--- /dev/null
+Index: bash-4.4/bashline.c
+===================================================================
+--- bash-4.4.orig/bashline.c
++++ bash-4.4/bashline.c
+@@ -142,7 +142,7 @@ static int executable_completion __P((co
+ static rl_icppfunc_t *save_directory_hook __P((void));
+ static void restore_directory_hook __P((rl_icppfunc_t));
+
+-static int directory_exists __P((const char *));
++static int directory_exists __P((const char *, int));
+
+ static void cleanup_expansion_error __P((void));
+ static void maybe_make_readline_line __P((char *));
+@@ -3102,18 +3102,20 @@ restore_directory_hook (hookf)
+ rl_directory_rewrite_hook = hookf;
+ }
+
+-/* Check whether not the (dequoted) version of DIRNAME, with any trailing slash
+- removed, exists. */
++/* Check whether not DIRNAME, with any trailing slash removed, exists. If
++ SHOULD_DEQUOTE is non-zero, we dequote the directory name first. */
+ static int
+-directory_exists (dirname)
++directory_exists (dirname, should_dequote)
+ const char *dirname;
++ int should_dequote;
+ {
+ char *new_dirname;
+ int dirlen, r;
+ struct stat sb;
+
+- /* First, dequote the directory name */
+- new_dirname = bash_dequote_filename ((char *)dirname, rl_completion_quote_character);
++ /* We save the string and chop the trailing slash because stat/lstat behave
++ inconsistently if one is present. */
++ new_dirname = should_dequote ? bash_dequote_filename ((char *)dirname, rl_completion_quote_character) : savestring (dirname);
+ dirlen = STRLEN (new_dirname);
+ if (new_dirname[dirlen - 1] == '/')
+ new_dirname[dirlen - 1] = '\0';
+@@ -3145,7 +3147,7 @@ bash_filename_stat_hook (dirname)
+ else if (t = mbschr (local_dirname, '`')) /* XXX */
+ should_expand_dirname = '`';
+
+- if (should_expand_dirname && directory_exists (local_dirname))
++ if (should_expand_dirname && directory_exists (local_dirname, 0))
+ should_expand_dirname = 0;
+
+ if (should_expand_dirname)
+@@ -3155,7 +3157,7 @@ bash_filename_stat_hook (dirname)
+ have to worry about restoring this setting. */
+ global_nounset = unbound_vars_is_error;
+ unbound_vars_is_error = 0;
+- wl = expand_prompt_string (new_dirname, 0, W_NOCOMSUB|W_COMPLETE); /* does the right thing */
++ wl = expand_prompt_string (new_dirname, 0, W_NOCOMSUB|W_NOPROCSUB|W_COMPLETE); /* does the right thing */
+ unbound_vars_is_error = global_nounset;
+ if (wl)
+ {
+@@ -3244,13 +3246,13 @@ bash_directory_completion_hook (dirname)
+ should_expand_dirname = '`';
+ }
+
+- if (should_expand_dirname && directory_exists (local_dirname))
++ if (should_expand_dirname && directory_exists (local_dirname, 1))
+ should_expand_dirname = 0;
+
+ if (should_expand_dirname)
+ {
+ new_dirname = savestring (local_dirname);
+- wl = expand_prompt_string (new_dirname, 0, W_NOCOMSUB|W_COMPLETE); /* does the right thing */
++ wl = expand_prompt_string (new_dirname, 0, W_NOCOMSUB|W_NOPROCSUB|W_COMPLETE); /* does the right thing */
+ if (wl)
+ {
+ *dirname = string_list (wl);
+Index: bash-4.4/patchlevel.h
+===================================================================
+--- bash-4.4.orig/patchlevel.h
++++ bash-4.4/patchlevel.h
+@@ -25,6 +25,6 @@
+ regexp `^#define[ ]*PATCHLEVEL', since that's what support/mkversion.sh
+ looks for to find the patch level (for the sccs version string). */
+
+-#define PATCHLEVEL 6
++#define PATCHLEVEL 7
+
+ #endif /* _PATCHLEVEL_H_ */
+Index: bash-4.4/subst.c
+===================================================================
+--- bash-4.4.orig/subst.c
++++ bash-4.4/subst.c
+@@ -9458,6 +9458,10 @@ add_twochars:
+ tword->flags |= word->flags & (W_ASSIGNARG|W_ASSIGNRHS); /* affects $@ */
+ if (word->flags & W_COMPLETE)
+ tword->flags |= W_COMPLETE; /* for command substitutions */
++ if (word->flags & W_NOCOMSUB)
++ tword->flags |= W_NOCOMSUB;
++ if (word->flags & W_NOPROCSUB)
++ tword->flags |= W_NOPROCSUB;
+
+ temp = (char *)NULL;
+