regression - glob expansion with brace expansion and parameter exapansion about ksh HOT 11 CLOSED

diff --git a/src/cmd/ksh93/sh/macro.c b/src/cmd/ksh93/sh/macro.c
index 44e48bb92..29ac26aed 100644
--- a/src/cmd/ksh93/sh/macro.c
+++ b/src/cmd/ksh93/sh/macro.c
@@ -76,6 +76,7 @@ typedef struct  _mac_
 	char		macsub;		/* set to 1 when running mac_substitute */
 	int		dotdot;		/* set for .. in subscript */
 	void		*nvwalk;	/* for name space walking */
+	char		bracketexpr; 	/* set when in [brackets] within a non-ERE glob pattern */
 } Mac_t;
 
 #undef ESCAPE
@@ -437,7 +438,6 @@ static void copyto(Mac_t *mp,int endch, int newquote)
 	char		oldquote = mp->quote;	/* save "double quoted" state */
 	char		ansi_c = 0;		/* set when processing ANSI C escape codes */
 	int32_t		ere = 0;		/* bitmask of pattern options indicating an extended regular expression */
-	char		bracketexpr = 0; 	/* set when in [brackets] within a non-ERE glob pattern */
 	Sfio_t		*sp = mp->sp;
 	Stk_t		*stkp = sh.stk;
 	char		*resume = 0;
@@ -533,7 +533,7 @@ static void copyto(Mac_t *mp,int endch, int newquote)
 			if(mp->pattern)
 			{
 				/* preserve \ for escaping glob pattern bracket expression operators */
-				if(bracketexpr && n==S_BRAOP)
+				if(mp->bracketexpr && n==S_BRAOP)
 					break;
 				/* preserve \digit for pattern matching */
 				/* also \alpha for extended patterns */
@@ -636,8 +636,8 @@ static void copyto(Mac_t *mp,int endch, int newquote)
 				mp->pattern = c;
 			break;
 		    case S_ENDCH:
-			if(bracketexpr && cp[-1]==RBRACT && !(mp->quote || mp->lit))
-				bracketexpr--;
+			if(mp->bracketexpr && cp[-1]==RBRACT && !(mp->quote || mp->lit))
+				mp->bracketexpr--;
 			if((mp->lit || cp[-1]!=endch || mp->quote!=newquote))
 				goto pattern;
 			if(endch==RBRACE && mp->pattern && brace)
@@ -738,12 +738,12 @@ static void copyto(Mac_t *mp,int endch, int newquote)
 				cp = first = fcseek(0);
 				break;
 			}
-			if(mp->pattern==1 && !ere && !bracketexpr)
+			if(mp->pattern==1 && !ere && !mp->bracketexpr)
 			{
-				bracketexpr++;
+				mp->bracketexpr++;
 				/* a ] following [, as in []abc], should not close the bracket expression */
 				if(cp[0]==RBRACT && cp[1])
-					bracketexpr++;
+					mp->bracketexpr++;
 			}
 			/* FALLTHROUGH */
 		    case S_PAT:
@@ -883,7 +883,7 @@ static void copyto(Mac_t *mp,int endch, int newquote)
 			break;
 		    case S_BRAOP:
 			/* escape a quoted !^- within a bracket expression */
-			if(!bracketexpr || !(mp->quote || mp->lit))
+			if(!mp->bracketexpr || !(mp->quote || mp->lit))
 				continue;
 			if(c)
 				sfwrite(stkp,first,c);
@@ -2481,7 +2481,10 @@ static void mac_copy(Mac_t *mp,const char *str, int size)
 				continue;
 			}
 			if(n==S_ESC)
-				sfputc(stkp,ESCAPE);
+			{
+				if(!mp->bracketexpr)
+					sfputc(stkp,ESCAPE);
+			}
 			else if(n==S_EPAT)
 			{
 				/* don't allow extended patterns in this case */
@@ -2583,7 +2586,7 @@ static void endfield(Mac_t *mp,int split)
 		mp->atmode = 0;
 		if(mp->patfound)
 		{
-			int musttrim = mp->wasexpan && !mp->noextpat && strchr(argp->argval,'\\');
+			int musttrim = mp->wasexpan && !mp->quoted && !mp->noextpat && strchr(argp->argval,'\\');
 			sh.argaddr = 0;
 #if SHOPT_BRACEPAT
 			/* in POSIX mode, disallow brace expansion for unquoted expansions */

diff --git a/src/cmd/ksh93/sh/macro.c b/src/cmd/ksh93/sh/macro.c
index 44e48bb92..9d19df04a 100644
--- a/src/cmd/ksh93/sh/macro.c
+++ b/src/cmd/ksh93/sh/macro.c
@@ -2451,6 +2451,7 @@ static void mac_copy(Mac_t *mp,const char *str, int size)
 	}
 	else if(!mp->quote && mp->split && (mp->ifs||mp->pattern))
 	{
+		char	bracketexpr = 0; 	/* set when in [brackets] */
 		/* split words at ifs characters */
 		state = sh.ifstable;
 		if(mp->pattern)
@@ -2467,6 +2468,8 @@ static void mac_copy(Mac_t *mp,const char *str, int size)
 				if(state[c]==0)
 					state[c] = S_PAT;
 			}
+			if(state[RBRACT]==0 && state[LBRACT]==S_PAT)
+				state[RBRACT] = S_ENDCH;
 			if(state[ESCAPE]==0)
 				state[ESCAPE] = S_ESC;
 		}
@@ -2481,7 +2484,10 @@ static void mac_copy(Mac_t *mp,const char *str, int size)
 				continue;
 			}
 			if(n==S_ESC)
-				sfputc(stkp,ESCAPE);
+			{
+				if(!bracketexpr)
+					sfputc(stkp,ESCAPE);
+			}
 			else if(n==S_EPAT)
 			{
 				/* don't allow extended patterns in this case */
@@ -2491,7 +2497,21 @@ static void mac_copy(Mac_t *mp,const char *str, int size)
 					mp->noextpat = 1;
 			}
 			else if(n==S_PAT)
+			{
 				mp->patfound = mp->pattern;
+				if(!bracketexpr && mp->pattern)
+				{
+					bracketexpr++;
+					/* a ] following [, as in []abc], should not close the bracket expression */
+					if(cp[0]==RBRACT && cp[1])
+						bracketexpr++;
+				}
+			}
+			else if(n==S_ENDCH)
+			{
+				if(bracketexpr)
+					bracketexpr--;
+			}
 			else if(n && mp->ifs)
 			{
 				if(mbwide() && n==S_MBYTE)
@@ -2557,8 +2577,10 @@ static void mac_copy(Mac_t *mp,const char *str, int size)
 				if(state[c]==S_PAT)
 					state[c] = 0;
 			}
-			if(sh.ifstable[ESCAPE]==S_ESC)
-				sh.ifstable[ESCAPE] = 0;
+			if(state[RBRACT]==S_ENDCH)
+				state[RBRACT] = 0;
+			if(state[ESCAPE]==S_ESC)
+				state[ESCAPE] = 0;
 		}
 	}
 	else
@@ -2583,7 +2605,7 @@ static void endfield(Mac_t *mp,int split)
 		mp->atmode = 0;
 		if(mp->patfound)
 		{
-			int musttrim = mp->wasexpan && !mp->noextpat && strchr(argp->argval,'\\');
+			int musttrim = mp->wasexpan && !mp->quoted && !mp->noextpat && strchr(argp->argval,'\\');
 			sh.argaddr = 0;
 #if SHOPT_BRACEPAT
 			/* in POSIX mode, disallow brace expansion for unquoted expansions */
diff --git a/src/cmd/ksh93/tests/glob.sh b/src/cmd/ksh93/tests/glob.sh
index ae4a8e101..d95eeae42 100755
--- a/src/cmd/ksh93/tests/glob.sh
+++ b/src/cmd/ksh93/tests/glob.sh
@@ -471,6 +471,8 @@ test_glob '<~(K)[]-z]>' ~(K)["]-z"]
 unquoted_patvar='[\!N]'; test_glob '<[\!N]>' $unquoted_patvar
 unquoted_patvar='[\^N]'; test_glob '<[\^N]>' $unquoted_patvar
 unquoted_patvar='[a\-c]'; test_glob '<[a\-c]>' $unquoted_patvar
+unquoted_patvar='[a\-c]'; test_glob '<[a\-c]>' ""$unquoted_patvar
+unquoted_patvar='[a\-c]'; test_glob '<[a\-c]>' $unquoted_patvar""
 : > -; test_glob '<->' $unquoted_patvar
 : > a > c; test_glob '<-> <a> <c>' $unquoted_patvar
 : > !; unquoted_patvar='[\!N]'; test_glob '<!>' $unquoted_patvar