Completion problem on right hand side of assignment.

[Tanaka Akira <akr@xxxxxxxxxxx>]

zsh-3.1.5-pws-17 dumps core with following operation on BSD/OS 3.0.

Z:akr@rascal% ./Src/zsh -f
rascal% fpath=($PWD/Completion/*(/))
rascal% . Completion/Core/compinit   
rascal% A=D

Push <TAB> after "A=D".

rascal% A=Doc/

Push <TAB>.

rascal% A=Doc/
META-FAQ.yo      zsh.info-3       zshcompctl.1     zshoptions.1 
Makefile         zsh.info-4       zshcompctl.yo    zshoptions.yo 
Makefile.in      zsh.info-5       zshcompsys.1     zshparam.1 
Zsh/             zsh.info-6       zshcompsys.yo    zshparam.yo 
intro.ms         zsh.info-7       zshcompwid.1     zshzftpsys.1 
version.yo       zsh.info-8       zshcompwid.yo    zshzftpsys.yo 
zmacros.yo       zsh.info-9       zshexpn.1        zshzle.1 
zman.yo          zsh.texi         zshexpn.yo       zshzle.yo 
zsh.1            zsh.yo           zshmisc.1        ztexi.yo 
zsh.info         zshall.1         zshmisc.yo       
zsh.info-1       zshbuiltins.1    zshmodules.1     
zsh.info-2       zshbuiltins.yo   zshmodules.yo    

Push "Z" and <TAB>.

rascal% A=Doc/Zsh/
META-FAQ.yo      zsh.info-3       zshcompctl.1     zshoptions.1 
Makefile         zsh.info-4       zshcompctl.yo    zshoptions.yo 
Makefile.in      zsh.info-5       zshcompsys.1     zshparam.1 
Zsh/             zsh.info-6       zshcompsys.yo    zshparam.yo 
intro.ms         zsh.info-7       zshcompwid.1     zshzftpsys.1 
version.yo       zsh.info-8       zshcompwid.yo    zshzftpsys.yo 
zmacros.yo       zsh.info-9       zshexpn.1        zshzle.1 
zman.yo          zsh.texi         zshexpn.yo       zshzle.yo 
zsh.1            zsh.yo           zshmisc.1        ztexi.yo 
zsh.info         zshall.1         zshmisc.yo       
zsh.info-1       zshbuiltins.1    zshmodules.1     
zsh.info-2       zshbuiltins.yo   zshmodules.yo    

Push <TAB>.

rascal% A=Doc/Zsh/
arith.yo           files.yo           mod_clone.yo       modules.yo 
builtins.yo        func.yo            mod_comp1.yo       options.yo 
compat.yo          grammar.yo         mod_compctl.yo     params.yo 
compctl.yo         guide.yo           mod_deltochar.yo   prompt.yo 
compsys.yo         index.yo           mod_example.yo     redirect.yo 
compwid.yo         intro.yo           mod_files.yo       restricted.yo 
cond.yo            invoke.yo          mod_sched.yo       seealso.yo 
exec.yo            jobs.yo            mod_stat.yo        zftpsys.yo 
expn.yo            metafaq.yo         mod_zftp.yo        zle.yo 
filelist.yo        mod_cap.yo         mod_zle.yo         

Push <TAB>.

rascal% A=Doc/Zsh/zsh: segmentation fault (core dumped)  ./Src/zsh -f
Z:akr@rascal% 

Backtrace produced by re-linked zsh binary without -s option and
zsh.core is follows.

(gdb) where
#0  0x211aa in dupstring ()
#1  0x331e6 in arrdup ()
#2  0x3baf9 in comp_wrapper ()
#3  0xd823 in runshfunc ()
#4  0xd678 in doshfunc ()
#5  0x4e8e5 in callcompfunc ()
#6  0x4ee48 in makecomplist ()
#7  0x4de62 in docompletion ()
#8  0x48700 in docomplete ()
#9  0x47897 in expandorcomplete ()
#10 0x47652 in completecall ()
#11 0x41a26 in execzlefunc ()
#12 0x41778 in zleread ()
#13 0x19257 in inputline ()
#14 0x1918d in ingetc ()
#15 0x14fb1 in hgetc ()
#16 0x1c349 in gettok ()
#17 0x1bd75 in yylex ()
#18 0x26314 in parse_event ()
#19 0x17757 in loop ()
#20 0x1211 in main ()
(gdb)  

# Hmm, zsh binary with configure --enable-debug produce very short
# backtrace.

Also, I made zsh with following configuration.

  ./configure --enable-zsh-debug --enable-zsh-mem --enable-zsh-mem-debug --enable-zsh-mem-warning --enable-zsh-secure-free

This zsh binary does not dumps core immediately after above operation.
But it dumps core after input Ctrl-U "A=D" <TAB> <TAB> "Z" <TAB>.

Also, sometimes the binary print following message though I cannot
explain accurate operation to reproduce.

  BUG: attempt to free already free storage
  BUG: attempt to free storage at invalid address
-- 
Tanaka Akira