parser confusions with braces inside ${ cmd; } form of command substitution

[stephane-chazelas]

Using braces inside ${ ...; } command substitution sometimes causes some `{' unmatched errors:

$ ksh -c 'echo ${ echo {a.b}; }'
ksh: syntax error at line 1: `{' unmatched
$ ksh -c 'echo ${ echo "{a,b}c; }'
ksh: syntax error at line 1: `"' unmatched
$ ksh -c 'echo ${ echo {fd[0]}< /dev/null; }'
ksh: syntax error at line 1: `{' unmatched

These are OK for some reason:

$ ksh -c 'echo ${ echo {acb}; }'
{acb}
$ ksh -c 'echo ${ echo {a b}; }'
{a b}
$ ksh -c 'echo ${ echo x{a,b} ;}'
xa xb
$ ksh -c 'echo ${ echo ${0}; }'
ksh
$ ksh -c 'echo ${ a={a,b}c; echo $a }'
ac bc

Quoting the cmdsubst doesn't help:

$ ksh -c 'echo "${ echo {a,b}; }"'
ksh: syntax error at line 1: `"' unmatched

Escaping/quoting the { avoids the error:

$ ksh -c 'echo ${ echo \{a,b}c; }'
ac bc
$ ksh -c 'echo "{"a,b}c'
{a,b}c
$ ksh -c 'echo ${ echo "{"a,b}c; }'
ac bc

I guess the brace expansion is done on the output of unquoted command substitution:

$ ksh -o posix -c 'echo ${ echo \{a,b} ;}'
{a,b}

$ ksh --version
  version         sh (AT&T Research) 93u+m/1.0.4 2022-10-22

[McDutchie]

This is the reason for bugs like these: https://github.com/ksh93/ksh/blob/4dacec274706dda16201831eb0d5d4ab4ef3af0f/src/cmd/ksh93/sh/lex.c#L1497-L1523

So far, my experiments in that direction have not been successful.