Crash/error with recursive-edit and set

[Mikael Magnusson <mikachu@gmail.com>]

% zsh -f
% foo() { zle recursive-edit; set > /dev/null }
% autoload -U narrow-to-region
% zle -N foo
% bindkey t foo
% '
foo: unmatched '

With my full rc loaded, this also results in a segfault.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  scanmatchtable (ht=0x1578f00, pprog=pprog@entry=0x0, sorted=sorted@entry=1,
    flags1=flags1@entry=0, flags2=flags2@entry=0, scanfunc=0x462431
<printparamnode>,
    scanflags=scanflags@entry=0) at hashtable.c:405
405            if ((!flags1 || ((*htp)->flags & flags1)) &&
(gdb) p *htp
$1 = (HashNode) 0x0
(gdb) bt
#0  scanmatchtable (ht=0x1578f00, pprog=pprog@entry=0x0, sorted=sorted@entry=1,
    flags1=flags1@entry=0, flags2=flags2@entry=0, scanfunc=0x462431
<printparamnode>,
    scanflags=scanflags@entry=0) at hashtable.c:405
#1  0x0000000000436fe4 in scanhashtable (ht=<optimized out>,
sorted=sorted@entry=1,
    flags1=flags1@entry=0, flags2=flags2@entry=0, scanfunc=<optimized out>,
    scanflags=scanflags@entry=0) at hashtable.c:444
#2  0x000000000040ffe4 in bin_set (nam=0x7f4767d5dd48 "set",
args=0x7f4767d5dd80,
    ops=<optimized out>, func=<optimized out>) at builtin.c:622
#3  0x000000000041d4e4 in execbuiltin (args=args@entry=0x7f4767d5dd18,
    bn=bn@entry=0x6ac360 <builtins+3392>) at builtin.c:450
#4  0x000000000042a9e5 in execcmd (state=<optimized out>, input=<optimized out>,
    output=<optimized out>, how=<optimized out>, last1=2) at exec.c:3471
#5  0x000000000042aef9 in execpline2 (state=0x7fffbf7548a0, pcode=67,
how=18, input=0,
    output=0, last1=0) at exec.c:1718
#6  0x000000000042b503 in execpline (state=state@entry=0x7fffbf7548a0,
    slcode=<optimized out>, how=how@entry=18, last1=0) at exec.c:1501
#7  0x000000000042c362 in execlist (state=state@entry=0x7fffbf7548a0,
    dont_change_job=dont_change_job@entry=1, exiting=exiting@entry=0)
at exec.c:1277
#8  0x000000000042c819 in execode (p=p@entry=0x165a780,
    dont_change_job=dont_change_job@entry=1, exiting=exiting@entry=0,
    context=context@entry=0x48e8d3 "shfunc") at exec.c:1074
#9  0x000000000042d483 in runshfunc (prog=0x165a780, wrap=0x0,
name=0x7f4767d5db78 "foo")
    at exec.c:5176
#10 0x000000000042d8a1 in doshfunc (shfunc=shfunc@entry=0x157d5c0,
    doshargs=doshargs@entry=0x0, noreturnval=noreturnval@entry=1) at exec.c:5046
#11 0x00007f4765aa0200 in execzlefunc (func=0x16b5f48, args=<optimized out>,
    args@entry=0x7f4765ccb1e8 <zlenoargs>,
set_bindk=set_bindk@entry=0) at zle_main.c:1394
#12 0x00007f4765aa03f9 in zlecore () at zle_main.c:1067
#13 0x00007f4765aa1045 in zleread (lp=<optimized out>, rp=<optimized out>,
    flags=<optimized out>, context=<optimized out>,
    init=init@entry=0x7f4765abb5af "zle-line-init",
---Type <return> to continue, or q <return> to quit---
    finish=finish@entry=0x7f4765abb59f "zle-line-finish") at zle_main.c:1256
#14 0x00007f4765aa2740 in zle_main_entry (cmd=<optimized out>,
ap=<optimized out>)
    at zle_main.c:1922
#15 0x00000000004410b9 in zleentry (cmd=cmd@entry=1) at init.c:1522
#16 0x0000000000441cdf in inputline () at input.c:288
#17 0x0000000000441fb6 in ingetc () at input.c:222
#18 0x000000000043b5b8 in ihgetc () at hist.c:390
#19 0x000000000044ab8c in gettok () at lex.c:604
#20 0x000000000044bba4 in zshlex () at lex.c:271
#21 0x0000000000468b77 in parse_event (endtok=endtok@entry=37) at parse.c:537
#22 0x000000000043e61b in loop (toplevel=toplevel@entry=1,
justonce=justonce@entry=0)
    at init.c:145
#23 0x00000000004413f7 in zsh_main (argc=<optimized out>,
argv=0x7fffbf7551d8) at init.c:1677
#24 0x000000000040f266 in main (argc=<optimized out>, argv=<optimized
out>) at ./main.c:93


-- 
Mikael Magnusson