Breakage with compctl?

[duvall@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (Danek Duvall)]

-----BEGIN PGP SIGNED MESSAGE-----

This problem occurs on both zsh 3.0.2 (on Linux) and zsh 3.1.0 (on Solaris).

Run zsh -f and source a file containing the following:

    friends=( duvall )

    _machines=( lorien.princeton.edu cassius.mts.jhu.edu )

    function _get_hosts {
      typeset -l _user
      reply=()
      read -l
      _user=($=REPLY)
      reply=($_machines)
    }

    compctl -q -k friends -S @ -x 'n[0,@]' -K _get_hosts -- finger talk ytalk

Now type:

    % finger duvall@lo<TAB>

Which expands to

    % finger duvall@xxxxxxxxxxxxxxxxxxxx _

Now erase back to the @:

    % finger duvall@_

and expand:

    % <lots of garbage>

After this, it seems zsh is pretty screwed up.  I've managed to get both
bus errors and segmentation faults.  Sometimes it happens when hitting
control-C, sometimes it doesn't happen for a while.

Anyway, I can regularly reproduce this.  Anyone else seen this?  I can
recompile and get a stack trace if that would be of any help.

Thanks,
Danek

- -- 
Danek Duvall <duvall@xxxxxxxxxxxxxxxxxxxx>      PGP keyID: 1024/280CEFB5
Computer Science, Princeton University      F-print: 55 FD E0 AE 19 1C 7D DA
http://lorien.princeton.edu/~duvall/                 E5 D0 56 B2 48 5F A7 A9

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCUAwUBMtcDPXusfJIoDO+1AQHNYQP2Lf9H6clakJHJO2C/Jgs6+pVmxMxDkqav
9w9gzlPt6sdzDL5vhbP0a4rQ4/eHjevqDH/PSvS4b7ZxBvNJ2OOMw/gtDFt0YLsu
SKewuvQeKIWPdaAqNZepxxHZn0huYDwyV4h3WwkOm6EEO/SLdqs2UuaK2JIhLKPb
W/ma/5tnoQ==
=PifX
-----END PGP SIGNATURE-----