Core dump inserting completion

[Peter Stephenson <pws@xxxxxxxxxxxxxxxxx>]

I get the shell to crash every time with the following.

1. Pick a directory with menu selection
2. Use accept-line-and-down-history to browse the directory.
3. Hit return on some completion.

Here's a backtrace.

#0  0xd000db50 in strlen ()
#1  0xd0c25038 in instmatch (m=0x0, scs=0x2ff7eeb0) at zle_tricky.c:7655
#2  0xd0c25898 in do_single (m=0x0) at zle_tricky.c:7880
#3  0xd0c5fed8 in domenuselect (dummy=0xbadfca11, dat=0x2ff7f074)
    at complist.c:1020
#4  0x10051850 in runhookdef (h=0x20053e64, d=0x2ff7f074) at module.c:1443
#5  0xd0c1415c in docomplete (lst=0) at zle_tricky.c:1107
#6  0xd0c123e4 in expandorcomplete (args=0x2005a580) at zle_tricky.c:495
#7  0xd0c11f0c in completecall (args=0xbadfca11) at zle_tricky.c:394
#8  0xd0c0d2c0 in execzlefunc (func=0x200542d4, args=0x20053e38)
    at zle_main.c:628
#9  0xd0c0cf6c in zleread (lp=0x20059eac <Address 0x20059eac out of bounds>, 
    rp=0x1 "", flags=537239908) at zle_main.c:547
#10 0x1001d398 in inputline () at input.c:265
#11 0x1001d22c in ingetc () at input.c:210
#12 0x1000c3e0 in ihgetc () at hist.c:242
#13 0x100119d8 in gettok () at lex.c:545
#14 0x10010fb8 in yylex () at lex.c:308
#15 0x100527a0 in parse_event () at parse.c:105
#16 0x10009ee0 in loop (toplevel=1, justonce=0) at init.c:113
#17 0x100006c4 in main (argc=-1159738863, argv=0x20096618) at main.c:89
#18 0x1000042c in __start ()

strlen() is getting an invalid pointer.  This is not surprising as the
pointer is coming from dereferencing the NULL passed down to instmatch().
This traces back to the call
	do_single(*(minfo.cur));
in complist.c.  None of this tells me anything.

-- 
Peter Stephenson <pws@xxxxxxxxxxxxxxxxx>       Tel: +39 050 844536
WWW:  http://www.ifh.de/~pws/
Dipartimento di Fisica, Via Buonarroti 2, 56127 Pisa, Italy