[BUG] Zsh crashes when reverse-menu-complete is invoked during complist MENUSELECT without 'menu:' in $compstate[insert]

[BUG] Zsh crashes when reverse-menu-complete is invoked during complist MENUSELECT without 'menu:' in $compstate[insert]

[Marlon Richert]

Given:
  * complist's MENUSELECT mode is active
  * $compstate[insert] does not start with 'menu:'
When:
  * The user activates reverse-menu-complete.
Then:
  * Zsh crashes.

Expected behavior:
  * Move to the previous completion in the menu.

Steps to reproduce:
% zmodload zsh/complist
% tst() { compadd bar baz; compstate[insert]=1 }
% zle -C tst menu-select tst
% bindkey '^I' tst
% bindkey -M menuselect '^[[Z' reverse-menu-complete
% ba^I^[[Z

Re: [BUG] Zsh crashes when reverse-menu-complete is invoked during complist MENUSELECT without 'menu:' in $compstate[insert]

[Oliver Kiddle]

On 27 May, Marlon Richert wrote:
> Given:
>   * complist's MENUSELECT mode is active
>   * $compstate[insert] does not start with 'menu:'
> When:
>   * The user activates reverse-menu-complete.
> Then:
>   * Zsh crashes.

It calls reversemenucomplete() which is a function that pre-dates menu
selection. The path down which it clears minfo didn't look appropriate
from within menu selection. But it doesn't crash for forward menu
completion. Taking the same code path as for forward completion but
with zmult negated appears to work fine and would seem logical enough.
But perhaps there's some aspect to reversemenucomplete() that would be
needed so it'd be good if this can get some further testing.

Oliver

diff --git a/Src/Zle/complist.c b/Src/Zle/complist.c
index 429c8159f..353cb3562 100644
--- a/Src/Zle/complist.c
+++ b/Src/Zle/complist.c
@@ -3277,9 +3277,8 @@ domenuselect(Hookdef dummy, Chdata dat)
 		   !strcmp(cmd->nam, "reverse-menu-complete")) {
             mode = 0;
 	    comprecursive = 1;
-	    unmetafy_line();
-	    reversemenucomplete(zlenoargs);
-	    metafy_line();
+	    zmult = -zmult;
+	    do_menucmp(0);
 	    mselect = (*(minfo.cur))->gnum;
 	    setwish = 1;
 	    mline = -1;