leaks fd for internal functions but not external command

[Sam Liddicott]

Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64'
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-pc-linux-gnu'
-DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL
-DHAVE_CONFIG_H   -I.  -I../. -I.././include -I.././lib  -Wdate-time
-D_FORTIFY_SOURCE=2 -g -O2
-fdebug-prefix-map=/build/bash-N2nMjo/bash-4.4.18=.
-fstack-protector-strong -Wformat -Werror=format-security -Wall
-Wno-parentheses -Wno-format-security
uname output: Linux sojo 4.15.0-54-generic #58-Ubuntu SMP Mon Jun 24
10:55:24 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Machine Type: x86_64-pc-linux-gnu

Bash Version: 4.4
Patch Level: 20
Release Status: release

Description:
Bash redirection sequence cases a file descriptor to be leaked
if the main command is an internal function but not if it is
an external command.

Based on prior conversation, I suspect it is supposed to leak
in the internal case (though that is annoying) but it is
inconsistent that it does not for the external case.

Repeat-By:
bash -c is used to get a pure environment for test

The perl-esque 'line noise' {_}>&2 2>&1 1>&${_} {_}<&-
is to swap stdout with stderr while providing no other
fd for any invoked processes to hang on to.

(Yes _ is abused)

test 1: leaks fd 10 for internal echo

bash -c 'echo 1 {_}>&2 2>&1 1>&${_} {_}<&- ;
        echo done ; lsof -p $$ | grep CHR'

test 2: does not leak fd for external /bin/echo

bash -c '/bin/echo 1 {_}>&2 2>&1 1>&${_} {_}<&- ;
        echo done ; lsof -p $$ | grep CHR'

test 3: does not leak if fd 10 is used explicitly

bash -c 'echo 1 10>&2 2>&1 1>&10 10<&- ;
        echo done ; lsof -p $$ | grep CHR'