segfault on repeated tab completion after menu selection

segfault on repeated tab completion after menu selection

[Christian Taylor]

Hi,

I use zsh 4.2.6 on Linux (vanilla 2.6.17.7 kernel). Under the following 
circumstances I can reliably produce a segfault:

% zsh -f
% autoload -U compinit; compinit
% bindkey '+' accept-and-infer-next-history
% zstyle ':completion:*' menu select yes=long
% zstyle ':completion:*:warnings' format 'No matches for: %d'

% cd <some directory with files/subdirectories in it>
% mkdir xyz
% ls <TAB><TAB>
From the menu, select the empty xyz directory, hit "+". zsh accepts the 
selection and says that there are no further matches in that directory.
At this point, pressing either "+<TAB>" or "<TAB><TAB>" will result in:
zsh: segmentation fault  zsh -f
as the second instance of zsh terminates with exit code 139.
I guess this won't occur too often, especially since a custom "warnings" 
format string seems to be necessary to reproduce it.

If any further information is required, please let me know!

Best regards,
Christian