sh: Only accept a '}' inside ${v+-=?...} if double-quote state matches.

If double-quote state does not match, treat the '}' literally.

This ensures double-quote state remains the same before and after a
${v+-=?...} which helps with expand.c.

It makes things like
  ${foo+"\${bar}"}
which I have seen in the wild work as expected.

Exp-run done by:	pav (with some other sh(1) changes)

bin/sh/parser.c

@@ -1233,12 +1233,12 @@ readtoken1(int firstc, char const *initialsyntax, char *eofmark, int striptabs)
 				break;
 			case CENDVAR:	/* '}' */
 				if (level > 0 &&
-				    (state[level].category == TSTATE_VAR_OLD ||
+				    ((state[level].category == TSTATE_VAR_OLD &&
+				      state[level].syntax ==
+				      state[level - 1].syntax) ||
 				    (state[level].category == TSTATE_VAR_NEW &&
 				     state[level].syntax == BASESYNTAX))) {
-					if (state[level].category == TSTATE_VAR_OLD)
-						state[level - 1].syntax = state[level].syntax;
-					else
+					if (state[level].category == TSTATE_VAR_NEW)
 						newvarnest--;
 					level--;
 					USTPUTC(CTLENDVAR, out);

tools/regression/bin/sh/expansion/plus-minus5.0

@@ -0,0 +1,31 @@
+# $FreeBSD$
+
+e= q='?' a='*' t=texttext s='ast*que?non' p='/et[c]/' w='a b c' b='{{(#)}}'
+h='##'
+failures=''
+ok=''
+
+testcase() {
+	code="$1"
+	expected="$2"
+	oIFS="$IFS"
+	eval "$code"
+	IFS='|'
+	result="$#|$*"
+	IFS="$oIFS"
+	if [ "x$result" = "x$expected" ]; then
+		ok=x$ok
+	else
+		failures=x$failures
+		echo "For $code, expected $expected actual $result"
+	fi
+}
+
+testcase 'set -- ${e:-"{x}"}'			'1|{x}'
+testcase 'set -- "${e:-"{x}"}"'			'1|{x}'
+testcase 'set -- ${h+"{x}"}'			'1|{x}'
+testcase 'set -- "${h+"{x}"}"'			'1|{x}'
+testcase 'set -- ${h:-"{x}"}'			'1|##'
+testcase 'set -- "${h:-"{x}"}"'			'1|##'
+
+test "x$failures" = x