * do not assume we are at the start of the word (PREFIX above).
+                                 */
+                                if (dest.data) {
+                                        n = expand_vars_to_list(output, n, dest.data);
+                                        o_free_and_set_NULL(&dest);
+                                        o_addchr(output, '\0');
+                                        n = o_save_ptr(output, n); /* create next word */
+                                } else
+                                if (output->length != o_get_last_ptr(output, n)
+                                 || output->has_quoted_part
+                                ) {
+                                        /* For these cases:
+                                         * f() { for i; do echo "|$i|"; done; }; x=x
+                                         * f a${x:+ }b  # 1st condition
+                                         * |a|
+                                         * |b|
+                                         * f ""${x:+ }b  # 2nd condition
+                                         * ||
+                                         * |b|
+                                         */
+                                        o_addchr(output, '\0');
+                                        n = o_save_ptr(output, n); /* create next word */
+                                }
+                                continue;
+                        }
+                        if (!dquoted && ch == '\'') {
+                                if (!add_till_single_quote_dquoted(&dest, &input))
+                                        goto ret; /* error */
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                                continue;
+                        }
+                }
+                if (ch == EOF) {
+                        syntax_error_unterm_ch('"');
+                        goto ret; /* error */
+                }
+                if (ch == '"') {
+                        dest.o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
+                        if (dest.o_expflags) {
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        }
+                        continue;
+                }
+                if (ch == '\\') {
+                        ch = i_getch(&input);
+                        if (ch == EOF) {
+//example? error message?       syntax_error_unterm_ch('"');
+                                debug_printf_parse("%s: error: \\<eof>\n", __func__);
+                                goto ret;
+                        }
+                        o_addqchr(&dest, ch);
+                        continue;
+                }
+                if (ch == '$') {
+                        if (!parse_dollar(NULL, &dest, &input, /*quote_mask:*/ (dest.o_expflags || dquoted) ? 0x80 : 0)) {
+                                debug_printf_parse("%s: error: parse_dollar returned 0 (error)\n", __func__);
+                                goto ret;
+                        }
+                        continue;
+                }
+#if ENABLE_HUSH_TICK
+                if (ch == '`') {
+                        //unsigned pos = dest->length;
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        o_addchr(&dest, (dest.o_expflags || dquoted) ? 0x80 | '`' : '`');
+                        if (!add_till_backquote(&dest, &input,
+                                        /*in_dquote:*/ dest.o_expflags /* nonzero if EXP_FLAG_ESC_GLOB_CHARS set */
+                                )
+                        ) {
+                                goto ret; /* error */
+                        }
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        //debug_printf_subst("SUBST RES3 '%s'\n", dest->data + pos);
+                        continue;
+                }
+#endif
+                if (dquoted) {
+                        /* Always glob-protect if in dquotes:
+                         * x=x; echo "${x:+/bin/c*}" - prints: /bin/c*
+                         * x=x; echo "${x:+"/bin/c*"}" - prints: /bin/c*
+                         */
+                        o_addqchr(&dest, ch);
+                } else {
+                        /* Glob-protect only if char is quoted:
+                         * x=x; echo ${x:+/bin/c*} - prints many filenames
+                         * x=x; echo ${x:+"/bin/c*"} - prints: /bin/c*
+                         */
+                        o_addQchr(&dest, ch);
+                }
+        } /* for (;;) */
+
+        if (dest.data) {
+                n = expand_vars_to_list(output, n, dest.data);
+        }
+ ret:
+        o_free(&dest);
+        return n;
+}
+
 #if ENABLE_FEATURE_SH_MATH
 static arith_t expand_and_evaluate_arith(const char *arg, const char **errmsg_p)
 {
@@ -5790,7 +6114,7 @@ static arith_t expand_and_evaluate_arith(const char *arg, const char **errmsg_p)
         math_state.lookupvar = get_local_var_value;
         math_state.setvar = set_local_var_from_halves;
         //math_state.endofname = endofname;
-        exp_str = encode_then_expand_string(arg, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
+        exp_str = encode_then_expand_string(arg);
         res = arith(&math_state, exp_str ? exp_str : arg);
         free(exp_str);
         if (errmsg_p)
@@ -5857,16 +6181,33 @@ static char *replace_pattern(char *val, const char *pattern, const char *repl, c
 }
 #endif /* BASH_PATTERN_SUBST */
 
-/* Helper:
- * Handles <SPECIAL_VAR_SYMBOL>varname...<SPECIAL_VAR_SYMBOL> construct.
+static int append_str_maybe_ifs_split(o_string *output, int n,
+                int first_ch, const char *val)
+{
+        if (!(first_ch & 0x80)) { /* unquoted $VAR */
+                debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val,
+                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
+                if (val && val[0])
+                        n = expand_on_ifs(output, n, val);
+        } else { /* quoted "$VAR" */
+                output->has_quoted_part = 1;
+                debug_printf_expand("quoted '%s', output->o_escape:%d\n", val,
+                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
+                if (val && val[0])
+                        o_addQstr(output, val);
+        }
+        return n;
+}
+
+/* Handle <SPECIAL_VAR_SYMBOL>varname...<SPECIAL_VAR_SYMBOL> construct.
  */
-static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, char **pp)
+static NOINLINE int expand_one_var(o_string *output, int n,
+                int first_ch, char *arg, char **pp)
 {
         const char *val;
         char *to_be_freed;
         char *p;
         char *var;
-        char first_char;
         char exp_op;
         char exp_save = exp_save; /* for compiler */
         char *exp_saveptr; /* points to expansion operator */
@@ -5880,10 +6221,10 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
         var = arg;
         exp_saveptr = arg[1] ? strchr(VAR_ENCODED_SUBST_OPS, arg[1]) : NULL;
         arg0 = arg[0];
-        first_char = arg[0] = arg0 & 0x7f;
+        arg[0] = (arg0 & 0x7f);
         exp_op = 0;
 
-        if (first_char == '#' && arg[1] /* ${#...} but not ${#} */
+        if (arg[0] == '#' && arg[1] /* ${#...} but not ${#} */
          && (!exp_saveptr               /* and ( not(${#<op_char>...}) */
             || (arg[2] == '\0' && strchr(SPECIAL_VARS_STR, arg[1])) /* or ${#C} "len of $C" ) */
             )           /* NB: skipping ^^^specvar check mishandles ${#::2} */
@@ -5894,7 +6235,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
         } else {
                 /* Maybe handle parameter expansion */
                 if (exp_saveptr /* if 2nd char is one of expansion operators */
-                 && strchr(NUMERIC_SPECVARS_STR, first_char) /* 1st char is special variable */
+                 && strchr(NUMERIC_SPECVARS_STR, arg[0]) /* 1st char is special variable */
                 ) {
                         /* ${?:0}, ${#[:]%0} etc */
                         exp_saveptr = var + 1;
@@ -5923,9 +6264,9 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
         /* Look up the variable in question */
         if (isdigit(var[0])) {
                 /* parse_dollar should have vetted var for us */
-                int n = xatoi_positive(var);
-                if (n < G.global_argc)
-                        val = G.global_argv[n];
+                int nn = xatoi_positive(var);
+                if (nn < G.global_argc)
+                        val = G.global_argv[nn];
                 /* else val remains NULL: $N with too big N */
         } else {
                 switch (var[0]) {
@@ -5963,6 +6304,9 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                          * Word is expanded to produce a glob pattern.
                          * Then var's value is matched to it and matching part removed.
                          */
+//FIXME: ${x#...${...}...}
+//should evaluate inner ${...} even if x is "" and no shrinking of it is possible -
+//inner ${...} may have side effects!
                         if (val && val[0]) {
                                 char *t;
                                 char *exp_exp_word;
@@ -5971,20 +6315,16 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                 if (exp_op == *exp_word)  /* ## or %% */
                                         exp_word++;
                                 debug_printf_expand("expand: exp_word:'%s'\n", exp_word);
-                                /*
-                                 * process_bkslash:1 unbackslash:1 breaks this:
-                                 * a='a\\'; echo ${a%\\\\} # correct output is: a
-                                 * process_bkslash:1 unbackslash:0 breaks this:
-                                 * a='a}'; echo ${a%\}}    # correct output is: a
-                                 */
-                                exp_exp_word = encode_then_expand_string(exp_word, /*process_bkslash:*/ 0, /*unbackslash:*/ 0);
+                                exp_exp_word = encode_then_expand_vararg(exp_word, /*handle_squotes:*/ 1, /*unbackslash:*/ 0);
                                 if (exp_exp_word)
                                         exp_word = exp_exp_word;
-                                debug_printf_expand("expand: exp_exp_word:'%s'\n", exp_word);
-                                /* HACK ALERT. We depend here on the fact that
+                                debug_printf_expand("expand: exp_word:'%s'\n", exp_word);
+                                /*
+                                 * HACK ALERT. We depend here on the fact that
                                  * G.global_argv and results of utoa and get_local_var_value
                                  * are actually in writable memory:
-                                 * scan_and_match momentarily stores NULs there. */
+                                 * scan_and_match momentarily stores NULs there.
+                                 */
                                 t = (char*)val;
                                 loc = scan_and_match(t, exp_word, scan_flags);
                                 debug_printf_expand("op:%c str:'%s' pat:'%s' res:'%s'\n", exp_op, t, exp_word, loc);
@@ -6017,7 +6357,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                  * (note that a*z _pattern_ is never globbed!)
                                  */
                                 char *pattern, *repl, *t;
-                                pattern = encode_then_expand_string(exp_word, /*process_bkslash:*/ 0, /*unbackslash:*/ 0);
+                                pattern = encode_then_expand_vararg(exp_word, /*handle_squotes:*/ 1, /*unbackslash:*/ 0);
                                 if (!pattern)
                                         pattern = xstrdup(exp_word);
                                 debug_printf_varexp("pattern:'%s'->'%s'\n", exp_word, pattern);
@@ -6025,7 +6365,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                 exp_word = p;
                                 p = strchr(p, SPECIAL_VAR_SYMBOL);
                                 *p = '\0';
-                                repl = encode_then_expand_string(exp_word, /*process_bkslash:*/ 0, /*unbackslash:*/ 1);
+                                repl = encode_then_expand_vararg(exp_word, /*handle_squotes:*/ 1, /*unbackslash:*/ 1);
                                 debug_printf_varexp("repl:'%s'->'%s'\n", exp_word, repl);
                                 /* HACK ALERT. We depend here on the fact that
                                  * G.global_argv and results of utoa and get_local_var_value
@@ -6121,6 +6461,34 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                          *
                          * Colon forms (${var:-word}, ${var:=word} etc) do the same,
                          * but also treat null var as if it is unset.
+                         *
+                         * Word-splitting and single quote behavior:
+                         *
+                         * $ f() { for i; do echo "|$i|"; done; };
+                         *
+                         * $ x=; f ${x:?'x y' z}
+                         * bash: x: x y z              #BUG: does not abort, ${} results in empty expansion
+                         * $ x=; f "${x:?'x y' z}"
+                         * bash: x: x y z       # dash prints: dash: x: 'x y' z   #BUG: does not abort, ${} results in ""
+                         *
+                         * $ x=; f ${x:='x y' z}
+                         * |x|
+                         * |y|
+                         * |z|
+                         * $ x=; f "${x:='x y' z}"
+                         * |'x y' z|
+                         *
+                         * $ x=x; f ${x:+'x y' z}
+                         * |x y|
+                         * |z|
+                         * $ x=x; f "${x:+'x y' z}"
+                         * |'x y' z|
+                         *
+                         * $ x=; f ${x:-'x y' z}
+                         * |x y|
+                         * |z|
+                         * $ x=; f "${x:-'x y' z}"
+                         * |'x y' z|
                          */
                         int use_word = (!val || ((exp_save == ':') && !val[0]));
                         if (exp_op == '+')
@@ -6128,33 +6496,51 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                         debug_printf_expand("expand: op:%c (null:%s) test:%i\n", exp_op,
                                         (exp_save == ':') ? "true" : "false", use_word);
                         if (use_word) {
-                                to_be_freed = encode_then_expand_string(exp_word, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
-                                if (to_be_freed)
-                                        exp_word = to_be_freed;
-                                if (exp_op == '?') {
-                                        /* mimic bash message */
-                                        msg_and_die_if_script("%s: %s",
-                                                var,
-                                                exp_word[0]
-                                                ? exp_word
-                                                : "parameter null or not set"
-                                                /* ash has more specific messages, a-la: */
-                                                /*: (exp_save == ':' ? "parameter null or not set" : "parameter not set")*/
+                                if (exp_op == '+' || exp_op == '-') {
+                                        /* ${var+word} - use alternative value */
+                                        /* ${var-word} - use default value */
+                                        n = encode_then_append_var_plusminus(output, n, exp_word,
+                                                        /*dquoted:*/ (arg0 & 0x80)
                                         );
-//TODO: how interactive bash aborts expansion mid-command?
+                                        val = NULL;
                                 } else {
-                                        val = exp_word;
-                                }
-
-                                if (exp_op == '=') {
-                                        /* ${var=[word]} or ${var:=[word]} */
-                                        if (isdigit(var[0]) || var[0] == '#') {
+                                        /* ${var?word} - indicate error if unset */
+                                        /* ${var=word} - assign and use default value */
+                                        to_be_freed = encode_then_expand_vararg(exp_word,
+                                                        /*handle_squotes:*/ !(arg0 & 0x80),
+                                                        /*unbackslash:*/ 0
+                                        );
+                                        if (to_be_freed)
+                                                exp_word = to_be_freed;
+                                        if (exp_op == '?') {
                                                 /* mimic bash message */
-                                                msg_and_die_if_script("$%s: cannot assign in this way", var);
-                                                val = NULL;
+                                                msg_and_die_if_script("%s: %s",
+                                                        var,
+                                                        exp_word[0]
+                                                        ? exp_word
+                                                        : "parameter null or not set"
+                                                        /* ash has more specific messages, a-la: */
+                                                        /*: (exp_save == ':' ? "parameter null or not set" : "parameter not set")*/
+                                                );
+//TODO: how interactive bash aborts expansion mid-command?
+//It aborts the entire line, returns to prompt:
+// $ f() { for i; do echo "|$i|"; done; }; x=; f "${x:?'x y' z}"; echo YO
+// bash: x: x y z
+// $
+// ("echo YO" is not executed, neither the f function call)
                                         } else {
-                                                char *new_var = xasprintf("%s=%s", var, val);
-                                                set_local_var(new_var, /*flag:*/ 0);
+                                                val = exp_word;
+                                        }
+                                        if (exp_op == '=') {
+                                                /* ${var=[word]} or ${var:=[word]} */
+                                                if (isdigit(var[0]) || var[0] == '#') {
+                                                        /* mimic bash message */
+                                                        msg_and_die_if_script("$%s: cannot assign in this way", var);
+                                                        val = NULL;
+                                                } else {
+                                                        char *new_var = xasprintf("%s=%s", var, val);
+                                                        set_local_var(new_var, /*flag:*/ 0);
+                                                }
                                         }
                                 }
                         }
@@ -6164,10 +6550,12 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
         } /* if (exp_op) */
 
         arg[0] = arg0;
-
         *pp = p;
-        *to_be_freed_pp = to_be_freed;
-        return val;
+
+        n = append_str_maybe_ifs_split(output, n, first_ch, val);
+
+        free(to_be_freed);
+        return n;
 }
 
 /* Expand all variable references in given string, adding words to list[]
@@ -6181,30 +6569,22 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
          * expansion of right-hand side of assignment == 1-element expand.
          */
         char cant_be_null = 0; /* only bit 0x80 matters */
-        int ended_in_ifs = 0;  /* did last unquoted expansion end with IFS chars? */
         char *p;
 
         debug_printf_expand("expand_vars_to_list: arg:'%s' singleword:%x\n", arg,
                         !!(output->o_expflags & EXP_FLAG_SINGLEWORD));
-        debug_print_list("expand_vars_to_list", output, n);
-        n = o_save_ptr(output, n);
         debug_print_list("expand_vars_to_list[0]", output, n);
 
         while ((p = strchr(arg, SPECIAL_VAR_SYMBOL)) != NULL) {
                 char first_ch;
-                char *to_be_freed = NULL;
-                const char *val = NULL;
-#if ENABLE_HUSH_TICK
-                o_string subst_result = NULL_O_STRING;
-#endif
 #if ENABLE_FEATURE_SH_MATH
                 char arith_buf[sizeof(arith_t)*3 + 2];
 #endif
 
-                if (ended_in_ifs) {
+                if (output->ended_in_ifs) {
                         o_addchr(output, '\0');
                         n = o_save_ptr(output, n);
-                        ended_in_ifs = 0;
+                        output->ended_in_ifs = 0;
                 }
 
                 o_addblock(output, arg, p - arg);
@@ -6235,7 +6615,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         cant_be_null |= first_ch; /* do it for "$@" _now_, when we know it's not empty */
                         if (!(first_ch & 0x80)) { /* unquoted $* or $@ */
                                 while (G.global_argv[i]) {
-                                        n = expand_on_ifs(NULL, output, n, G.global_argv[i]);
+                                        n = expand_on_ifs(output, n, G.global_argv[i]);
                                         debug_printf_expand("expand_vars_to_list: argv %d (last %d)\n", i, G.global_argc - 1);
                                         if (G.global_argv[i++][0] && G.global_argv[i]) {
                                                 /* this argv[] is not empty and not last:
@@ -6272,19 +6652,25 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         }
                         break;
                 }
-                case SPECIAL_VAR_SYMBOL: /* <SPECIAL_VAR_SYMBOL><SPECIAL_VAR_SYMBOL> */
+                case SPECIAL_VAR_SYMBOL: {
+                        /* <SPECIAL_VAR_SYMBOL><SPECIAL_VAR_SYMBOL> */
                         /* "Empty variable", used to make "" etc to not disappear */
                         output->has_quoted_part = 1;
-                        arg++;
                         cant_be_null = 0x80;
+                        arg++;
                         break;
+                }
                 case SPECIAL_VAR_QUOTED_SVS:
                         /* <SPECIAL_VAR_SYMBOL><SPECIAL_VAR_QUOTED_SVS><SPECIAL_VAR_SYMBOL> */
+                        /* "^C variable", represents literal ^C char (possible in scripts) */
+                        o_addchr(output, SPECIAL_VAR_SYMBOL);
                         arg++;
-                        val = SPECIAL_VAR_SYMBOL_STR;
                         break;
 #if ENABLE_HUSH_TICK
-                case '`': /* <SPECIAL_VAR_SYMBOL>`cmd<SPECIAL_VAR_SYMBOL> */
+                case '`': {
+                        /* <SPECIAL_VAR_SYMBOL>`cmd<SPECIAL_VAR_SYMBOL> */
+                        o_string subst_result = NULL_O_STRING;
+
                         *p = '\0'; /* replace trailing <SPECIAL_VAR_SYMBOL> */
                         arg++;
                         /* Can't just stuff it into output o_string,
@@ -6294,11 +6680,14 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         G.last_exitcode = process_command_subs(&subst_result, arg);
                         G.expand_exitcode = G.last_exitcode;
                         debug_printf_subst("SUBST RES:%d '%s'\n", G.last_exitcode, subst_result.data);
-                        val = subst_result.data;
-                        goto store_val;
+                        n = append_str_maybe_ifs_split(output, n, first_ch, subst_result.data);
+                        o_free(&subst_result);
+                        break;
+                }
 #endif
 #if ENABLE_FEATURE_SH_MATH
-                case '+': { /* <SPECIAL_VAR_SYMBOL>+cmd<SPECIAL_VAR_SYMBOL> */
+                case '+': {
+                        /* <SPECIAL_VAR_SYMBOL>+arith<SPECIAL_VAR_SYMBOL> */
                         arith_t res;
 
                         arg++; /* skip '+' */
@@ -6307,62 +6696,43 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         res = expand_and_evaluate_arith(arg, NULL);
                         debug_printf_subst("ARITH RES '"ARITH_FMT"'\n", res);
                         sprintf(arith_buf, ARITH_FMT, res);
-                        val = arith_buf;
+                        o_addstr(output, arith_buf);
                         break;
                 }
 #endif
                 default:
-                        val = expand_one_var(&to_be_freed, arg, &p);
- IF_HUSH_TICK(store_val:)
-                        if (!(first_ch & 0x80)) { /* unquoted $VAR */
-                                debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val,
-                                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
-                                if (val && val[0]) {
-                                        n = expand_on_ifs(&ended_in_ifs, output, n, val);
-                                        val = NULL;
-                                }
-                        } else { /* quoted $VAR, val will be appended below */
-                                output->has_quoted_part = 1;
-                                debug_printf_expand("quoted '%s', output->o_escape:%d\n", val,
-                                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
-                        }
+                        /* <SPECIAL_VAR_SYMBOL>varname[ops]<SPECIAL_VAR_SYMBOL> */
+                        n = expand_one_var(output, n, first_ch, arg, &p);
                         break;
                 } /* switch (char after <SPECIAL_VAR_SYMBOL>) */
 
-                if (val && val[0]) {
-                        o_addQstr(output, val);
-                }
-                free(to_be_freed);
-
                 /* Restore NULL'ed SPECIAL_VAR_SYMBOL.
                  * Do the check to avoid writing to a const string. */
                 if (*p != SPECIAL_VAR_SYMBOL)
                         *p = SPECIAL_VAR_SYMBOL;
-
-#if ENABLE_HUSH_TICK
-                o_free(&subst_result);
-#endif
                 arg = ++p;
         } /* end of "while (SPECIAL_VAR_SYMBOL is found) ..." */
 
-        if (arg[0]) {
-                if (ended_in_ifs) {
+        if (*arg) {
+                /* handle trailing string */
+                if (output->ended_in_ifs) {
                         o_addchr(output, '\0');
                         n = o_save_ptr(output, n);
                 }
                 debug_print_list("expand_vars_to_list[a]", output, n);
                 /* this part is literal, and it was already pre-quoted
-                 * if needed (much earlier), do not use o_addQstr here! */
-                o_addstr_with_NUL(output, arg);
+                 * if needed (much earlier), do not use o_addQstr here!
+                 */
+                o_addstr(output, arg);
                 debug_print_list("expand_vars_to_list[b]", output, n);
-        } else if (output->length == o_get_last_ptr(output, n) /* expansion is empty */
-         && !(cant_be_null & 0x80) /* and all vars were not quoted. */
+        } else
+        if (output->length == o_get_last_ptr(output, n) /* expansion is empty */
+         && !(cant_be_null & 0x80)   /* and all vars were not quoted */
+         && !output->has_quoted_part
         ) {
                 n--;
                 /* allow to reuse list[n] later without re-growth */
                 output->has_empty_slot = 1;
-        } else {
-                o_addchr(output, '\0');
         }
 
         return n;
@@ -6377,9 +6747,18 @@ static char **expand_variables(char **argv, unsigned expflags)
         output.o_expflags = expflags;
 
         n = 0;
-        while (*argv) {
-                n = expand_vars_to_list(&output, n, *argv);
-                argv++;
+        for (;;) {
+                /* go to next list[n] */
+                output.ended_in_ifs = 0;
+                n = o_save_ptr(&output, n);
+
+                if (!*argv)
+                        break;
+
+                /* expand argv[i] */
+                n = expand_vars_to_list(&output, n, *argv++);
+                /* if (!output->has_empty_slot) -- need this?? */
+                        o_addchr(&output, '\0');
         }
         debug_print_list("expand_variables", &output, n);
 
@@ -6429,13 +6808,20 @@ static char *expand_string_to_string(const char *str, int EXP_flags, int do_unba
         argv[0] = (char*)str;
         argv[1] = NULL;
         list = expand_variables(argv, EXP_flags | EXP_FLAG_SINGLEWORD);
-        if (HUSH_DEBUG)
-                if (!list[0] || list[1])
-                        bb_error_msg_and_die("BUG in varexp2");
-        /* actually, just move string 2*sizeof(char*) bytes back */
-        overlapping_strcpy((char*)list, list[0]);
-        if (do_unbackslash)
-                unbackslash((char*)list);
+        if (!list[0]) {
+                /* Example where it happens:
+                 * x=; echo ${x:-"$@"}
+                 */
+                ((char*)list)[0] = '\0';
+        } else {
+                if (HUSH_DEBUG)
+                        if (list[1])
+                                bb_error_msg_and_die("BUG in varexp2");
+                /* actually, just move string 2*sizeof(char*) bytes back */
+                overlapping_strcpy((char*)list, list[0]);
+                if (do_unbackslash)
+                        unbackslash((char*)list);
+        }
         debug_printf_expand("string_to_string=>'%s'\n", (char*)list);
         return (char*)list;
 }
@@ -6722,7 +7108,7 @@ static void parse_and_run_stream(struct in_str *inp, int end_trigger)
                         debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
                 }
 #endif
-                pipe_list = parse_stream(NULL, inp, end_trigger);
+                pipe_list = parse_stream(NULL, NULL, inp, end_trigger);
                 if (!pipe_list || pipe_list == ERR_PTR) { /* EOF/error */
                         /* If we are in "big" script
                          * (not in `cmd` or something similar)...
@@ -6763,19 +7149,19 @@ static void parse_and_run_string(const char *s)
         //IF_HUSH_LINENO_VAR(G.lineno = sv;)
 }
 
-static void parse_and_run_file(FILE *f)
+static void parse_and_run_file(HFILE *fp)
 {
         struct in_str input;
         IF_HUSH_LINENO_VAR(unsigned sv = G.lineno;)
 
         IF_HUSH_LINENO_VAR(G.lineno = 1;)
-        setup_file_in_str(&input, f);
+        setup_file_in_str(&input, fp);
         parse_and_run_stream(&input, ';');
         IF_HUSH_LINENO_VAR(G.lineno = sv;)
 }
 
 #if ENABLE_HUSH_TICK
-static FILE *generate_stream_from_string(const char *s, pid_t *pid_p)
+static int generate_stream_from_string(const char *s, pid_t *pid_p)
 {
         pid_t pid;
         int channel[2];
@@ -6877,7 +7263,7 @@ static FILE *generate_stream_from_string(const char *s, pid_t *pid_p)
         free(to_free);
 # endif
         close(channel[1]);
-        return remember_FILE(xfdopen_for_read(channel[0]));
+        return channel[0];
 }
 
 /* Return code is exit status of the process that is run. */
@@ -6887,7 +7273,7 @@ static int process_command_subs(o_string *dest, const char *s)
         pid_t pid;
         int status, ch, eol_cnt;
 
-        fp = generate_stream_from_string(s, &pid);
+        fp = xfdopen_for_read(generate_stream_from_string(s, &pid));
 
         /* Now send results of command back into original context */
         eol_cnt = 0;
@@ -6906,7 +7292,7 @@ static int process_command_subs(o_string *dest, const char *s)
         }
 
         debug_printf("done reading from `cmd` pipe, closing it\n");
-        fclose_and_forget(fp);
+        fclose(fp);
         /* We need to extract exitcode. Test case
          * "true; echo `sleep 1; false` $?"
          * should print 1 */
@@ -6931,7 +7317,7 @@ static void setup_heredoc(struct redir_struct *redir)
 
         expanded = NULL;
         if (!(redir->rd_dup & HEREDOC_QUOTED)) {
-                expanded = encode_then_expand_string(heredoc, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
+                expanded = encode_then_expand_string(heredoc);
                 if (expanded)
                         heredoc = expanded;
         }
@@ -7084,19 +7470,54 @@ static int save_fd_on_redirect(int fd, int avoid_fd, struct squirrel **sqp)
                 return 1; /* "we closed fd" */
         }
 #endif
-        /* Are we called from setup_redirects(squirrel==NULL)? Two cases:
-         * (1) Redirect in a forked child. No need to save FILEs' fds,
-         * we aren't going to use them anymore, ok to trash.
-         * (2) "exec 3>FILE". Bummer. We can save script FILEs' fds,
-         * but how are we doing to restore them?
-         * "fileno(fd) = new_fd" can't be done.
+        /* Are we called from setup_redirects(squirrel==NULL)
+         * in redirect in a [v]forked child?
          */
-        if (!sqp)
+        if (sqp == NULL) {
+                /* No need to move script fds.
+                 * For NOMMU case, it's actively wrong: we'd change ->fd
+                 * fields in memory for the parent, but parent's fds
+                 * aren't be moved, it would use wrong fd!
+                 * Reproducer: "cmd 3>FILE" in script.
+                 * If we would call move_HFILEs_on_redirect(), child would:
+                 *  fcntl64(3, F_DUPFD_CLOEXEC, 10)   = 10
+                 *  close(3)                          = 0
+                 * and change ->fd to 10 if fd#3 is a script fd. WRONG.
+                 */
+                //bb_error_msg("sqp == NULL: [v]forked child");
                 return 0;
+        }
 
         /* If this one of script's fds? */
-        if (save_FILEs_on_redirect(fd, avoid_fd))
-                return 1; /* yes. "we closed fd" */
+        if (move_HFILEs_on_redirect(fd, avoid_fd))
+                return 1; /* yes. "we closed fd" (actually moved it) */
+
+        /* Are we called for "exec 3>FILE"? Came through
+         * redirect_and_varexp_helper(squirrel=ERR_PTR) -> setup_redirects(ERR_PTR)
+         * This case used to fail for this script:
+         *  exec 3>FILE
+         *  echo Ok
+         *  ...100000 more lines...
+         *  echo Ok
+         * as follows:
+         *  read(3, "exec 3>FILE\necho Ok\necho Ok"..., 1024) = 1024
+         *  open("FILE", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 4
+         *  dup2(4, 3)                        = 3
+         *  ^^^^^^^^ oops, we lost fd#3 opened to our script!
+         *  close(4)                          = 0
+         *  write(1, "Ok\n", 3)               = 3
+         *  ...                               = 3
+         *  write(1, "Ok\n", 3)               = 3
+         *  read(3, 0x94fbc08, 1024)          = -1 EBADF (Bad file descriptor)
+         *  ^^^^^^^^ oops, wrong fd!!!
+         * With this case separate from sqp == NULL and *after* move_HFILEs,
+         * it now works:
+         */
+        if (sqp == ERR_PTR) {
+                /* Don't preserve redirected fds: exec is _meant_ to change these */
+                //bb_error_msg("sqp == ERR_PTR: exec >FILE");
+                return 0;
+        }
 
         /* Check whether it collides with any open fds (e.g. stdio), save fds as needed */
         *sqp = add_squirrel(*sqp, fd, avoid_fd);
@@ -7122,8 +7543,6 @@ static void restore_redirects(struct squirrel *sq)
         }
 
         /* If moved, G.interactive_fd stays on new fd, not restoring it */
-
-        restore_redirected_FILEs();
 }
 
 #if ENABLE_FEATURE_SH_STANDALONE && BB_MMU
@@ -7131,7 +7550,7 @@ static void close_saved_fds_and_FILE_fds(void)
 {
         if (G_interactive_fd)
                 close(G_interactive_fd);
-        close_all_FILE_list();
+        close_all_HFILE_list();
 }
 #endif
 
@@ -7144,7 +7563,7 @@ static int internally_opened_fd(int fd, struct squirrel *sq)
                 return 1;
 #endif
         /* If this one of script's fds? */
-        if (fd_in_FILEs(fd))
+        if (fd_in_HFILEs(fd))
                 return 1;
 
         if (sq) for (i = 0; sq[i].orig_fd >= 0; i++) {
@@ -7169,7 +7588,7 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                         save_fd_on_redirect(redir->rd_fd, /*avoid:*/ 0, sqp);
                         /* for REDIRECT_HEREDOC2, rd_filename holds _contents_
                          * of the heredoc */
-                        debug_printf_parse("set heredoc '%s'\n",
+                        debug_printf_redir("set heredoc '%s'\n",
                                         redir->rd_filename);
                         setup_heredoc(redir);
                         continue;
@@ -7181,8 +7600,7 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                         int mode;
 
                         if (redir->rd_filename == NULL) {
-                                /*
-                                 * Examples:
+                                /* Examples:
                                  * "cmd >" (no filename)
                                  * "cmd > <file" (2nd redirect starts too early)
                                  */
@@ -7238,7 +7656,7 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                          */
                 } else {
                         /* if newfd is a script fd or saved fd, simulate EBADF */
-                        if (internally_opened_fd(newfd, sqp ? *sqp : NULL)) {
+                        if (internally_opened_fd(newfd, sqp && sqp != ERR_PTR ? *sqp : NULL)) {
                                 //errno = EBADF;
                                 //bb_perror_msg_and_die("can't duplicate file descriptor");
                                 newfd = -1; /* same effect as code above */
@@ -7312,6 +7730,58 @@ static const struct built_in_command *find_builtin(const char *name)
         return find_builtin_helper(name, bltins2, &bltins2[ARRAY_SIZE(bltins2)]);
 }
 
+static void remove_nested_vars(void)
+{
+        struct variable *cur;
+        struct variable **cur_pp;
+
+        cur_pp = &G.top_var;
+        while ((cur = *cur_pp) != NULL) {
+                if (cur->var_nest_level <= G.var_nest_level) {
+                        cur_pp = &cur->next;
+                        continue;
+                }
+                /* Unexport */
+                if (cur->flg_export) {
+                        debug_printf_env("unexporting nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
+                        bb_unsetenv(cur->varstr);
+                }
+                /* Remove from global list */
+                *cur_pp = cur->next;
+                /* Free */
+                if (!cur->max_len) {
+                        debug_printf_env("freeing nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
+                        free(cur->varstr);
+                }
+                free(cur);
+        }
+}
+
+static void enter_var_nest_level(void)
+{
+        G.var_nest_level++;
+        debug_printf_env("var_nest_level++ %u\n", G.var_nest_level);
+
+        /* Try: f() { echo -n .; f; }; f
+         * struct variable::var_nest_level is uint16_t,
+         * thus limiting recursion to < 2^16.
+         * In any case, with 8 Mbyte stack SEGV happens
+         * not too long after 2^16 recursions anyway.
+         */
+        if (G.var_nest_level > 0xff00)
+                bb_error_msg_and_die("fatal recursion (depth %u)", G.var_nest_level);
+}
+
+static void leave_var_nest_level(void)
+{
+        G.var_nest_level--;
+        debug_printf_env("var_nest_level-- %u\n", G.var_nest_level);
+        if (HUSH_DEBUG && (int)G.var_nest_level < 0)
+                bb_error_msg_and_die("BUG: nesting underflow");
+
+        remove_nested_vars();
+}
+
 #if ENABLE_HUSH_FUNCTIONS
 static struct function **find_function_slot(const char *name)
 {
@@ -7398,58 +7868,6 @@ static void unset_func(const char *name)
 }
 # endif
 
-static void remove_nested_vars(void)
-{
-        struct variable *cur;
-        struct variable **cur_pp;
-
-        cur_pp = &G.top_var;
-        while ((cur = *cur_pp) != NULL) {
-                if (cur->var_nest_level <= G.var_nest_level) {
-                        cur_pp = &cur->next;
-                        continue;
-                }
-                /* Unexport */
-                if (cur->flg_export) {
-                        debug_printf_env("unexporting nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
-                        bb_unsetenv(cur->varstr);
-                }
-                /* Remove from global list */
-                *cur_pp = cur->next;
-                /* Free */
-                if (!cur->max_len) {
-                        debug_printf_env("freeing nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
-                        free(cur->varstr);
-                }
-                free(cur);
-        }
-}
-
-static void enter_var_nest_level(void)
-{
-        G.var_nest_level++;
-        debug_printf_env("var_nest_level++ %u\n", G.var_nest_level);
-
-        /* Try: f() { echo -n .; f; }; f
-         * struct variable::var_nest_level is uint16_t,
-         * thus limiting recursion to < 2^16.
-         * In any case, with 8 Mbyte stack SEGV happens
-         * not too long after 2^16 recursions anyway.
-         */
-        if (G.var_nest_level > 0xff00)
-                bb_error_msg_and_die("fatal recursion (depth %u)", G.var_nest_level);
-}
-
-static void leave_var_nest_level(void)
-{
-        G.var_nest_level--;
-        debug_printf_env("var_nest_level-- %u\n", G.var_nest_level);
-        if (HUSH_DEBUG && (int)G.var_nest_level < 0)
-                bb_error_msg_and_die("BUG: nesting underflow");
-
-        remove_nested_vars();
-}
-
 # if BB_MMU
 #define exec_function(to_free, funcp, argv) \
         exec_function(funcp, argv)
@@ -8253,8 +8671,8 @@ static int checkjobs_and_fg_shell(struct pipe *fg_pipe)
  * subshell:     ( list ) [&]
  */
 #if !ENABLE_HUSH_MODE_X
-#define redirect_and_varexp_helper(old_vars_p, command, squirrel, argv_expanded) \
-        redirect_and_varexp_helper(old_vars_p, command, squirrel)
+#define redirect_and_varexp_helper(command, sqp, argv_expanded) \
+        redirect_and_varexp_helper(command, sqp)
 #endif
 static int redirect_and_varexp_helper(
                 struct command *command,
@@ -8271,10 +8689,6 @@ static int redirect_and_varexp_helper(
         /* this takes ownership of new_env[i] elements, and frees new_env: */
         set_vars_and_save_old(new_env);
 
-        /* setup_redirects acts on file descriptors, not FILEs.
-         * This is perfect for work that comes after exec().
-         * Is it really safe for inline use?  Experimentally,
-         * things seem to work. */
         return setup_redirects(command, sqp);
 }
 static NOINLINE int run_pipe(struct pipe *pi)
@@ -8363,7 +8777,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
                 }
 #endif
                 /* { list } */
-                debug_printf("non-subshell group\n");
+                debug_printf_exec("non-subshell group\n");
                 rcode = 1; /* exitcode if redir failed */
                 if (setup_redirects(command, &squirrel) == 0) {
                         debug_printf_exec(": run_list\n");
@@ -8475,7 +8889,10 @@ static NOINLINE int run_pipe(struct pipe *pi)
                                  */
                                 enter_var_nest_level();
                                 G.shadowed_vars_pp = &old_vars;
-                                rcode = redirect_and_varexp_helper(command, /*squirrel:*/ NULL, argv_expanded);
+                                rcode = redirect_and_varexp_helper(command,
+                                        /*squirrel:*/ ERR_PTR,
+                                        argv_expanded
+                                );
                                 G.shadowed_vars_pp = sv_shadowed;
                                 /* rcode=1 can be if redir file can't be opened */
 
@@ -9528,14 +9945,13 @@ int hush_main(int argc, char **argv)
 
         /* If we are login shell... */
         if (flags & OPT_login) {
-                FILE *input;
+                HFILE *input;
                 debug_printf("sourcing /etc/profile\n");
-                input = fopen_for_read("/etc/profile");
+                input = hfopen("/etc/profile");
                 if (input != NULL) {
-                        remember_FILE(input);
                         install_special_sighandlers();
                         parse_and_run_file(input);
-                        fclose_and_forget(input);
+                        hfclose(input);
                 }
                 /* bash: after sourcing /etc/profile,
                  * tries to source (in the given order):
@@ -9548,7 +9964,7 @@ int hush_main(int argc, char **argv)
 
         /* -s is: hush -s ARGV1 ARGV2 (no SCRIPT) */
         if (!(flags & OPT_s) && G.global_argv[1]) {
-                FILE *input;
+                HFILE *input;
                 /*
                  * "bash <script>" (which is never interactive (unless -i?))
                  * sources $BASH_ENV here (without scanning $PATH).
@@ -9559,13 +9975,15 @@ int hush_main(int argc, char **argv)
                 G.global_argv++;
                 debug_printf("running script '%s'\n", G.global_argv[0]);
                 xfunc_error_retval = 127; /* for "hush /does/not/exist" case */
-                input = xfopen_for_read(G.global_argv[0]);
+                input = hfopen(G.global_argv[0]);
+                if (!input) {
+                        bb_simple_perror_msg_and_die(G.global_argv[0]);
+                }
                 xfunc_error_retval = 1;
-                remember_FILE(input);
                 install_special_sighandlers();
                 parse_and_run_file(input);
 #if ENABLE_FEATURE_CLEAN_UP
-                fclose_and_forget(input);
+                hfclose(input);
 #endif
                 goto final_return;
         }
@@ -9666,7 +10084,7 @@ int hush_main(int argc, char **argv)
                 G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, 254);
                 if (G_interactive_fd < 0) {
                         /* try to dup to any fd */
-                        G_interactive_fd = dup_CLOEXEC(STDIN_FILENO);
+                        G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, -1);
                         if (G_interactive_fd < 0)
                                 /* give up */
                                 G_interactive_fd = 0;
@@ -9695,7 +10113,7 @@ int hush_main(int argc, char **argv)
                 );
         }
 
-        parse_and_run_file(stdin);
+        parse_and_run_file(hfopen(NULL)); /* stdin */
 
  final_return:
         hush_exit(G.last_exitcode);
@@ -9803,41 +10221,41 @@ static int FAST_FUNC builtin_pwd(char **argv UNUSED_PARAM)
 
 static int FAST_FUNC builtin_eval(char **argv)
 {
-        int rcode = EXIT_SUCCESS;
-
         argv = skip_dash_dash(argv);
-        if (argv[0]) {
-                char *str = NULL;
 
-                if (argv[1]) {
-                        /* "The eval utility shall construct a command by
-                         * concatenating arguments together, separating
-                         * each with a <space> character."
-                         */
-                        char *p;
-                        unsigned len = 0;
-                        char **pp = argv;
-                        do
-                                len += strlen(*pp) + 1;
-                        while (*++pp);
-                        str = p = xmalloc(len);
-                        pp = argv;
-                        do {
-                                p = stpcpy(p, *pp);
-                                *p++ = ' ';
-                        } while (*++pp);
-                        p[-1] = '\0';
-                }
+        if (!argv[0])
+                return EXIT_SUCCESS;
 
+        if (!argv[1]) {
                 /* bash:
                  * eval "echo Hi; done" ("done" is syntax error):
                  * "echo Hi" will not execute too.
                  */
-                parse_and_run_string(str ? str : argv[0]);
+                parse_and_run_string(argv[0]);
+        } else {
+                /* "The eval utility shall construct a command by
+                 * concatenating arguments together, separating
+                 * each with a <space> character."
+                 */
+                char *str, *p;
+                unsigned len = 0;
+                char **pp = argv;
+                do
+                        len += strlen(*pp) + 1;
+                while (*++pp);
+                str = p = xmalloc(len);
+                pp = argv;
+                for (;;) {
+                        p = stpcpy(p, *pp);
+                        pp++;
+                        if (!*pp)
+                                break;
+                        *p++ = ' ';
+                }
+                parse_and_run_string(str);
                 free(str);
-                rcode = G.last_exitcode;
         }
-        return rcode;
+        return G.last_exitcode;
 }
 
 static int FAST_FUNC builtin_exec(char **argv)
@@ -10506,7 +10924,7 @@ Test that VAR is a valid variable name?
 static int FAST_FUNC builtin_source(char **argv)
 {
         char *arg_path, *filename;
-        FILE *input;
+        HFILE *input;
         save_arg_t sv;
         char *args_need_save;
 #if ENABLE_HUSH_FUNCTIONS
@@ -10530,10 +10948,10 @@ static int FAST_FUNC builtin_source(char **argv)
                         return EXIT_FAILURE;
                 }
         }
-        input = remember_FILE(fopen_or_warn(filename, "r"));
+        input = hfopen(filename);
         free(arg_path);
         if (!input) {
-                /* bb_perror_msg("%s", *argv); - done by fopen_or_warn */
+                bb_perror_msg("%s", filename);
                 /* POSIX: non-interactive shell should abort here,
                  * not merely fail. So far no one complained :)
                  */
@@ -10552,7 +10970,7 @@ static int FAST_FUNC builtin_source(char **argv)
         /* "false; . ./empty_line; echo Zero:$?" should print 0 */
         G.last_exitcode = 0;
         parse_and_run_file(input);
-        fclose_and_forget(input);
+        hfclose(input);
 
         if (args_need_save) /* can't use argv[1] instead: "shift" can mangle it */
                 restore_G_args(&sv, argv);
diff --git a/shell/hush_test/hush-glob/glob_altvalue1.right b/shell/hush_test/hush-glob/glob_altvalue1.right
new file mode 100644
index 000000000..bd3592229
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_altvalue1.right
@@ -0,0 +1,7 @@
+1u: glob_altvalue1.tests
+2u: glob_altvalue1.t*
+3u: glob_altvalue1.t*
+4u: glob_altvalue1.t*
+1q: glob_altvalue1.t*
+2q: 'glob_altvalue1.t*'
+3q: glob_altvalue1.t*
diff --git a/shell/hush_test/hush-glob/glob_altvalue1.tests b/shell/hush_test/hush-glob/glob_altvalue1.tests
new file mode 100755
index 000000000..5483d63e6
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_altvalue1.tests
@@ -0,0 +1,13 @@
+x=x
+
+echo 1u: ${x:+glob_altvalue1.t*}
+echo 2u: ${x:+'glob_altvalue1.t*'}
+echo 3u: ${x:+"glob_altvalue1.t*"}
+echo 4u: ${x:+glob_altvalue1.t\*}
+##echo 5u: ${x:+"glob_altvalue1.t\*"}
+
+echo 1q: "${x:+glob_altvalue1.t*}"
+echo 2q: "${x:+'glob_altvalue1.t*'}"
+echo 3q: "${x:+"glob_altvalue1.t*"}"
+##echo 4q: "${x:+glob_altvalue1.t\*}"
+##echo 5q: "${x:+"glob_altvalue1.t\*"}"
diff --git a/shell/hush_test/hush-heredoc/heredoc.right b/shell/hush_test/hush-heredoc/heredoc.right
new file mode 100644
index 000000000..9b9e2aae9
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc.right
@@ -0,0 +1,20 @@
+there
+one - alpha
+two - beta
+three - gamma
+hi\
+there$a
+stuff
+hi\
+there
+EO\
+F
+hi
+hi
+tab 1
+tab 2
+tab 3
+abc
+def ghi
+jkl mno
+fff is a function
diff --git a/shell/hush_test/hush-heredoc/heredoc.tests b/shell/hush_test/hush-heredoc/heredoc.tests
new file mode 100755
index 000000000..39345c51b
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc.tests
@@ -0,0 +1,97 @@
+# check order and content of multiple here docs
+
+cat << EOF1 << EOF2
+hi
+EOF1
+there
+EOF2
+
+while read line1; do
+        read line2 <&3
+        echo $line1 - $line2
+done <<EOF1 3<<EOF2
+one
+two
+three
+EOF1
+alpha
+beta
+gamma
+EOF2
+
+
+# check quoted here-doc is protected
+
+a=foo
+cat << 'EOF'
+hi\
+there$a
+stuff
+EOF
+
+# check that quoted here-documents don't have \newline processing done
+
+cat << 'EOF'
+hi\
+there
+EO\
+F
+EOF
+true
+
+# check that \newline is removed at start of here-doc
+cat << EO\
+F
+hi
+EOF
+
+# check that \newline removal works for here-doc delimiter
+cat << EOF
+hi
+EO\
+F
+
+# check operation of tab removal in here documents
+cat <<- EOF
+        tab 1
+        tab 2
+        tab 3
+        EOF
+
+# check appending of text to file from here document
+rm -f /tmp/bash-zzz
+cat > /tmp/bash-zzz << EOF
+abc
+EOF
+cat >> /tmp/bash-zzz << EOF
+def ghi
+jkl mno
+EOF
+cat /tmp/bash-zzz
+rm -f /tmp/bash-zzz
+
+# make sure command printing puts the here-document as the last redirection
+# on the line, and the function export code preserves syntactic correctness
+fff()
+{
+  ed /tmp/foo <<ENDOFINPUT >/dev/null
+/^name/d
+w
+q
+ENDOFINPUT
+aa=1
+}
+
+type fff
+#ash# export -f fff
+#ash# ${THIS_SH} -c 'type fff'
+
+#hush# bash warns: "here-document at line N delimited by end-of-file",
+#hush# ash allows it,
+#hush# hush errors out for now:
+#hush# # check that end of file delimits a here-document
+#hush# # THIS MUST BE LAST!
+#hush#
+#hush# cat << EOF
+#hush# hi
+#hush# there
diff --git a/shell/hush_test/hush-heredoc/heredoc9.right b/shell/hush_test/hush-heredoc/heredoc9.right
new file mode 100644
index 000000000..ce0136250
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc9.right
@@ -0,0 +1 @@
+hello
diff --git a/shell/hush_test/hush-heredoc/heredoc9.tests b/shell/hush_test/hush-heredoc/heredoc9.tests
new file mode 100755
index 000000000..96c227cc1
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc9.tests
@@ -0,0 +1,9 @@
+echo hello >greeting
+cat <<EOF &&
+$(cat greeting)
+EOF
+{
+        echo $?
+        cat greeting
+} >/dev/null
+rm greeting
diff --git a/shell/hush_test/hush-heredoc/heredocA.right b/shell/hush_test/hush-heredoc/heredocA.right
new file mode 100644
index 000000000..7326d9603
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredocA.right
@@ -0,0 +1 @@
+Ok
diff --git a/shell/hush_test/hush-heredoc/heredocA.tests b/shell/hush_test/hush-heredoc/heredocA.tests
new file mode 100755
index 000000000..440aaf906
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredocA.tests
@@ -0,0 +1,4 @@
+{ cat <<EOF ;
+Ok
+EOF
+}
diff --git a/shell/hush_test/hush-heredoc/heredocB.right b/shell/hush_test/hush-heredoc/heredocB.right
new file mode 100644
index 000000000..43ba0b4f9
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredocB.right
@@ -0,0 +1,3 @@
+one - alpha
+two - beta
+three - gamma
diff --git a/shell/hush_test/hush-heredoc/heredocB.tests b/shell/hush_test/hush-heredoc/heredocB.tests
new file mode 100755
index 000000000..45ea4687f
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredocB.tests
@@ -0,0 +1,12 @@
+while read line1; do
+        read line2 <&3
+        echo $line1 - $line2
+done <<EOF1 3<<EOF2
+one
+two
+three
+EOF1
+alpha
+beta
+gamma
+EOF2
diff --git a/shell/hush_test/hush-heredoc/heredoc_after_compound1.right b/shell/hush_test/hush-heredoc/heredoc_after_compound1.right
new file mode 100644
index 000000000..9052f7d1f
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_after_compound1.right
@@ -0,0 +1,2 @@
+Ok1
+Ok2
diff --git a/shell/hush_test/hush-heredoc/heredoc_after_compound1.tests b/shell/hush_test/hush-heredoc/heredoc_after_compound1.tests
new file mode 100755
index 000000000..e7cfb5be1
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_after_compound1.tests
@@ -0,0 +1,3 @@
+{ cat <<EOF; }; echo Ok2
+Ok1
+EOF
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.right b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.tests b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.tests
new file mode 100755
index 000000000..1d2a26504
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+Ok1
+EO\
+F
diff --git a/shell/hush_test/hush-heredoc/heredoc_empty3.right b/shell/hush_test/hush-heredoc/heredoc_empty3.right
new file mode 100644
index 000000000..0b54a9c93
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_empty3.right
@@ -0,0 +1,2 @@
+
+Ok
diff --git a/shell/hush_test/hush-heredoc/heredoc_empty3.tests b/shell/hush_test/hush-heredoc/heredoc_empty3.tests
new file mode 100755
index 000000000..828c2dd89
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_empty3.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+
+Ok
+EOF
diff --git a/shell/hush_test/hush-heredoc/heredoc_var_expand1.right b/shell/hush_test/hush-heredoc/heredoc_var_expand1.right
new file mode 100644
index 000000000..eb221832d
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_var_expand1.right
@@ -0,0 +1,4 @@
+
+Ok1:0
+
+Ok2:0
diff --git a/shell/hush_test/hush-heredoc/heredoc_var_expand1.tests b/shell/hush_test/hush-heredoc/heredoc_var_expand1.tests
new file mode 100755
index 000000000..3b00bab7b
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_var_expand1.tests
@@ -0,0 +1,11 @@
+x='*'
+
+cat <<- EOF
+        ${x#'*'}
+EOF
+echo Ok1:$?
+
+cat <<EOF
+${x#'*'}
+EOF
+echo Ok2:$?
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue1.right b/shell/hush_test/hush-quoting/dollar_altvalue1.right
new file mode 100644
index 000000000..5cd495d3b
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue1.right
@@ -0,0 +1,16 @@
+Unquoted b c d
+|b|
+|c|
+|d|
+Unquoted 'b c' d
+|b c|
+|d|
+Unquoted "b c" d
+|b c|
+|d|
+Quoted b c d
+|b c d|
+Quoted 'b c' d
+|'b c' d|
+Quoted "b c" d
+|b c d|
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue1.tests b/shell/hush_test/hush-quoting/dollar_altvalue1.tests
new file mode 100755
index 000000000..f4dc8caec
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue1.tests
@@ -0,0 +1,16 @@
+f() { for i; do echo "|$i|"; done; }
+x=a
+
+echo Unquoted b c d
+f ${x:+b c d}
+echo Unquoted "'b c' d"
+f ${x:+'b c' d}
+echo Unquoted '"b c" d'
+f ${x:+"b c" d}
+
+echo Quoted b c d
+f "${x:+b c d}"
+echo Quoted "'b c' d"
+f "${x:+'b c' d}"
+echo Quoted '"b c" d'
+f "${x:+"b c" d}"
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue2.right b/shell/hush_test/hush-quoting/dollar_altvalue2.right
new file mode 100644
index 000000000..7cf37e379
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue2.right
@@ -0,0 +1,69 @@
+Unquoted '':
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+||
+end
+
+Unquoted "":
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+||
+end
+
+Quoted '':
+start:
+|''|
+end
+start:
+|'' |
+end
+start:
+| ''|
+end
+start:
+| '' |
+end
+start:
+|'' ''|
+end
+
+Quoted "":
+start:
+||
+end
+start:
+| |
+end
+start:
+| |
+end
+start:
+|  |
+end
+start:
+| |
+end
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue2.tests b/shell/hush_test/hush-quoting/dollar_altvalue2.tests
new file mode 100755
index 000000000..3377eb27f
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue2.tests
@@ -0,0 +1,33 @@
+f() { echo start:; for i; do echo "|$i|"; done; echo end; }
+x=a
+
+echo "Unquoted '':"
+f ${x:+''}
+f ${x:+'' }
+f ${x:+ ''}
+f ${x:+ '' }
+f ${x:+'' ''}
+
+echo
+echo 'Unquoted "":'
+f ${x:+""}
+f ${x:+"" }
+f ${x:+ ""}
+f ${x:+ "" }
+f ${x:+"" ""}
+
+echo
+echo "Quoted '':"
+f "${x:+''}"
+f "${x:+'' }"
+f "${x:+ ''}"
+f "${x:+ '' }"
+f "${x:+'' ''}"
+
+echo
+echo 'Quoted "":'
+f "${x:+""}"
+f "${x:+"" }"
+f "${x:+ ""}"
+f "${x:+ "" }"
+f "${x:+"" ""}"
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue9.right b/shell/hush_test/hush-quoting/dollar_altvalue9.right
new file mode 100644
index 000000000..39342fe7c
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue9.right
@@ -0,0 +1,26 @@
+Unquoted 1:
+|a|
+|x y|
+|1|
+|2|
+||
+|1 2|
+|A|
+|B|
+|C D|
+|zb|
+Quoted 1:
+|a 'x y' 1 2 ''  1 2 A B C D zb|
+Unquoted 2:
+|ax y|
+|1|
+|2|
+||
+|1 2|
+|A|
+|B|
+|C D|
+|z|
+|b|
+Quoted 2:
+|a 'x y' 1 2 ''  1 2 A B C D z b|
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue9.tests b/shell/hush_test/hush-quoting/dollar_altvalue9.tests
new file mode 100755
index 000000000..27a6f4f3c
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue9.tests
@@ -0,0 +1,17 @@
+f() { for i; do echo "|$i|"; done; }
+
+echo Unquoted 1:
+x='1 2'; f a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z}b
+echo Quoted 1:
+x='1 2'; f "a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z}b"
+
+echo Unquoted 2:
+x='1 2'; f a${x:+'x y' $x ''  "$x" `echo A B` "`echo C D`" z }b
+echo Quoted 2:
+x='1 2'; f "a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z }b"
+
+#echo Unquoted 3:
+#e=
+#x='1 2'; f a${x:+'x y' $x ''  "$x" $e $e "$e" $e `echo A B` "`echo C D`" z }b
+#echo Quoted 3:
+#x='1 2'; f "a${x:+ 'x y' $x ''  "$x" $e $e "$e" $e `echo A B` "`echo C D`" z }b"
diff --git a/shell/hush_test/hush-quoting/dollar_repl_bash1.right b/shell/hush_test/hush-quoting/dollar_repl_bash1.right
new file mode 100644
index 000000000..f5e9309f4
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_repl_bash1.right
@@ -0,0 +1,14 @@
+|y|
+|zx|
+|y|
+|zx|
+|y zx|
+|y zx|
+|y|
+|zy|
+|z|
+|y|
+|zy|
+|z|
+|y zy z|
+|y zy z|
diff --git a/shell/hush_test/hush-quoting/dollar_repl_bash1.tests b/shell/hush_test/hush-quoting/dollar_repl_bash1.tests
new file mode 100755
index 000000000..912635925
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_repl_bash1.tests
@@ -0,0 +1,12 @@
+f() { for i; do echo "|$i|"; done; }
+v=xx
+
+f ${v/'x'/"y z"}
+f ${v/"x"/'y z'}
+f "${v/'x'/"y z"}"
+f "${v/"x"/'y z'}"
+
+f ${v//'x'/"y z"}
+f ${v//"x"/'y z'}
+f "${v//'x'/"y z"}"
+f "${v//"x"/'y z'}"
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp.right b/shell/hush_test/hush-quoting/squote_in_varexp.right
index a75c0bfd6..4a457021b 100644
--- a/shell/hush_test/hush-quoting/squote_in_varexp.right
+++ b/shell/hush_test/hush-quoting/squote_in_varexp.right
@@ -1,5 +1,9 @@
 z
 z
+z
+z
+y
+y
 y
 y
 Ok:0
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp.tests b/shell/hush_test/hush-quoting/squote_in_varexp.tests
index a2d05a246..4afc52107 100755
--- a/shell/hush_test/hush-quoting/squote_in_varexp.tests
+++ b/shell/hush_test/hush-quoting/squote_in_varexp.tests
@@ -1,6 +1,10 @@
 x=yz
 echo ${x#'y'}
 echo "${x#'y'}"
+echo ${x#"y"}
+echo "${x#"y"}"
 echo ${x%'z'}
 echo "${x%'z'}"
+echo ${x%"z"}
+echo "${x%"z"}"
 echo Ok:$?
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp2.right b/shell/hush_test/hush-quoting/squote_in_varexp2.right
index 9d0add3c5..d03047024 100644
--- a/shell/hush_test/hush-quoting/squote_in_varexp2.right
+++ b/shell/hush_test/hush-quoting/squote_in_varexp2.right
@@ -1,3 +1,5 @@
 Nothing:
 Nothing:
+Nothing:
+Nothing:
 Ok:0
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp2.tests b/shell/hush_test/hush-quoting/squote_in_varexp2.tests
index 806ad12b9..2797725cc 100755
--- a/shell/hush_test/hush-quoting/squote_in_varexp2.tests
+++ b/shell/hush_test/hush-quoting/squote_in_varexp2.tests
@@ -1,4 +1,6 @@
 x='\\\\'
 printf Nothing:'%s\n' ${x#'\\\\'}
 printf Nothing:'%s\n' "${x#'\\\\'}"
+printf Nothing:'%s\n' ${x#"\\\\\\\\"}
+printf Nothing:'%s\n' "${x#"\\\\\\\\"}"
 echo Ok:$?
diff --git a/shell/hush_test/hush-redir/redir_script.tests b/shell/hush_test/hush-redir/redir_script.tests
index 740daa461..a8d93ce4f 100755
--- a/shell/hush_test/hush-redir/redir_script.tests
+++ b/shell/hush_test/hush-redir/redir_script.tests
@@ -27,6 +27,10 @@ test x"$fds1" = x"$fds" \
 test x"$fds1" = x" 10>&- 3>&-" && \
 test x"$fds"  = x" 11>&- 3>&-" \
 && { echo "Ok: script fd is not closed"; exit 0; }
+# or we see that fd 3 moved to fd 10:
+test x"$fds1" = x" 3>&- 4>&-" && \
+test x"$fds"  = x" 10>&- 3>&-" \
+&& { echo "Ok: script fd is not closed"; exit 0; }
 
 echo "Bug: script fd is closed"
 echo "fds1:$fds1"
diff --git a/shell/hush_test/hush-z_slow/many_ifs.tests b/shell/hush_test/hush-z_slow/many_ifs.tests
index 1f5b1b3a6..cf9a89874 100755
--- a/shell/hush_test/hush-z_slow/many_ifs.tests
+++ b/shell/hush_test/hush-z_slow/many_ifs.tests
@@ -229,8 +229,8 @@ do
                                                 '')     split "$d0$f1$d1$f2$d2$f3$d3" "[2]($f1)($f2)" "($f1)($f2)" ;;
                                                 ' ')    ;;
                                                 *)      x=$f2$d2$f3$d3
-                                                        x=${x# } #was x=${x#' '} hush needs fixing for this to work
-                                                        x=${x% } #was x=${x%' '}
+                                                        x=${x#' '}
+                                                        x=${x%' '}
                                                         split "$d0$f1$d1$f2$d2$f3$d3" "[3]($f1)($f2)($f3)" "($f1)($x)"
                                                         ;;
                                                 esac
diff --git a/shell/random.c b/shell/random.c
index 614172279..ffe0cc937 100644
--- a/shell/random.c
+++ b/shell/random.c
@@ -57,11 +57,11 @@ next_random(random_t *rnd)
          * Choices for a,b,c: 10,13,10; 8,9,22; 2,7,3; 23,3,24
          * (given by algorithm author)
          */
-        enum {
-                a = 2,
-                b = 7,
-                c = 3,
-        };
+        enum {
+                a = 2,
+                b = 7,
+                c = 3,
+        };
 
         uint32_t t;
 
@@ -165,7 +165,7 @@ int main(int argc, char **argv)
                 write(1, buf, sizeof(buf));
         }
 
-        return 0;
+        return 0;
 }
 
 #endif