Core dump after calling "print -s" from user-defined widget

["Bart Schaefer" <schaefer@xxxxxxxxxxxxxxxx>]

Easily reproducible:

function kaboom() {
  print -s $LBUFFER
  zle history-incremental-search-backward
}
zle -N kaboom kaboom
bindkey ^Xs kaboom

Now type f u n C-x s and watch the core.  It actually doesn't matter what
zle command you use; following "print -s ...", doing anything in zle will
eventually bring about a crash of this same basic shape:

#0  0x8094d4a in metadiffer (s=0x0, r=0x80df4c8 "fun", len=3) at ../../zsh-3.1.4/Src/utils.c:2856
#1  0x809d523 in remember_edits () at ../../../zsh-3.1.4/Src/Zle/zle_hist.c:66
#2  0x809eb8a in doisearch (dir=-1) at ../../../zsh-3.1.4/Src/Zle/zle_hist.c:715
#3  0x809e87a in historyincrementalsearchbackward () at ../../../zsh-3.1.4/Src/Zle/zle_hist.c:628
#4  0x80a3f37 in execzlefunc (func=0x80c6274) at ../../../zsh-3.1.4/Src/Zle/zle_main.c:579
#5  0x80ac06c in bin_zle_call (name=0x80d374c "zle", args=0x80d381c, ops=0xbffff5a0 "", func=0 '\000') at ../../../zsh-3.1.4/Src/Zle/zle_thingy.c:471
#6  0x80abb9b in bin_zle (name=0x80d374c "zle", args=0x80d381c, ops=0xbffff5a0 "", func=0) at ../../../zsh-3.1.4/Src/Zle/zle_thingy.c:367
#7  0x804acff in execbuiltin (args=0x80d3744, bn=0x80c81ac) at ../../zsh-3.1.4/Src/builtin.c:352
#8  0x805a30f in execcmd (cmd=0x80d3724, input=0, output=0, how=2, last1=2) at ../../zsh-3.1.4/Src/exec.c:1806
#9  0x80576de in execpline2 (pline=0x80d3714, how=2, input=0, output=0, last1=0) at ../../zsh-3.1.4/Src/exec.c:902
#10 0x8056f56 in execpline (l=0x80d3700, how=2, last1=0) at ../../zsh-3.1.4/Src/exec.c:747
#11 0x8056b77 in execlist (list=0x80d36f0, dont_change_job=1, exiting=0) at ../../zsh-3.1.4/Src/exec.c:627
#12 0x805c84f in doshfunc (list=0x80dfcc0, doshargs=0x0, flags=0, noreturnval=1) at ../../zsh-3.1.4/Src/exec.c:2694
#13 0x80a3fe9 in execzlefunc (func=0x80df300) at ../../../zsh-3.1.4/Src/Zle/zle_main.c:596
#14 0x80a3b15 in zleread (lp=0x80ce288 "%m<%h> ", rp=0x0, ha=1) at ../../../zsh-3.1.4/Src/Zle/zle_main.c:501
#15 0x806d442 in inputline () at ../../zsh-3.1.4/Src/input.c:252
#16 0x806d305 in ingetc () at ../../zsh-3.1.4/Src/input.c:208
#17 0x8066b2b in hgetc () at ../../zsh-3.1.4/Src/hist.c:206
#18 0x8071fc4 in gettok () at ../../zsh-3.1.4/Src/lex.c:525
#19 0x8071745 in yylex () at ../../zsh-3.1.4/Src/lex.c:288
#20 0x80801bc in parse_event () at ../../zsh-3.1.4/Src/parse.c:99
#21 0x806b3ec in loop (toplevel=1, justonce=0) at ../../zsh-3.1.4/Src/init.c:96
#22 0x804a311 in main (argc=1, argv=0xbffffa54) at ../../zsh-3.1.4/Src/main.c:77

-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts              http://www.brasslantern.com