[PATCH] fix other nofork substitution bugs revealed by tests

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

As alluded to in workers/51957, nearly all of this is about getting
the PS2 stack right.

This applies on top of, and partly reverses, the lex.c hunk of, workers/51985.

diff --git b/Src/lex.c a/Src/lex.c
index 323f8b6ac..1b678794a 100644
--- b/Src/lex.c
+++ a/Src/lex.c
@@ -1421,8 +1421,11 @@ gettokstr(int c, int sub)
   brk:
     if (errflag) {
 	if (in_brace_param) {
-	    while(bct-- >= in_brace_param)
+	    while(bct >= in_brace_param) {
+		if (bct-- == cmdsubst)
+		    cmdpop();
 		cmdpop();
+	    }
 	}
 	return LEXERR;
     }
@@ -1430,8 +1433,11 @@ gettokstr(int c, int sub)
     if (unmatched && !(lexflags & LEXFLAGS_ACTIVE))
 	zerr("unmatched %c", unmatched);
     if (in_brace_param) {
-	while(bct-- >= in_brace_param)
+	while(bct >= in_brace_param) {
+	    if (bct-- == cmdsubst)
+		cmdpop();
 	    cmdpop();
+	}
 	zerr("closing brace expected");
     } else if (unset(IGNOREBRACES) && !sub && lexbuf.len > 1 &&
 	       peek == STRING && lexbuf.ptr[-1] == '}' &&
@@ -1468,7 +1474,7 @@ static int
 dquote_parse(char endchar, int sub)
 {
     int pct = 0, brct = 0, bct = 0, intick = 0, err = 0, cmdsubst = 0;
-    int c;
+    int c, bskip = 0;
     int math = endchar == ')' || endchar == ']' || infor;
     int zlemath = math && zlemetacs > zlemetall + addedx - inbufct;
 
@@ -1541,19 +1547,22 @@ dquote_parse(char endchar, int sub)
 	    if (cmdsubst && !intick) {
 		/* In nofork substitution, tokenize as if unquoted */
 		c = Inbrace;
-		bct++;
+		bskip++;
 	    }
 	    break;
 	case '}':
 	    if (intick || !bct)
 		break;
 	    c = Outbrace;
+	    if (bskip) {
+		bskip--;
+		break;
+	    }
 	    if (bct-- == cmdsubst) {
-		cmdpop();
 		cmdsubst = 0;
-	    }
-	    if (cmdsubst == 0)
 		cmdpop();
+	    }
+	    cmdpop();
 	    break;
 	case '`':
 	    c = Qtick;
@@ -1609,7 +1618,7 @@ dquote_parse(char endchar, int sub)
 	add(c);
 	if (!cmdsubst && c == Inbrace) {
 	    /* Check for ${|...} nofork command substitution */
-	    if ((c = hgetc())) {
+	    if ((c = hgetc()) && !lexstop) {
 		if (c == '|' || inblank(c)) {
 		    cmdsubst = bct;
 		    cmdpush(CS_CURSH);
@@ -1623,10 +1632,18 @@ dquote_parse(char endchar, int sub)
     if (intick) {
 	cmdpop();
     }
-    if (bct && bct == cmdsubst)
-	cmdpop();
-    while (bct--)
+    while (bct) {
+	if (bct-- == cmdsubst) {
+	    /*
+	     * You would think this is an error, but if we call it one,
+	     * parsestrnoerr() returns nonzero to subst_parse_str() and
+	     * subsequently "bad substitution" is not reported
+	     */
+	    /* err = 1 */
+	    cmdpop();
+	}
 	cmdpop();
+    }
     if (lexstop)
 	err = intick || endchar || err;
     else if (err == 1) {