With zsh 5.2 under Debian/unstable, zsh sometimes crashes when
I do:

cventin:~/software/mutt/mutt> ./configure --[TAB]

cventin:~/software/mutt/mutt> gdb /usr/bin/zsh core
GNU gdb (Debian 7.10-1+b1) 7.10
[...]
Reading symbols from /usr/bin/zsh...Reading symbols from /usr/lib/debug/.build-id/40/ed59c9d46d5070800a6087db0691e68a1c311e.debug...done.
done.

warning: core file may not match specified executable file.
[New LWP 695]
Core was generated by `zsh'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000000000046f315 in charrefinc (x=0x6c58b8 <patinput>, 
    y=0x7fd0f708c3c4 <error: Cannot access memory at address 0x7fd0f708c3c4>, 
    z=0x7ffd49191418) at ../../Src/pattern.c:1937
(gdb) bt full
#0  0x000000000046f315 in charrefinc (x=0x6c58b8 <patinput>, 
    y=0x7fd0f708c3c4 <error: Cannot access memory at address 0x7fd0f708c3c4>, 
    z=0x7ffd49191418) at ../../Src/pattern.c:1937
        wc = 0 L'\000'
        ret = <optimized out>
#1  0x0000000000472a0a in patmatch (prog=prog@entry=0xa00948)
    at ../../Src/pattern.c:2718
        savpatinput = 0x7fd0f708c3b8 <error: Cannot access memory at address 0x7fd0f708c3b8>
        savchrop = 0xa00960 " "
        chin = <optimized out>
        chpa = <optimized out>
        badin = 0
        badpa = 0
        scan = 0xa00950
        next = <optimized out>
        opnd = <optimized out>
        start = <optimized out>
        save = <optimized out>
        chrop = 0xa00960 " "
        chrend = 0xa00961 ""
        compend = <optimized out>
        savglobflags = <optimized out>
        op = <optimized out>
        no = <optimized out>
        min = <optimized out>
        fail = 0
        saverrsfound = <optimized out>
        from = <optimized out>
        to = <optimized out>
        comp = <optimized out>
        nextch = <optimized out>
#2  0x00000000004746f1 in pattryrefs (prog=prog@entry=0xa00910, 
    string=string@entry=0x7fd0f7095b00 ' ' <repeats 26 times>, "[/usr/local]llTRAPCHLD", stringlen=stringlen@entry=38, unmetalenin=unmetalenin@entry=0, 
    patstralloc=<optimized out>, patstralloc@entry=0x7ffd491916d0, 
    patoffset=patoffset@entry=0, nump=0x0, begp=0x0, endp=0x0)
    at ../../Src/pattern.c:2457
        i = <optimized out>
        maxnpos = 0
        ret = <optimized out>
        origlen = 38
        sp = <optimized out>
        ep = <optimized out>
        ptr = <optimized out>
        progstr = <optimized out>
        patstralloc_struct = {unmetalen = 0, unmetalenp = 0, alloced = 0x0, 
          progstrunmeta = 0x0, progstrunmetalen = 0}
#3  0x0000000000474dff in pattrylen (prog=prog@entry=0xa00910, 
    string=string@entry=0x7fd0f7095b00 ' ' <repeats 26 times>, "[/usr/local]llTRAPCHLD", len=len@entry=38, unmetalen=unmetalen@entry=0, 
    patstralloc=patstralloc@entry=0x7ffd491916d0, offset=offset@entry=0)
    at ../../Src/pattern.c:2195
No locals.
#4  0x0000000000432959 in igetmatch (sp=sp@entry=0x7ffd491918d0, p=0xa00910, 
    fl=18, n=n@entry=1, replstr=<optimized out>, repllistp=repllistp@entry=0x0)
    at ../../Src/glob.c:2842
        s = <optimized out>
        t = <optimized out>
[...]

I'm attaching the full backtrace.

This seems quite random: I can sometimes reproduce the crash,
but not always.

Ditto from the mpfr working copy (instead of mutt), so that this is
not specific to some software.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)