bin/50834: /bin/sh incorrectly treats ${unset_or_null_var:-} as ''

[kre%munnari.OZ.AU@localhost]

>Number:         50834
>Category:       bin
>Synopsis:       /bin/sh incorrectly treats ${unset_or_null_var:-} as ''
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Feb 21 23:10:00 +0000 2016
>Originator:     Robert Elz
>Release:        NetBSD 7.99.26
>Organization:
	Prince of Songkla University
>Environment:
System: NetBSD andromeda.noi.kre.to 7.99.26 NetBSD 7.99.26 (VBOX64-1.1-20160128) #43: Thu Jan 28 16:09:08 ICT 2016 kre%onyx.coe.psu.ac.th@localhost:/usr/obj/current/kernels/amd64/VBOX64 amd64
Architecture: x86_64
Machine: amd64
>Description:
	When expanding (unquoted) ${N} an unset or null value for N
	will result in nothing being produced, so

		N=
		set -- a ${N} b; echo $# ; 		# echoes 2

	Of course, if quoted:
		set -- a "${N}" b; echo $# ;		# echoes 3

	That's all good.

	But
		set -- a ${N:-} b; echo $# ;		# echoes 3

	This is broken.

	[Aside: note, if N is set, but null,
		N=; set -- a ${N-} b; echo $# ;		# echoes 2
	that is interpolating the value of N rather than the empty word,
	and that's nothing, so that's what is (correctly) produced.

	This really doesn't matter all that much, as ${N:-} is
	identical to ${N} in meaning (if N is set and non-null, it is
	the value of N, otherwise it is nothing, which is what $N iis)
	so there's no reason for anyone to ever use this form.

	Fortunately, the case that does matter:

		N=; E=; set -- a ${N:-${E}}; echo $#	# echoes 2

	If that one failed, this would need fixing, as that's a
	useful construct, unlike the bare ${N:-}

>How-To-Repeat:
	As above.

	I noticed this as there is (was - or will be was soonish)
	an ATF sh test that explicitly tested for unquoted ${N:-}
	producing a null string, rather than nothing, and failed
	if that was not true....

	That test is about to become an expected failure...

>Fix:
	I'm not sure I will bother, this is just so meaningless...

	This PR is just so there is a number to put in the
	ATF failure message so it is possible for people who see
	the expected failure to discover exacly what is going on,
	and why it isn't fixed.

	Of course, if there were to be a great demand to make ${N:-}
	work properly, I might reconsider this, but for now there
	are more important sh bugs that need fixing (IMO).