Ordering bug when handling redirection with file descriptors

[Érico Nogueira]

Hi! I have the below test case which works with dash, zsh, and has been 
reported to work at least up to bash 4.4.12. After 4.4.23 it definitely 
no longer works (I have also tested with 5.1.4).

#!/bin/sh

fn() {
        echo a >&3
}

b=`fn 3>&1 1>&4 4>&-` 4>&1

With dash, it will simply exit silently (and `b` will be set to "a"), 
but with current bash it errors out with the following error message:

test: line 10: 4: Bad file descriptor

This test case was taken from a real world example,
https://github.com/skarnet/skalibs/blob/f2c9b3cb899555af1a295df7341afc1cf55f7c71/configure#L322

While exploring similar issues, I found that

fn() {
        echo a >&3
}

echo `fn 3>&1 1>&4 4>&-` 4>&1


also fails, but in this case dash doesn't seem to get it correct either.

I can provide straces for these, if necessary. This is all on Linux.

Thanks,
Érico