Crash in reverse-menu-complete with menu-selection

[Mikael Magnusson <mikachu@xxxxxxxxx>]

% zsh -f
% autoload compinit
% compinit -D
% zmodload zsh/complist
% bindkey '^F' menu-select
% bindkey '^B' reverse-menu-complete
% ls <ctrl-f><enter><ctrl-f><ctrl-b>

(btw, I just realized after a couple of years if you do 'alias %=' in
the zsh -f you can paste things like these more easily).

Reproduced on 4.3.2 (32bit), 4.3.6 and current cvs.

I'm posting this in the hope that the crash might be obvious to
someone, if not, I can dig around myself for a while and see if I can
turn anything up.

Program received signal SIGSEGV, Segmentation fault.
0x00007fc96a4b5f92 in memcpy () from /lib/libc.so.6
(gdb) bt
#0  0x00007fc96a4b5f92 in memcpy () from /lib/libc.so.6
#1  0x00007fc969bfba5a in setlastline () at zle_utils.c:1139
#2  0x00007fc969bf20a7 in docomplete (lst=0) at zle_tricky.c:608
#3  0x00007fc969bf142e in menucomplete (args=0x7fc969e0e928) at zle_tricky.c:247
#4  0x00007fc969bf17b6 in reversemenucomplete (args=0x7fc969e0e928) at
zle_tricky.c:349
#5  0x00007fc968f516cc in domenuselect (dummy=0x0, dat=0x0) at complist.c:3220
#6  0x00007fc968f51f39 in menuselect (args=0x7fc969e0e928) at complist.c:3383
#7  0x00007fc969be017d in execzlefunc (func=0xac28c0,
args=0x7fc969e0e928, set_bindk=0)
    at zle_main.c:1333
#8  0x00007fc969bdf524 in zlecore () at zle_main.c:1058
#9  0x00007fc969bdfc91 in zleread (lp=0x6c1998, rp=0x0, flags=3, context=0)
    at zle_main.c:1227
#10 0x00007fc969be1fdd in zle_main_entry (cmd=1, ap=0x7fff182fd710) at
zle_main.c:1889
#11 0x0000000000444a62 in zleentry (cmd=1) at init.c:1354
#12 0x00000000004454bb in inputline () at input.c:281
#13 0x0000000000445332 in ingetc () at input.c:217
#14 0x000000000043b02a in ihgetc () at hist.c:279
#15 0x000000000044d46c in gettok () at lex.c:694
#16 0x000000000044cc51 in zshlex () at lex.c:381
#17 0x000000000046a0fb in parse_event () at parse.c:451
#18 0x0000000000441e01 in loop (toplevel=1, justonce=0) at init.c:132
#19 0x0000000000444f31 in zsh_main (argc=2, argv=0x7fff182fdad8) at init.c:1508
#20 0x0000000000410634 in main (argc=2, argv=0x7fff182fdad8) at ./main.c:93
(gdb) bt full
#0  0x00007fc96a4b5f92 in memcpy () from /lib/libc.so.6
No symbol table info available.
#1  0x00007fc969bfba5a in setlastline () at zle_utils.c:1139
No locals.
#2  0x00007fc969bf20a7 in docomplete (lst=0) at zle_tricky.c:608
        active = 1
        s = 0x7fc969bbe000 "\177ELF\002\001\001"
        ol = 0x7fc96b082452 "H\211\303d\213\004%\030"
        olst = 0
        chl = 0
        ne = 0
        ocs = 1760837632
        ret = 0
        dat = {0, 0}
#3  0x00007fc969bf142e in menucomplete (args=0x7fc969e0e928) at zle_tricky.c:247
No locals.
#4  0x00007fc969bf17b6 in reversemenucomplete (args=0x7fc969e0e928) at
zle_tricky.c:349
No locals.
#5  0x00007fc968f516cc in domenuselect (dummy=0x0, dat=0x0) at complist.c:3220
        fdat = 0x0
        lastsearch = 0x0
        p = 0xb29f30
        pg = 0xb33510
        cmd = 0x7fc969e0b9c0
        do_last_key = 0
        u = 0x0
        i = 1
        acc = 0
        wishcol = 0
        setwish = 0
        oe = 0
        wasnext = 0
        space = 31
        lbeg = 0
        step = 1
        wrap = 32767
        pl = 1
        broken = 0
        first = 0
        nolist = 0
        mode = 0
        modecs = 12
        modell = 12
        modelen = 8
        wasmeta = 0
        s = 0x0
        status =
"\000}Ej\311\177\000\000\200\342\244\000\000\000\000\000k\354\245\000\000\000\000\000l\354\245",
'\000' <repeats 13 times>,
"\033\315Kj\311\177\000\000\000\000\000\000\377\177\000\000\001\000\000\000\000\000\000\000\320\332/\030\377\177\000\000u\205\bk\311\177\000\000\277\322/\030\377\177\000\000\000\322/\030\377\177\000\000\000\000\000\000\000\000\000\000\001\000\000\000\004",
'\000' <repeats 11 times>, "H\322/\030\377\177\000"
        modeline = 0x7fc96b286508 "ls alt-home/"
#6  0x00007fc968f51f39 in menuselect (args=0x7fc969e0e928) at complist.c:3383
        d = 0
#7  0x00007fc969be017d in execzlefunc (func=0xac28c0,
args=0x7fc969e0e928, set_bindk=0)
    at zle_main.c:1333
        wflags = 645
        r = 0
        ret = 0
        remetafy = 0
        w = 0xae08a0
        save_bindk = 0xac28c0
#8  0x00007fc969bdf524 in zlecore () at zle_main.c:1058
No locals.
#9  0x00007fc969bdfc91 in zleread (lp=0x6c1998, rp=0x0, flags=3, context=0)
    at zle_main.c:1227
        s = 0x0
        old_errno = 4
        tmout = 0
        initthingy = 0x0
#10 0x00007fc969be1fdd in zle_main_entry (cmd=1, ap=0x7fff182fd710) at
zle_main.c:1889
        lp = 0x6c1998
        rp = 0x0
        flags = 3
        context = 0
#11 0x0000000000444a62 in zleentry (cmd=1) at init.c:1354
        ret = 0x0
        ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area =
0x7fff182fd810,
            reg_save_area = 0x7fff182fd750}}
#12 0x00000000004454bb in inputline () at input.c:281
        flags = 3
        ingetcline = 0x0
        ingetcpmptl = 0x6c1998
        ingetcpmptr = 0x0
        context = 0
#13 0x0000000000445332 in ingetc () at input.c:217
        lastc = 0
#14 0x000000000043b02a in ihgetc () at hist.c:279
        c = 0
#15 0x000000000044d46c in gettok () at lex.c:694
        c = 0
        d = 0
        peekfd = -1
        peek = 0
#16 0x000000000044cc51 in zshlex () at lex.c:381
No locals.
#17 0x000000000046a0fb in parse_event () at parse.c:451
No locals.
#18 0x0000000000441e01 in loop (toplevel=1, justonce=0) at init.c:132
        prog = 0x7fc96b2865e0
        err = 0
        non_empty = 1
#19 0x0000000000444f31 in zsh_main (argc=2, argv=0x7fff182fdad8) at init.c:1508
        t = 0x7fff182fdae8
        runscript = 0x0
        t0 = 158
#20 0x0000000000410634 in main (argc=2, argv=0x7fff182fdad8) at ./main.c:93
No locals.
(gdb)


-- 
Mikael Magnusson