Segfault in completion inside a [[]]

[emotn <emotn2@xxxxxxxxx>]

Hello,

zsh segfaults with the following testcase (also segfaults with fresh
built zsh, 4.3.10 and 4.2.7) in "zsh -f":
- type this line: if [[ -e / ]] { echo }
- put the cursor after the '/'
- press tab

The segfault doesn't happen if there is nothing between '{' and '}'.
If instead we add more arguments inside, zsh will eat up all the CPU.

The last faulty call (before libc) is in complist.c. It rightfully
tries to complete based on the fact it's in a "[[ ]]" but the
"clwords" variable wrongly points at what's inside the "{ }" (a.k.a
{"echo", "}", 0}).
Unfortunately, I don't know enough about zsh source for making it point right.