[BUG] SIGSEGV under certain circumstances

[Chi-Hsuan Yen <yan12125@xxxxxxxxx>]

Hello zsh experts,

Yesterday I got SIGSEGV in zsh under certain circumstances. I'm on
Arch Linux x86_64. Steps to reproduce are:

1. Install the mpv media player. Seems the bug is related to its
completion script _mpv. On Arch Linux it's stored in
/usr/share/zsh/site-functions/_mpv. I have uploaded a copy to [1]
2. Use .zshrc at [2]
3. Create an empty file called 突然好想你-3565536.mp3 in $HOME
    Seems the filename affects how SIGSEGV occurs or not. Its content
is irrelevant.
4. Open a new terminal and run `mpv 突然好想你-3565536.mp3`. Then exit the
terminal to make sure that the mpv command is written to
~/.zsh_history
5. Open another new terminal, hit arrow up one or more times to the
previous mpv command.
6. Hit tab, then zsh crashes with SIGSEGV. The log under gdb can be found at [3]

My zsh version is d00931de5c2b7aa846daf137865dd05ac8d4be8a. I replaced
the value of `source` to git-master and rebuild the Arch Linux zsh
package. [4]

I can reproduce this bug with both QTerminal (a fork of Konsole) and
xfce4-terminal. So it's not a terminal-specific issue.

By the way, after those steps ~/.zsh_history seems corrupted:

$ head -n 2 ~/.zsh_history | tail -n 1 | xxd
00000000: 6d70 7620 e7aa 81e7 83a4 b6e5 a5bd e683  mpv ............
00000010: a3b3 e4bd 8380 2d33 3536 3535 3336 2e6d  ......-3565536.m
00000020: 7033 0a                                  p3.

$ echo -n 突然好想你 | xxd
00000000: e7aa 81e7 84b6 e5a5 bde6 83b3 e4bd a0  ...............

Chinese characters 突然好想你 map to:

e7aa81 e784b6 e5a5bd e683b3 e4bda0

in utf-8 (15 bytes, 3 bytes for each character). However, in
~/.zsh_history, the saved content is: (I reformatted it for easier
comparision with the correct version)

e7aa81 e783a4b6 e5a5bd e683a3b3 e4bd8380

Apparently the 2nd, 4th and 5th characters are corrupted. I'm not sure
whether it's related to the crash, though.

I know this bug is not easy to reproduce. Thanks for the patience in
reading this long letter!

Best,

Yen, Chi-Hsuan

[1] https://gist.github.com/yan12125/014c7a7510d1d9bd9ac8edf142a0c65d#file-_mpv
[2] https://gist.github.com/yan12125/014c7a7510d1d9bd9ac8edf142a0c65d#file-zshrc
[3] https://gist.github.com/yan12125/014c7a7510d1d9bd9ac8edf142a0c65d#file-backtrace
[4] https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/zsh