command completion mishandles spaces

[neil]

Configuration Information [Automatically generated, do not change]:
Machine: i486
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i486' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i486-pc-linux-gnu' 
-DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL 
-DHAVE_CONFIG_H   -I.  -I../bash -I../bash/include -I../bash/lib   -g -O2
uname output: Linux dirac.s-z.org 2.6.18-2-k7 #1 SMP Wed Nov 8 20:38:36 UTC 
2006 i686 GNU/Linux
Machine Type: i486-pc-linux-gnu

Bash Version: 3.1
Patch Level: 17
Release Status: release

Description:
        When tab-completing a command, spaces and other special characters
        are escaped with backslashes.  However, when the command begins with
        tilde and already contains backslash-quoted characters, these
        backslashes are treated as a literal part of the command, and are
        double-escaped.  That is, the text to be completed is not properly
        dequoted.  Filename completion is NOT affected.

        This bug was discovered by Nathan Rich in #bash on freenode.  I have
        confirmed the bug in bash 3.1.17 and 3.2.25.

Repeat-By:
        mkdir ~/Foo\ bar
        cp /bin/true ~/Foo\ bar/
        ~/Fo<TAB>  =>  expands to '~/Foo\ bar/' as expected
        ~/Fo<TAB><TAB>  =>  expands to '~/Foo\\\ bar/true' (WRONG)

Fix:
        The following patch fixes the problem by basing the expansion
        on the dequoted text rather than the original hint_text.  The
        patch was created from bash-3.2 sources, but also applies, with
        offsets, to bash-3.1.

diff -ur bash-3.2.25/bashline.c bash-3.2/bashline.c
--- bash-3.2.25/bashline.c      2006-07-29 16:39:30.000000000 -0400
+++ bash-3.2/bashline.c 2007-10-12 19:17:18.603626967 -0400
@@ -1476,10 +1476,16 @@
             filename. */
          if (*hint_text == '~')
            {
+             static char *deq_text;
+
              int l, tl, vl, dl;
              char *rd;
+             
+             FREE(deq_text);
+             deq_text = bash_dequote_filename(hint_text, 0);
+            
              vl = strlen (val);
-             tl = strlen (hint_text);
+             tl = strlen (deq_text);
 #if 0
              l = vl - hint_len;        /* # of chars added */
 #else
@@ -1490,7 +1496,7 @@
              free (rd);
 #endif
              temp = (char *)xmalloc (l + 2 + tl);
-             strcpy (temp, hint_text);
+             strcpy (temp, deq_text);
              strcpy (temp + tl, val + vl - l);
            }
          else