core dump or infinite loop in brace expansion

["Jun T." <takimoto-j@xxxxxxxxxxxxxxxxx>]

The following works as expected:

$ print -r {\{..~}
{ | } ~                   # characters from '{' to '~'

But the following causes a core dump or infinite loop
(if BRACECCL is not set):

$ print -r {{..~}
glob.c:2178: BUG: unmatched brace in xpandbraces()
glob.c:2371: BUG: illegal brace expansion
glob.c:2371: BUG: illegal brace expansion
....

When bracechardots() is called from hasbraces() (line 1972 of glob.c),
it returns 1, interpreting {{..~} as a character range from '{' to '~'.

Then hasbraces() also returns 1, and now xpandbraces() is called.

But xpandbraces() (lines 2163-2177) doesn't consider {{..~} as a
character range, and calls DPUTS("BUG: unmatched brace ...").
It also doesn't set dotdot.

Then execution goes to line 2365, but the loop never finishes
but repeatedly calls DPUTS("BUG: illegal brace expansion")
(and may eventually core dump).

I'm not sure what is the correct fix here. Maybe "print {{..~}"
should just print "{{..~}", not expand to "{ | } ~".