* If a backslash-newline (which is removed) with no other input is given as
input to `read', the shell tries to dereference a null pointer and seg faults.
* Under certain circumstances, bash attempts to expand variables in
arithmetic expressions even when evaluation is being suppressed.
* Output redirection applied to builtin commands missed I/O errors if
they happened when the file descriptor was closed, rather than on write
(e.g., like with an out-of-space error on a remote NFS file system).
* Process substitution incorrectly inherited a flag that inhibited using
the (local) temporary environment for variable lookups if it was providing
the filename to a redirection. The intent the flag is to enforce the
POSIX command expansion ordering rules.
22ae009ed5