Segfault completing: for f in 1; do <[here] x

[solo-zsh@xxxxxxxxxxxxx]

Hi!

I'm getting a segfault when trying to complete after the "<" in:
for f in 1; do < x

This happens every time, tested both on 5.0.0-2 Ubuntu,
4.3.17-1 Debian and git HEAD on Debian, and a nice guy/gal
on IRC reproduced it on HEAD/Debian too.

Derived from a much more reasonable:
for f in pom.xml **/pom.xml; do <pom[here] bar -O '//baz'

...which goes into 100% cpu usage sometimes.
(Yes, this code is obviously wrong, there was some ongoing brainfail.)


faux@om:~/code/zsh% git desc
zsh-5.0.2-130-gc5d9abc

faux@om:~/code/zsh% zsh --version
zsh 5.0.2-dev-0 (x86_64-unknown-linux-gnu)

faux@om:~/code/zsh% gdb --args zsh -f
GNU gdb (GDB) 7.4.1-debian
...
(gdb) r
Starting program: /home/faux/bin/zsh -f
...

om% for f in 1; do < x
Program received signal SIGSEGV, Segmentation fault.
0x00000000004a36ce in itype_end (ptr=0x0, itype=128, once=1) at utils.c:3581
3581            while (*ptr) {
(gdb) bt
#0  0x00000000004a36ce in itype_end (ptr=0x0, itype=128, once=1) at utils.c:3581
#1  0x00007ffff645af64 in get_comp_string () at zle_tricky.c:1481
#2  0x00007ffff64584d1 in docomplete (lst=4) at zle_tricky.c:666
#3  0x00007ffff6457907 in expandorcomplete (args=0x7ffff64770a8) at zle_tricky.c:315
#4  0x00007ffff6445541 in execzlefunc (func=0x7ffff6473538, args=0x7ffff64770a8, set_bindk=0) at zle_main.c:1339
#5  0x00007ffff6444715 in zlecore () at zle_main.c:1063
#6  0x00007ffff644508b in zleread (lp=0x4de940, rp=0x0, flags=3, context=0, init=0x7ffff6468d28 "zle-line-init", finish=0x7ffff6468d18 "zle-line-finish")
    at zle_main.c:1240
#7  0x00007ffff6447b4d in zle_main_entry (cmd=1, ap=0x7fffffffe1a0) at zle_main.c:1901
#8  0x000000000044d3d5 in zleentry (cmd=1) at init.c:1453
#9  0x000000000044e065 in inputline () at input.c:283
#10 0x000000000044dedc in ingetc () at input.c:219
#11 0x0000000000441e4b in ihgetc () at hist.c:279
#12 0x0000000000457b8f in gettok () at lex.c:714
#13 0x00000000004572f7 in zshlex () at lex.c:395
#14 0x0000000000478368 in parse_event () at parse.c:451
#15 0x000000000044a050 in loop (toplevel=1, justonce=0) at init.c:132
#16 0x000000000044d8e6 in zsh_main (argc=2, argv=0x7fffffffe558) at init.c:1619
#17 0x000000000041075c in main (argc=2, argv=0x7fffffffe558) at ./main.c:93


And, for the "pom" case, ctrl+c'ing it after a second or so:

om% for f in pom.xml **/pom.xml; do <pom bar -O '//baz'
Program received signal SIGINT, Interrupt.
__memset_x86_64 () at ../sysdeps/x86_64/multiarch/../memset.S:43
43      ../sysdeps/x86_64/multiarch/../memset.S: No such file or directory.
(gdb) bt
#0  __memset_x86_64 () at ../sysdeps/x86_64/multiarch/../memset.S:43
#1  0x00000000004a4f15 in mb_metacharlenconv_r (s=0x4fefa1 "", wcp=0x0, mbsp=0x4d43c8) at utils.c:4532
#2  0x00000000004a4ff4 in mb_metacharlenconv (s=0x4fefa1 "", wcp=0x0) at utils.c:4576
#3  0x00007ffff645b013 in get_comp_string () at zle_tricky.c:1495
#4  0x00007ffff64584d1 in docomplete (lst=4) at zle_tricky.c:666
#5  0x00007ffff6457907 in expandorcomplete (args=0x7ffff64770a8) at zle_tricky.c:315
#6  0x00007ffff6445541 in execzlefunc (func=0x7ffff6473538, args=0x7ffff64770a8, set_bindk=0) at zle_main.c:1339
#7  0x00007ffff6444715 in zlecore () at zle_main.c:1063
#8  0x00007ffff644508b in zleread (lp=0x4de940, rp=0x0, flags=3, context=0, init=0x7ffff6468d28 "zle-line-init", finish=0x7ffff6468d18 "zle-line-finish")
    at zle_main.c:1240
#9  0x00007ffff6447b4d in zle_main_entry (cmd=1, ap=0x7fffffffe1b0) at zle_main.c:1901
#10 0x000000000044d3d5 in zleentry (cmd=1) at init.c:1453
#11 0x000000000044e065 in inputline () at input.c:283
#12 0x000000000044dedc in ingetc () at input.c:219
#13 0x0000000000441e4b in ihgetc () at hist.c:279
#14 0x0000000000457b8f in gettok () at lex.c:714
#15 0x00000000004572f7 in zshlex () at lex.c:395
#16 0x0000000000478368 in parse_event () at parse.c:451
#17 0x000000000044a050 in loop (toplevel=1, justonce=0) at init.c:132
#18 0x000000000044d8e6 in zsh_main (argc=2, argv=0x7fffffffe568) at init.c:1619
#19 0x000000000041075c in main (argc=2, argv=0x7fffffffe568) at ./main.c:93

I'm not going anywhere near that kind of code,
so I hope someone else is up for it?

Chris.