parameter expansion assignment to array index nameref

[Grisha Levit]

$ declare -n ref=arr[1]
$ arr=(A); (echo "${ref=X} ${ref}")
A X
$ arr=( ); (echo "${ref=X} ${ref}")
Segmentation fault: 11

Expanding the nameref while still in parameter_brace_expand seems to do the
right thing though I can't say I'm fully confident in this.

diff --git a/subst.c b/subst.c
index 555d18db..64f4d6da 100644
--- a/subst.c
+++ b/subst.c
@@ -9260,6 +9260,7 @@ parameter_brace_expand (char *string, int *indexp,
int quoted, int pflags, int *
   int want_substring, want_indir, want_patsub, want_casemod,
want_attributes;
   char *name, *value, *temp, *temp1;
   WORD_DESC *tdesc, *ret;
+  SHELL_VAR *var;
   int t_index, sindex, c, tflag, modspec, local_pflags,
all_element_arrayref;
   intmax_t number;
   array_eltstate_t es;
@@ -9583,6 +9584,13 @@ parameter_brace_expand (char *string, int *indexp,
int quoted, int pflags, int *
       return (temp == &expand_param_error ? &expand_wdesc_error :
&expand_wdesc_fatal);
     }

+  if ((var = find_variable_last_nameref (name, 0)) && nameref_p (var) &&
+      (temp1 = nameref_cell (var)) && *temp1)
+    {
+      FREE (name);
+      name = savestring (temp1);
+    }
+
 #if defined (ARRAY_VARS)
   if (valid_array_reference (name, 0))
     {