unset IFS and ${v=$*} CTLNUL leakage

[Grisha Levit]

The changes in [1] to parameter_brace_expand_rhs (for the fix for [2])
created (exposed?) an issue with ${var=$*} expansion when $* is
multiple nulls and IFS is unset:

    $ unset -v IFS v; set -- '' ''; printf '<%q>' ${v=$*}
    <$'\177'><$'\177'>

Uncommmenting the itrace lines shows:

    TRACE: pid 86967: param_expand: `${v=$*}' pflags = 0
    TRACE: pid 86967: parameter_brace_expand_rhs: v:$* pflags = 0
    TRACE: pid 86967: param_expand: `$*' pflags = 12
    TRACE: pid 86967: parameter_brace_expand_rhs: v:$*: l != NULL, set
*qdollaratp

OTOH, if IFS is set:

    $ IFS=x; set -- '' ''; printf '<%q>' ${v=$*}
    <''>

And:

    TRACE: pid 88443: param_expand: `${v=$*}' pflags = 0
    TRACE: pid 88443: parameter_brace_expand_rhs: v:$* pflags = 0
    TRACE: pid 88443: param_expand: `$*' pflags = 12


This seems to be related to the special-casing of unset IFS at [3]
which I don't really understand if an unset IFS is supposed to be the
same as $' \t\n'.  Getting rid of that "IFS unset" case and having the
"IFS set to non-null value" case apply to unset IFS seems to resolve
this issue.


[1]: 
https://git.savannah.gnu.org/cgit/bash.git/diff/subst.c?h=devel&id=2e4125745321da8cea9cd814173393d22cb74c60
[2]: https://lists.gnu.org/archive/html/bug-bash/2017-12/msg00052.html
[3]: 
https://git.savannah.gnu.org/cgit/bash.git/tree/subst.c?h=devel&id=e230f9979dad9cbe7e6774862e3c10d902ba3490#n9318