core dump in vichange()

["Jun T." <takimoto-j@xxxxxxxxxxxxxxxxx>]

The following causes a core dump in function vichange():

$ zsh -f
$ bindkey -v
$ echo foo
$ <ESC>kcw

k=up-line-or-history, c=vi-change, w=vi-forward-word
(or 'kc' followed by any motion command)

The core dump is at line 404 of zle_vi.c:
        vistartchange = curchange->prev->changeno;
with curchange->prev == NULL.


diff --git a/Src/Zle/zle_vi.c b/Src/Zle/zle_vi.c
index 994b44f..9e39143 100644
--- a/Src/Zle/zle_vi.c
+++ b/Src/Zle/zle_vi.c
@@ -401,7 +401,7 @@ vichange(UNUSED(char **args))
 	forekill(c2 - zlecs, CUT_RAW);
 	selectkeymap("main", 1);
 	viinsbegin = zlecs;
-	vistartchange = curchange->prev->changeno;
+	vistartchange = (curchange && curchange->prev) ? curchange->prev->changeno : 0;
     }
     return ret;
 }