core dump while completing: infinite recursion?

["Jun T." <takimoto-j@xxxxxxxxxxxxxxxxx>]

This bug is first repotred in the "Apple Discussion"
http://discussions.apple.com/thread.jspa?threadID=1303878&tstart=0

[1] Problem:
zsh (sometimes) core dumps if "case-insensitive" and "partial-completion" matchings are used simulatneously.

[2] How to reproduce the core dump:
Create a file _mycmd in $HOME/.zsh/functions/ with the following contents:

#compdef mycmd
_mydomains() {
        local -a list
        local expl
        list=( a.b.Cx a.b.cy a.b.cz )
        _wanted domains expl domain compadd -M 'r:|.=* r:|=*' -a list
}
_arguments  '*:domains:_mydomains'

and start a new zsh

% zsh -f
zsh% FPATH=$HOME/.zsh/fuctions:$FPATH
zsh% autoload -U compinit; compinit
zsh% zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}'
zsh% mycmd a.b.c<TAB>

If you hit <TAB>, zsh hangs and eventually core dumps after few seconds (or minutes). This happens at least on MacOSX and Linux, with zsh-4.3.4-dev-5.

[3] Notes:
It works normaly
if "zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}'" is not run, or
if "-M 'r:|.=* r:|=*'" is omitted from _mycmd, or
if the value of "list" is changed to either of
 list=( a.b.Cx a.b.cy )
 list=( a.b.cx a.b.cy a.b.cz )
 list=( b.Cx b.cy b.cz )

[4] Possible cause of the core dump:
It seems there is an infinite recursion of free_cline().
As can be seen in the gdb session log below, Cline list (tree) seems to have an loop "l == l->prefix". But I could not figure out where this loop was created.

% gdb =zsh pid_of_running_zsh
(gdb) b add_match_data
(gdb) cont
Continuing.

--- type 'mycmd a.b.c<TAB>' in the zsh being debugged ---

Breakpoint 1, add_match_data (alt=0, str=0x40009788 "a.b.Cx", 
    orig=0x9849118 "a.b.Cx", line=0x40009590, ipre=0x40009558 "", ripre=0x0, 
    isuf=0x40009560 "", pre=0x0, prpre=0x0, ppre=0x0, pline=0x0, psuf=0x0, 
    sline=0x0, suf=0x0, flags=0, exact=0) at compcore.c:2489
2489        char curchar, *t, *f, *fs, *fe, *new_str = NULL;
(gdb) cont
Continuing.

Breakpoint 1, add_match_data (alt=0, str=0x40009960 "a.b.cy", 
    orig=0x9849128 "a.b.cy", line=0x40009810, ipre=0x40009558 "", ripre=0x0, 
    isuf=0x40009560 "", pre=0x0, prpre=0x0, ppre=0x0, pline=0x0, psuf=0x0, 
    sline=0x0, suf=0x0, flags=0, exact=0) at compcore.c:2489
2489        char curchar, *t, *f, *fs, *fe, *new_str = NULL;
(gdb) cont
Continuing.

Breakpoint 1, add_match_data (alt=0, str=0x40009ba8 "a.b.cz", 
    orig=0x9847fd8 "a.b.cz", line=0x40009928, ipre=0x40009558 "", ripre=0x0, 
    isuf=0x40009560 "", pre=0x0, prpre=0x0, ppre=0x0, pline=0x0, psuf=0x0, 
    sline=0x0, suf=0x0, flags=0, exact=0) at compcore.c:2489
2489        char curchar, *t, *f, *fs, *fe, *new_str = NULL;
(gdb) b join_psfx
Breakpoint 2 at 0x4035dbb4: file compmatch.c, line 1782.
(gdb) cont
Continuing.

Breakpoint 2, join_psfx (ot=0x40009590, nt=0x40009928, orest=0x0, nrest=0x0, 
    sfx=0) at compmatch.c:1782
1782        Cline p = NULL, o, n;
(gdb) cont
Continuing.

Breakpoint 2, join_psfx (ot=0x40009718, nt=0x40009b20, orest=0x0, nrest=0x0, 
    sfx=0) at compmatch.c:1782
1782        Cline p = NULL, o, n;
(gdb) print ot->prefix->prefix
$1 = (Cline) 0x40009638
(gdb) print ot->prefix->prefix->prefix
$2 = (Cline) 0x40009638
(gdb) b free_cline
Breakpoint 3 at 0x40359644: file compmatch.c, line 147.
(gdb) cont
Continuing.

Breakpoint 3, free_cline (l=0x40009cc0) at compmatch.c:147
147         while (l) {
(gdb) print l
$3 = (Cline) 0x40009cc0
(gdb) print l->prefix
$4 = (Cline) 0x40009638
(gdb) print l->prefix->prefix
$5 = (Cline) 0x40009638
(gdb) cont
Continuing.

Breakpoint 3, free_cline (l=0x40009638) at compmatch.c:147
147         while (l) {
(gdb) cont
Continuing.

Breakpoint 3, free_cline (l=0x40009638) at compmatch.c:147
147         while (l) {
(gdb) bt
#0  free_cline (l=0x40009638) at compmatch.c:147
#1  0x40359674 in free_cline (l=0x40009638) at compmatch.c:151
#2  0x40359674 in free_cline (l=0x40009cc0) at compmatch.c:151
#3  0x4035e12a in join_psfx (ot=0x40009718, nt=0x40009b20, orest=0x0, 
    nrest=0x0, sfx=0) at compmatch.c:1916
#4  0x4035e4f9 in sub_join (a=0x40009718, b=0x40009b20, e=0x40009b20, anew=0)
    at compmatch.c:2019
#5  0x4035ee3e in join_clines (o=0x40009718, n=0x40009848) at compmatch.c:2244
#6  0x40357596 in add_match_data (alt=0, str=0x40009ba8 "a.b.cz", 
    orig=0x8d018c0 "a.b.cz", line=0x40009928, ipre=0x40009558 "", ripre=0x0, 
    isuf=0x40009560 "", pre=0x0, prpre=0x0, ppre=0x0, pline=0x0, psuf=0x0, 
    sline=0x0, suf=0x0, flags=0, exact=0) at compcore.c:2835
#7  0x40355c98 in addmatches (dat=0xbfdd50a4, argv=0x8cb4238)
    at compcore.c:2399
#8  0x4034c74f in bin_compadd (name=0x4039bbc8 "compadd", argv=0xbfdd514c, 
    ops=0xbfdd5190, func=0) at complete.c:638
#9  0x08052f4a in execbuiltin (args=0x4039bae8, bn=0x40368ae0) at builtin.c:438
#10 0x0806ec4c in execcmd (state=0xbfdd6ebc, input=0, output=0, how=2, last1=2)
    at exec.c:2925
#11 0x0806a844 in execpline2 (state=0xbfdd6ebc, pcode=2563, how=2, input=0, 
    output=0, last1=0) at exec.c:1489
#12 0x08069c26 in execpline (state=0xbfdd6ebc, slcode=5154, how=2, last1=0)
    at exec.c:1275
.....
#256 0x08082511 in loop (toplevel=1, justonce=0) at init.c:129
#257 0x080851ed in zsh_main (argc=2, argv=0xbfdec1e4) at init.c:1352
#258 0x08052626 in main (argc=0, argv=0x0) at ./main.c:93