Pull up following revision(s) (requested by kre in ticket #906):

bin/sh/eval.c: revision 1.155
bin/sh/mknodes.sh: revision 1.3
bin/sh/nodes.c.pat: revision 1.14
bin/sh/exec.h: revision 1.27
bin/sh/exec.c: revision 1.52

Deal with ref after free found by ASAN when a function redefines
itself, or some other function which is still active.

This was a long known bug (fixed ages ago in the FreeBSD sh) which
hadn't been fixed as in practice, the situation that causes the
problem simply doesn't arise .. ASAN found it in the sh dotcmd
tests which do have this odd "feature" in the way they are written
(but where it never caused a problem, as the tests are so simple
that no mem is ever allocated between when the old version of the
function was deleted, and when it finished executing, so its code
all remained intact, despite having been freed.)

The fix is taken from the FreeBSD sh.

XXX -- pullup-8 (after a while to ensure no other problems arise).

(martin)