param expansion with single-character special vars in the environment

[Grisha Levit]

There seems to be a bug that if an array variable with a name matching one of the special single-character variables exists, then that variable is used during substring expansion and parameter transformation.

There is also a potential issue with namerefs, in that they allow creating/modifying variables with invalid identifiers if a variable is defined first and subsequently given the nameref attribute, which is how the above behavior can be uncovered.

# Expected behavior:
set -- 1 2 3
echo ${@@A}     # set -- '1' '2' '3'
echo ${@:0}     # bash 1 2 3

ref=@
declare -n ref  # maybe should not be allowed?
ref=(X)

# These no longer reference the positional parameters:
echo ${@@A}     # declare -a @='X'
echo ${@:0}     # X

​