LISTMAX and menu select

[Tanaka Akira <akr@xxxxxxxxxxx>]

zsh dumps core as follows.

Z(2):akr@is27e1u11% Src/zsh -f
is27e1u11% bindkey -e; autoload -U compinit; compinit -D
is27e1u11% zstyle ':completion*:default' menu select=1
is27e1u11% LISTMAX=2
is27e1u11% ls M<TAB>
zsh: do you wish to see all 4 possibilities? n
is27e1u11% ls M<TAB>
zsh: do you wish to see all 4 possibilities? n
is27e1u11% ls META-FAQzsh: segmentation fault (core dumped)  Src/zsh -f

(gdb) where
#0  0xfefb5bc0 in domenuselect (dummy=0xff03695c, dat=0xffbeec38) at complist.c:898
#1  0x6d234 in runhookdef (h=0xff03695c, d=0xffbeec38) at module.c:1607
#2  0xff00bfbc in after_complete (dummy=0xff0ae504, dat=0xffbeedbc) at compcore.c:482
#3  0x6d2d8 in runhookdef (h=0xff0ae504, d=0xffbeedbc) at module.c:1613
#4  0xff088ac4 in docomplete (lst=0) at zle_tricky.c:751
#5  0xff086624 in expandorcomplete (args=0xff0ae458) at zle_tricky.c:260
#6  0xff0860d8 in completecall (args=0xff0ae458) at zle_tricky.c:165
#7  0xff076fc8 in execzlefunc (func=0xff0ac3b4, args=0xff0ae458) at zle_main.c:645
#8  0xff076aa4 in zleread (lp=0xd5c68 "%m%# ", rp=0x0, flags=3) at zle_main.c:564
#9  0x53ab4 in inputline () at input.c:265
#10 0x53880 in ingetc () at input.c:210
#11 0x490fc in ihgetc () at hist.c:242
#12 0x5ba70 in gettok () at lex.c:560
#13 0x5adcc in yylex () at lex.c:313
#14 0x7a020 in parse_event () at parse.c:292
#15 0x4fcf0 in loop (toplevel=1, justonce=0) at init.c:115
#16 0x1b2a8 in main (argc=2, argv=0xffbef474) at ./main.c:89
(gdb) 

This is reproduced on Debian GNU/Linux as well as Solaris 7.
-- 
Tanaka Akira