segv with :_correct or :_correct:_approximate

["F. G. Marx" <fmarx@xxxxxxxxxxxxxxxxxxxxxxx>]

With `completer' set to either `completer=_complete:_correct' or
			       `completer=_complete:_correct:_approximate'
in the new Completion model, I'm seeing a segv.
`completer=_complete' appears o.k.

To reproduce it: attempt completion on any non-existent file, with
correction enabled.

gdb bt follows my compinit.dump.

compinit.dump
-------------
#files: 92
_comps=(
'-' '_precommand'
'-brace-parameter-' '_brace_parameter'
'-command-' '_command_names'
'-condition-' '_condition'
'-default-' '_default'
'-equal-' '_equal'
'-math-' '_math'
'-parameter-' '_parameter'
'-redirect-' '_redirect'
'-subscript-' '_subscript'
.
.
.
'xdvi' '_dvi'
'xfig' '_xfig'
'xping' '_hosts'
'zcat' '_gunzip'
'zle' '_zle'
'zmodload' '_zmodload'
'zmore' '_uncompress'
)

_patcomps=(
'zf* _zftp'
'*/X11/* _x_options'
)

zle -C _complete_list-choices list-choices _main_complete
zle -C _complete_menu-complete menu-complete _main_complete
zle -C _correct_filename complete-word _correct_filename
zle -C _correct_word complete-word _correct_word
zle -C _most_recent_file complete-word _most_recent_file
bindkey '^D' _complete_list-choices
bindkey '^I' _complete_menu-complete
bindkey '^XC' _correct_filename
bindkey '^Xc' _correct_word
bindkey '^Xm' _most_recent_file
bindkey '^[[[A' _complete_list-choices

autoload _a2ps _aliases _approximate _arrays _autoload
autoload _bg_jobs _bindkey _brace_parameter _builtin _cd
autoload _closequotes _command _command_names _compalso _complete
autoload _compress _condition _configure _correct _correct_filename
autoload _correct_word _dd _default _dirs _disable
autoload _dvi _echotc _enable _equal _expand
autoload _fc _files _find _functions _gunzip
autoload _gzip _hash _hosts _jobs _kill
autoload _limits _list _long_options _main_complete _make
autoload _man _match _math _menu _mh
autoload _most_recent_file _multi_parts _normal _oldlist _options
autoload _parameter _parameters _path_files _pdf _precommand
autoload _ps _rcs _redirect _rlogin _sched
autoload _sep_parts _set _set_options _setopt _source
autoload _stat _strip _stty _subscript _tar
autoload _tar_archive _tex _tilde _trap _uncompress
autoload _unhash _unset_options _unsetopt _vars _vars_eq
autoload _wait _which _x_options _xfig _zftp
autoload _zle _zmodload


gdb bt
------

[~shells/zsh-3.1.5-pws-20/Src 0] gdb zshg
gdb> r -l
Starting program: /src/source/shells/zsh-3.1.5-pws-20/Src/zshg -l

[~ 0] cd ~zsh/Completion
~zsh/Completion ~ ~shells/zsh-3.1.5-pws-20/Src
[~zsh/Completion 0] ls Core/_usx
Program received signal SIGSEGV, Segmentation fault.
0x400cfa03 in free () from /lib/libc.so.6
gdb> bt
#0  0x400cfa03 in free () from /lib/libc.so.6
#1  0x807ddc2 in zfree (p=0x80b65c0, sz=44) at mem.c:1280
#2  0x806c39c in freehistnode (nodeptr=0x80b65c0) at hashtable.c:1351
#3  0x806e306 in remhist () at hist.c:989
#4  0x80612b3 in execfuncdef (cmd=0x812a058) at exec.c:2703
#5  0x805f38b in execcmd (cmd=0x812a058, input=0, output=0, how=2, last1=2) at exec.c:1881
#6  0x805cc4e in execpline2 (pline=0x812a048, how=2, input=0, output=0, last1=0) at exec.c:1014
#7  0x805c440 in execpline (l=0x812a034, how=2, last1=0) at exec.c:858
#8  0x805c098 in execlist (list=0x812a024, dont_change_job=1, exiting=0) at exec.c:731
#9  0x80615cb in execautofn (cmd=0x8126238) at exec.c:2777
#10 0x805f38b in execcmd (cmd=0x8126238, input=0, output=0, how=2, last1=2) at exec.c:1881
#11 0x805cc4e in execpline2 (pline=0x8126228, how=2, input=0, output=0, last1=0) at exec.c:1014
#12 0x805c440 in execpline (l=0x8126214, how=2, last1=0) at exec.c:858
#13 0x805c098 in execlist (list=0x8126204, dont_change_job=1, exiting=0) at exec.c:731
#14 0x8061a5a in runshfunc (list=0x80d38a8, wrap=0x0, name=0x80d38c0 "_approximate") at exec.c:2922
#15 0x401bdb91 in comp_wrapper (list=0x80d38a8, w=0x0, name=0x80d38c0 "_approximate") at compctl.c:2368
#16 0x80619cf in runshfunc (list=0x80d38a8, wrap=0x401bfe88, name=0x80d38c0 "_approximate") at exec.c:2908
#17 0x80617fa in doshfunc (name=0x80d38c0 "_approximate", list=0x80d38a8, doshargs=0x8133d50, flags=128, noreturnval=0)
    at exec.c:2840
#18 0x80613f2 in execshfunc (cmd=0x8125e4c, shf=0x80d3828) at exec.c:2738
#19 0x805f50e in execcmd (cmd=0x8125e4c, input=0, output=0, how=2, last1=2) at exec.c:1917
#20 0x805cc4e in execpline2 (pline=0x8133d40, how=2, input=0, output=0, last1=0) at exec.c:1014
#21 0x805c440 in execpline (l=0x8133d2c, how=2, last1=0) at exec.c:858
#22 0x805c0b2 in execlist (list=0x8133d1c, dont_change_job=1, exiting=0) at exec.c:737
#23 0x80615cb in execautofn (cmd=0x8132ab0) at exec.c:2777
#24 0x805f38b in execcmd (cmd=0x8132ab0, input=0, output=0, how=2, last1=2) at exec.c:1881
#25 0x805cc4e in execpline2 (pline=0x8132aa0, how=2, input=0, output=0, last1=0) at exec.c:1014
#26 0x805c440 in execpline (l=0x8132a8c, how=2, last1=0) at exec.c:858
#27 0x805c098 in execlist (list=0x8132a7c, dont_change_job=1, exiting=0) at exec.c:731
#28 0x8061a5a in runshfunc (list=0x80d4368, wrap=0x0, name=0x80d4380 "_correct") at exec.c:2922
#29 0x401bdb91 in comp_wrapper (list=0x80d4368, w=0x0, name=0x80d4380 "_correct") at compctl.c:2368
#30 0x80619cf in runshfunc (list=0x80d4368, wrap=0x401bfe88, name=0x80d4380 "_correct") at exec.c:2908
#31 0x80617fa in doshfunc (name=0x80d4380 "_correct", list=0x80d4368, doshargs=0x8132980, flags=128, noreturnval=0) at exec.c:2840
#32 0x80613f2 in execshfunc (cmd=0x8132960, shf=0x80d42e8) at exec.c:2738
#33 0x805f50e in execcmd (cmd=0x8132960, input=0, output=0, how=2, last1=2) at exec.c:1917
#34 0x805cc4e in execpline2 (pline=0x8132950, how=2, input=0, output=0, last1=0) at exec.c:1014
#35 0x805c440 in execpline (l=0x813293c, how=2, last1=0) at exec.c:858
#36 0x805c0b2 in execlist (list=0x813292c, dont_change_job=1, exiting=0) at exec.c:737
#37 0x807a0e8 in execfor (cmd=0x81324f0) at loop.c:104
#38 0x805f38b in execcmd (cmd=0x81324f0, input=0, output=0, how=2, last1=2) at exec.c:1881
#39 0x805cc4e in execpline2 (pline=0x81324e0, how=2, input=0, output=0, last1=0) at exec.c:1014
#40 0x805c440 in execpline (l=0x81324cc, how=2, last1=0) at exec.c:858
#41 0x805c098 in execlist (list=0x81324bc, dont_change_job=1, exiting=0) at exec.c:731
#42 0x80615cb in execautofn (cmd=0x81089e4) at exec.c:2777
#43 0x805f38b in execcmd (cmd=0x81089e4, input=0, output=0, how=2, last1=2) at exec.c:1881
#44 0x805cc4e in execpline2 (pline=0x81089d4, how=2, input=0, output=0, last1=0) at exec.c:1014
#45 0x805c440 in execpline (l=0x81089c0, how=2, last1=0) at exec.c:858
#46 0x805c098 in execlist (list=0x81089b0, dont_change_job=1, exiting=0) at exec.c:731
#47 0x8061a5a in runshfunc (list=0x80d53e0, wrap=0x0, name=0x80edf38 "_main_complete") at exec.c:2922
#48 0x401bdb91 in comp_wrapper (list=0x80d53e0, w=0x0, name=0x80edf38 "_main_complete") at compctl.c:2368
#49 0x80619cf in runshfunc (list=0x80d53e0, wrap=0x401bfe88, name=0x80edf38 "_main_complete") at exec.c:2908
#50 0x80617fa in doshfunc (name=0x80edf38 "_main_complete", list=0x80d53e0, doshargs=0x0, flags=0, noreturnval=1) at exec.c:2840
#51 0x4019be67 in callcompfunc (s=0x80bd7a4 "Core/_usx", fn=0x80edf38 "_main_complete") at zle_tricky.c:4507
#52 0x4019c625 in makecomplist (s=0x80bd7a4 "Core/_usx", incmd=0, lst=0) at zle_tricky.c:4659
#53 0x4019b03c in docompletion (s=0x80b98e0 "Core/_usx", lst=0, incmd=0) at zle_tricky.c:4223
#54 0x40192a86 in docomplete (lst=0) at zle_tricky.c:1005
#55 0x40191247 in menucomplete () at zle_tricky.c:406
#56 0x40191111 in completecall () at zle_tricky.c:376
#57 0x401874d0 in execzlefunc (func=0x80edf50) at zle_main.c:624
#58 0x40186f48 in zleread (lp=0x80b9e70 "[%~ 0] ", rp=0x0, flags=3) at zle_main.c:543
#59 0x8072984 in inputline () at input.c:263
#60 0x807286d in ingetc () at input.c:208
#61 0x806c65b in hgetc () at hist.c:223
#62 0x80773ad in gettok () at lex.c:526
#63 0x8076d39 in yylex () at lex.c:289
#64 0x8086c8c in parse_event () at parse.c:99
#65 0x80708ff in loop (toplevel=1, justonce=0) at init.c:100
#66 0x80506b9 in main (argc=2, argv=0xbffff7d4) at ./main.c:77
gdb> q
The program is running.  Exit anyway? (y or n) y