Important bugfix to beta13

[Zoltan Hidvegi <hzoli@xxxxxxxxxx>]

The patch below fixes a serious bug in doexpandhist.  So far each completion
used some already freed memory but it was only noticable on long lines.  This
caused strange random crashes sometimes (e.g. when editing files in zed
when magic-space is bound to space).  The patch is against the vanilla beta13
release.

Cheers,

Zoltan

diff -u Src/zle_tricky.c.orig Src/zle_tricky.c
--- Src/zle_tricky.c.orig	Tue Jan  2 21:52:36 1996
+++ Src/zle_tricky.c	Tue Jan  2 21:55:28 1996
@@ -3863,8 +3863,6 @@
     errflag = zleparse = 0;
     lexrestore();
     expanding = 0;
-    popheap();
-    permalloc();
     cs = (ce ? ll : excs);
 
     /* Compensate for the added space above. */
@@ -3883,6 +3881,8 @@
 	references like everything else, rather than doing the whole line? */
 	if (viinsbegin > findbol())
 	    viinsbegin = findbol();
+	popheap();
+	permalloc();
 	return 1;
     }
 
@@ -3890,6 +3890,8 @@
     ll = oll;
     cs = ocs;
 
+    popheap();
+    permalloc();
     return 0;
 }