ZSH completion crash with "typeset compstate"

[Mickaël THOMAS <mickael9@xxxxxxxxx>]

Found this by accident (I intended to use "typeset -p" for debugging).

% _f() { typeset compstate } ; compdef _f f
% f
Program received signal SIGSEGV, Segmentation fault.
0x00000000004d8324 in set_compstate (pm=0x7b6c90, ht=0x83b3c0) at
complete.c:1270
1270                            zsfree(*((char **) cp->var));
(gdb) p cp->var
$1 = (void *) 0x0
(gdb) bt 10
#0  0x00000000004d8324 in set_compstate (pm=0x7b6c90, ht=0x83b3c0) at
complete.c:1270
#1  0x000000000046f9b0 in scanendscope (hn=0x7b6c90, flags=0) at params.c:5091
#2  0x0000000000439240 in scanmatchtable (ht=0x7a1be0, pprog=0x0,
sorted=0, flags1=0, flags2=0, scanfunc=0x46f76c <scanendscope>,
scanflags=0) at hashtable.c:428
#3  0x00000000004392b6 in scanhashtable (ht=0x7a1be0, sorted=0,
flags1=0, flags2=0, scanfunc=0x46f76c <scanendscope>, scanflags=0) at
hashtable.c:444
#4  0x000000000046f651 in endparamscope () at params.c:5033
#5  0x000000000042dfb0 in runshfunc (prog=0x7aefa0, wrap=0x0,
name=0x7ffff7fc4028 "_f") at exec.c:5390
#6  0x00000000004d89ed in comp_wrapper (prog=0x7aefa0, w=0x0,
name=0x7ffff7fc4028 "_f") at complete.c:1472
#7  0x000000000042decc in runshfunc (prog=0x7aefa0, wrap=0x777f60
<wrapper>, name=0x7ffff7fc4028 "_f") at exec.c:5370
#8  0x000000000042d9a6 in doshfunc (shfunc=0x7b6810,
doshargs=0x7ffff7fc88e8, noreturnval=0) at exec.c:5251
#9  0x000000000042cc9a in execshfunc (shf=0x7b6810,
args=0x7ffff7fc88e8) at exec.c:4877