coredump in "interactive mode" of "menu select"

["Jun T." <takimoto-j@xxxxxxxxxxxxxxxxx>]

Ignore this if this is a well known problem.

zsh-4.3.4 (or the latest CVS) coredumps in the "interactive mode" of
the "menu select"  completion.

zsh -f
zsh$ zmodload -i zsh/complist
zsh$ bindkey '^I' menu-complete
zsh$ bindkey -M menuselect '^O' vi-insert
zsh$ zstyle ':completion:*' menu select=0 on=long
zsh$ ls <TAB>

This brings up the "menu selection" screen, with the first entry selected
(highlited). Now go into the "interactive mode" by typing '^O'.
If I hit any key bound to "self-insert" (e.g., a key 's') in this mode,
then the zsh coredumps (access to bad address).
This happens at least on Linuxes and MacOSX (ppc and intel).

The coredump is at line 54 of zle_mics.c, in function doinsert()

            zleline[zlecs++] = *s;

Gdb shows that metafy_line() is called from docomlete() (zle_tricky.c:629)
when I hit <TAB>. After that, unmetafy_line()/metafy_line() pair are called
many times by zrefresh() and zhandleundo(), but when the execution enters
into doinsert() the buffer is metafied and zleline is NULL.

Multibyte support is turnd on (by default) in my zsh,
but 'unsetopt multibyte' or even './configure --disable-multibyte'
seems to have no effect.

Gdb back trace follows:

(gdb) bt
#0  0x002114af in doinsert (zstr=0xbffff19c, len=1) at zle_misc.c:54
#1  0x0021156b in selfinsert (args=0x232320) at zle_misc.c:71
#2  0x000e76d2 in domenuselect (dummy=0x263394, dat=0xbffff4ac) at complist.c:2546
#3  0x0004e269 in runhookdef (h=0x263394, d=0xbffff4ac) at module.c:990
#4  0x0024a5a7 in after_complete (dummy=0x2323fc, dat=0xbffff540) at compcore.c:515
#5  0x0004e2d2 in runhookdef (h=0x2323fc, d=0xbffff540) at module.c:996
#6  0x0021f3cd in docomplete (lst=0) at zle_tricky.c:869
#7  0x0021d939 in completeword (args=0x232320) at zle_tricky.c:232
#8  0x0021d81a in completecall (args=0x232320) at zle_tricky.c:208
#9  0x0020f370 in execzlefunc (func=0x22ff98, args=0x232320, set_bindk=0) at zle_main.c:1254
#10 0x0020e813 in zlecore () at zle_main.c:1019
#11 0x0020efc4 in zleread (lp=0xa0f40, rp=0x0, flags=7, context=0) at zle_main.c:1174
#12 0x00038d8a in inputline () at input.c:278
#13 0x00038b9c in ingetc () at input.c:214
#14 0x0002d819 in ihgetc () at hist.c:240
#15 0x00041960 in gettok () at lex.c:646
#16 0x00040e64 in yylex () at lex.c:350
#17 0x0005f9a9 in parse_event () at parse.c:451
#18 0x00035016 in loop (toplevel=1, justonce=0) at init.c:129
#19 0x0003871a in zsh_main (argc=1, argv=0xbffffad0) at init.c:1347
#20 0x000020ba in main (argc=1, argv=0xbffffad0) at main.c:93