Running:

> $ zsh -fc ': ${${(PAA)p[foo]}::=x}'` in current zsh versions causes:
>
> [1] 4441 segmentation fault (core dumped) zsh -fc ': ${${(PAA)p[foo]}::=x}'

Also happens when testing with machabot:

> 19:42 <jp> > : ${${(PAA)p[foo]}::=x}
> 19:42 <machabot> jp: zsh[248]: segfault at 0 ip b7dfcda3 sp bfeb9ebc
>       error 4 in libc-2.13.so[b7d84000+149000]

Add a simple `dupstring(s)` fallback.

Signed-off-by: Joey Pabalinas <joeypabalinas@gmail.com>
Requested-by: Bart Schaefer <schaefer@brasslantern.com>

 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Src/subst.c b/Src/subst.c
index d027e3d83cadc631a7..d159a92ae1bc1b9c10 100644
--- a/Src/subst.c
+++ b/Src/subst.c
@@ -2423,14 +2423,14 @@ paramsubst(LinkList l, LinkNode n, char **str, int qt, int pf_flags,
 	     * substitution.
 	     */
 	    if (isarr) {
-		if (aval[0] && aval[1]) {
+		if (!aval[0] || (aval[0] && aval[1])) {
 		    zerr("parameter name reference used with array");
 		    return NULL;
 		}
 		val = aval[0];
 		isarr = 0;
 	    }
-	    s = dyncat(val, s);
+	    s = val ? dyncat(val, s) : dupstring(s);
 	    /* Now behave po-faced as if it was always like that... */
 	    subexp = 0;
 	    /*
-- 
2.16.0

Incorpated your changes, although I feel like the conditional operator is
a better fit here (simpler and much more concise; making each possibility a
lone function call is one of the few uses of `?:` where the intent is
flat-out obvious).

Tested and works great:

> $ : ${${(PAA)p[foo]}::=x}
>
> zsh: parameter name reference used with array

-- 
Joey Pabalinas