sh: Do not corrupt internal representation if LINENO inner expansion fails.

Example:
  f() { : ${LINENO+$((1/0))}; }
and call this function twice.

bin/sh/expand.c

@@ -672,10 +672,8 @@ evalvar(char *p, int flag)
 again: /* jump here after setting a variable with ${var=text} */
 	if (varflags & VSLINENO) {
 		set = 1;
-		special = 0;
-		val = var;
-		p[-1] = '\0';	/* temporarily overwrite '=' to have \0
-				   terminated string */
+		special = 1;
+		val = NULL;
 	} else if (special) {
 		set = varisset(var, varflags & VSNUL);
 		val = NULL;
@@ -704,7 +702,10 @@ evalvar(char *p, int flag)
 	if (set && subtype != VSPLUS) {
 		/* insert the value of the variable */
 		if (special) {
-			varvalue(var, varflags & VSQUOTE, subtype, flag);
+			if (varflags & VSLINENO)
+				STPUTBIN(var, p - var - 1, expdest);
+			else
+				varvalue(var, varflags & VSQUOTE, subtype, flag);
 			if (subtype == VSLENGTH) {
 				varlenb = expdest - stackblock() - startloc;
 				varlen = varlenb;
@@ -816,7 +817,6 @@ evalvar(char *p, int flag)
 	default:
 		abort();
 	}
-	p[-1] = '=';	/* recover overwritten '=' */
 
 	if (subtype != VSNORMAL) {	/* skip to end of alternative */
 		int nesting = 1;

bin/sh/tests/builtins/Makefile

@@ -87,6 +87,7 @@ FILES+=		hash4.0
 FILES+=		jobid1.0
 FILES+=		jobid2.0
 FILES+=		lineno.0 lineno.0.stdout
+FILES+=		lineno2.0
 FILES+=		local1.0
 FILES+=		local2.0
 FILES+=		local3.0

bin/sh/tests/builtins/lineno2.0

@@ -0,0 +1,10 @@
+# $FreeBSD$
+
+f() {
+	: ${LINENO+${x?}}
+}
+
+unset -v x
+command eval f 2>/dev/null && exit 3
+x=1
+f