Double-free crash in call to _values

[dana <dana@dana.is>]

[-- Attachment #1: Type: text/plain, Size: 1303 bytes --]

Hello,

This completion function —

#compdef foo
_values -S ':' 'val' 'val:val'

— crashes zsh when i enter the following at the command line:

% foo abcd:val:<tab>

On *zsh 5.3.1 (x86_64-apple-darwin16.6.0)* from Homebrew i get an error
like this (sometimes it complains about not finding some gibberish command
first):

-zsh(83431,0x7fffc0b9b3c0) malloc: *** error for object 0x7fce5fa19970:
pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug

I was also able to replicate on *zsh 5.1.1 (x86_64-ubuntu-linux-gnu)* from
Ubuntu 16.04, though the error it produces is less consistent. Here's one
example:

*** Error in `-zsh': munmap_chunk(): invalid pointer: 0x00000000015748f0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f21d02787e5]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x1a8)[0x7f21d0284ae8]
-zsh(freearray+0x21)[0x489ba1]
/usr/lib/x86_64-linux-gnu/zsh/5.1.1/zsh/complete.so(+0xa980)[0x7f21cf355980]
-zsh(runshfunc+0x91)[0x42e981]
-zsh(doshfunc+0x745)[0x42f335]
...

(Obviously when i encountered this 'in the wild' it was in a more useful
context, but i've tried to reduce the test case to the bare minimum.)

Please let me know if i can provide any other information. Cheers

dana