ash: fix dequoting error detected by var_bash4 test

But the test still fails (one more bug to fix)

function                                             old     new   delta
changepath                                           195     192      -3
readtoken1                                          3247    3240      -7
subevalvar                                          1204    1184     -20
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 0/3 up/down: 0/-30)             Total: -30 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
diff --git a/shell/ash.c b/shell/ash.c
index 16783f2..74b1c3a 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -6267,7 +6267,7 @@
 
 #if ENABLE_ASH_BASH_COMPAT
 static char *
-parse_sub_pattern(char *arg, int inquotes)
+parse_sub_pattern(char *arg, int varflags)
 {
 	char *idx, *repl = NULL;
 	unsigned char c;
@@ -6285,7 +6285,7 @@
 			}
 		}
 		*idx++ = c;
-		if (!inquotes && c == '\\' && arg[1] == '\\')
+		if (!(varflags & VSQUOTE) && c == '\\' && arg[1] == '\\')
 			arg++; /* skip both \\, not just first one */
 		arg++;
 	}
@@ -6427,7 +6427,7 @@
 		char *idx, *end;
 
 		if (!repl) {
-			repl = parse_sub_pattern(str, varflags & VSQUOTE);
+			repl = parse_sub_pattern(str, varflags);
 			//bb_error_msg("repl:'%s'", repl);
 			if (!repl)
 				repl = nullstr;
@@ -6496,12 +6496,11 @@
 			}
 
 			if (subtype == VSREPLACE) {
+				//bb_error_msg("tail:'%s', quotes:%x", idx, quotes);
 				while (*idx) {
 					char *restart_detect = stackblock();
-					if (quotes && *idx == '\\') {
-						STPUTC(CTLESC, expdest);
-						len++;
-					}
+					if (quotes && (unsigned char)*idx == CTLESC)
+						idx++;
 					STPUTC(*idx, expdest);
 					if (stackblock() != restart_detect)
 						goto restart;