zsh 5.3.1 crashes on completion

[ChenYao <chenyao@xxxxxxxxxxx>]

Hi,

It seems that zsh is attempting to double free memory when autocompleting `fc` or `r`.  And it causes zsh crash.

% echo $ZSH_VERSION
5.3.1
% `r`<press tab here>
*** glibc detected *** ./zsh: double free or corruption (fasttop): 0x0000000000887940 ***
======= Backtrace: =========
/lib64/libc.so.6[0x390e275e66]
./zsh(hend+0x5d4)[0x445f04]
./zsh(loop+0x6a)[0x4492ba]
./zsh(bin_fc+0x1c27)[0x4223f7]
./zsh(execbuiltin+0x42c)[0x42543c]
./zsh[0x42f251]
./zsh[0x42fcf2]
./zsh[0x430126]
./zsh(execlist+0x962)[0x4322e2]
./zsh(execode+0xa6)[0x432656]
./zsh(getoutput+0x3e9)[0x4353c9]
./zsh[0x489f30]
./zsh(prefork+0x99)[0x48f159]
/root/zsh-test/lib/zsh/5.3.1/zsh/zle.so(+0x339a7)[0x7ffc74e699a7]
/root/zsh-test/lib/zsh/5.3.1/zsh/zle.so(+0x36b10)[0x7ffc74e6cb10]
/root/zsh-test/lib/zsh/5.3.1/zsh/zle.so(completecall+0x40)[0x7ffc74e677c0]
/root/zsh-test/lib/zsh/5.3.1/zsh/zle.so(execzlefunc+0x76e)[0x7ffc74e5638e]
/root/zsh-test/lib/zsh/5.3.1/zsh/zle.so(zlecore+0x126)[0x7ffc74e567c6]
/root/zsh-test/lib/zsh/5.3.1/zsh/zle.so(zleread+0x70f)[0x7ffc74e5739f]
./zsh(zleentry+0xce)[0x44716e]
./zsh(ingetc+0x2ee)[0x44c21e]
./zsh[0x444266]
./zsh(zshlex+0x6e)[0x45637e]
./zsh(parse_event+0x26)[0x479216]
./zsh(loop+0x56)[0x4492a6]
./zsh(zsh_main+0x4ee)[0x44ac4e]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x390e21ed5d]
./zsh[0x40f319]
======= Memory map: ========
00400000-004b9000 r-xp 00000000 ca:01 1093254                            /root/zsh-test/bin/zsh
006b8000-006bf000 rw-p 000b8000 ca:01 1093254                            /root/zsh-test/bin/zsh
006bf000-006d2000 rw-p 00000000 00:00 0 
01884000-019ca000 rw-p 00000000 00:00 0                                  [heap]
339e800000-339e817000 r-xp 00000000 ca:01 303042                         /lib64/libpthread-2.12.so
339e817000-339ea17000 ---p 00017000 ca:01 303042                         /lib64/libpthread-2.12.so
339ea17000-339ea18000 r--p 00017000 ca:01 303042                         /lib64/libpthread-2.12.so
339ea18000-339ea19000 rw-p 00018000 ca:01 303042                         /lib64/libpthread-2.12.so
339ea19000-339ea1d000 rw-p 00000000 00:00 0 
390da00000-390da20000 r-xp 00000000 ca:01 262158                         /lib64/ld-2.12.so
390dc1f000-390dc20000 r--p 0001f000 ca:01 262158                         /lib64/ld-2.12.so
390dc20000-390dc21000 rw-p 00020000 ca:01 262158                         /lib64/ld-2.12.so
390dc21000-390dc22000 rw-p 00000000 00:00 0 
390e200000-390e38a000 r-xp 00000000 ca:01 262162                         /lib64/libc-2.12.so
390e38a000-390e58a000 ---p 0018a000 ca:01 262162                         /lib64/libc-2.12.so
390e58a000-390e58e000 r--p 0018a000 ca:01 262162                         /lib64/libc-2.12.so
390e58e000-390e58f000 rw-p 0018e000 ca:01 262162                         /lib64/libc-2.12.so
390e58f000-390e594000 rw-p 00000000 00:00 0 
390ea00000-390ea02000 r-xp 00000000 ca:01 262166                         /lib64/libdl-2.12.so
390ea02000-390ec02000 ---p 00002000 ca:01 262166                         /lib64/libdl-2.12.so
390ec02000-390ec03000 r--p 00002000 ca:01 262166                         /lib64/libdl-2.12.so
390ec03000-390ec04000 rw-p 00003000 ca:01 262166                         /lib64/libdl-2.12.so
390f200000-390f283000 r-xp 00000000 ca:01 262273                         /lib64/libm-2.12.so
390f283000-390f482000 ---p 00083000 ca:01 262273                         /lib64/libm-2.12.so
390f482000-390f483000 r--p 00082000 ca:01 262273                         /lib64/libm-2.12.so
390f483000-390f484000 rw-p 00083000 ca:01 262273                         /lib64/libm-2.12.so
39d8200000-39d8216000 r-xp 00000000 ca:01 269638                         /lib64/libgcc_s-4.4.7-20120601.so.1
39d8216000-39d8415000 ---p 00016000 ca:01 269638                         /lib64/libgcc_s-4.4.7-20120601.so.1
39d8415000-39d8416000 rw-p 00015000 ca:01 269638                         /lib64/libgcc_s-4.4.7-20120601.so.1
39ed000000-39ed007000 r-xp 00000000 ca:01 303046                         /lib64/librt-2.12.so
39ed007000-39ed206000 ---p 00007000 ca:01 303046                         /lib64/librt-2.12.so
39ed206000-39ed207000 r--p 00006000 ca:01 303046                         /lib64/librt-2.12.so
39ed207000-39ed208000 rw-p 00007000 ca:01 303046                         /lib64/librt-2.12.so
3c7a800000-3c7a81d000 r-xp 00000000 ca:01 274439                         /lib64/libtinfo.so.5.7
3c7a81d000-3c7aa1c000 ---p 0001d000 ca:01 274439                         /lib64/libtinfo.so.5.7
3c7aa1c000-3c7aa20000 rw-p 0001c000 ca:01 274439                         /lib64/libtinfo.so.5.7
3c7aa20000-3c7aa21000 rw-p 00000000 00:00 0 
3c7ac00000-3c7ac2e000 r-xp 00000000 ca:01 262236                         /lib64/libncursesw.so.5.7
3c7ac2e000-3c7ae2d000 ---p 0002e000 ca:01 262236                         /lib64/libncursesw.so.5.7
3c7ae2d000-3c7ae2e000 rw-p 0002d000 ca:01 262236                         /lib64/libncursesw.so.5.7
7ffc73781000-7ffc73791000 r-xp 00000000 ca:01 1093263                    /root/zsh-test/lib/zsh/5.3.1/zsh/computil.so
7ffc73791000-7ffc73990000 ---p 00010000 ca:01 1093263                    /root/zsh-test/lib/zsh/5.3.1/zsh/computil.so
7ffc73990000-7ffc73991000 rw-p 0000f000 ca:01 1093263                    /root/zsh-test/lib/zsh/5.3.1/zsh/computil.so
7ffc73991000-7ffc73992000 rw-p 00000000 00:00 0 
7ffc73992000-7ffc73995000 r-xp 00000000 ca:01 1093255                    /root/zsh-test/lib/zsh/5.3.1/zsh/rlimits.so
7ffc73995000-7ffc73b95000 ---p 00003000 ca:01 1093255                    /root/zsh-test/lib/zsh/5.3.1/zsh/rlimits.so
7ffc73b95000-7ffc73b96000 rw-p 00003000 ca:01 1093255                    /root/zsh-test/lib/zsh/5.3.1/zsh/rlimits.so
7ffc73b96000-7ffc73b98000 r-xp 00000000 ca:01 1093266                    /root/zsh-test/lib/zsh/5.3.1/zsh/zleparameter.so
7ffc73b98000-7ffc73d97000 ---p 00002000 ca:01 1093266                    /root/zsh-test/lib/zsh/5.3.1/zsh/zleparameter.so
7ffc73d97000-7ffc73d98000 rw-p 00001000 ca:01 1093266                    /root/zsh-test/lib/zsh/5.3.1/zsh/zleparameter.so
7ffc73d98000-7ffc73d9a000 r-xp 00000000 ca:01 1093259                    /root/zsh-test/lib/zsh/5.3.1/zsh/terminfo.so
7ffc73d9a000-7ffc73f99000 ---p 00002000 ca:01 1093259                    /root/zsh-test/lib/zsh/5.3.1/zsh/terminfo.so
7ffc73f99000-7ffc73f9a000 rw-p 00001000 ca:01 1093259                    /root/zsh-test/lib/zsh/5.3.1/zsh/terminfo.so
7ffc73f9a000-7ffc73fa1000 r-xp 00000000 ca:01 1093260                    /root/zsh-test/lib/zsh/5.3.1/zsh/zutil.so
7ffc73fa1000-7ffc741a0000 ---p 00007000 ca:01 1093260                    /root/zsh-test/lib/zsh/5.3.1/zsh/zutil.so
7ffc741a0000-7ffc741a1000 rw-p 00006000 ca:01 1093260                    /root/zsh-test/lib/zsh/5.3.1/zsh/zutil.so
7ffc741a1000-7ffc741a4000 r-xp 00000000 ca:01 1093258                    /root/zsh-test/lib/zsh/5.3.1/zsh/stat.so
7ffc741a4000-7ffc743a3000 ---p 00003000 ca:01 1093258                    /root/zsh-test/lib/zsh/5.3.1/zsh/stat.so
7ffc743a3000-7ffc743a4000 rw-p 00002000 ca:01 1093258                    /root/zsh-test/lib/zsh/5.3.1/zsh/stat.so
7ffc743eb000-7ffc743ee000 r-xp 00000000 ca:01 1093256                    /root/zsh-test/lib/zsh/5.3.1/zsh/mathfunc.so
7ffc743ee000-7ffc745ee000 ---p 00003000 ca:01 1093256                    /root/zsh-test/lib/zsh/5.3.1/zsh/mathfunc.so
7ffc745ee000-7ffc745ef000 rw-p 00003000 ca:01 1093256                    /root/zsh-test/lib/zsh/5.3.1/zsh/mathfunc.so
7ffc745ef000-7ffc745f0000 r-xp 00000000 ca:01 1093264                    /root/zsh-test/lib/zsh/5.3.1/zsh/deltochar.so
7ffc745f0000-7ffc747f0000 ---p 00001000 ca:01 1093264                    /root/zsh-test/lib/zsh/5.3.1/zsh/deltochar.so
7ffc747f0000-7ffc747f1000 rw-p 00001000 ca:01 1093264                    /root/zsh-test/lib/zsh/5.3.1/zsh/deltochar.so
7ffc747f1000-7ffc747ff000 r-xp 00000000 ca:01 1093262                    /root/zsh-test/lib/zsh/5.3.1/zsh/complist.so
7ffc747ff000-7ffc749ff000 ---p 0000e000 ca:01 1093262                    /root/zsh-test/lib/zsh/5.3.1/zsh/complist.so