malloc/realloc problem under repeated tab completition

[Marcin Sobieszczanski]

Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64'
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-pc-linux-gnu'
-DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL
-DHAVE_CONFIG_H -I. -I../bash -I../bash/include -I../bash/lib -g -O2 -Wall
uname output: Linux kubus 2.6.27-9-generic #1 SMP Thu Nov 20 22:15:32 UTC
2008 x86_64 GNU/Linux
Machine Type: x86_64-pc-linux-gnu

Bash Version: 3.2
Patch Level: 39
Release Status: release

Description:
  Hi,

  bash crashes if tab completition releated many times.
  These are only the last lines:
  <cut>
  marciso@kubus:~$ ls /
  bin/ cdrom/ etc/ initrd/ initrd.img.old lib32/ lost+found/ mnt/ proc/
sbin/ sys/ usr/ vmlinuz
  boot/ dev/ home/ initrd.img lib/ lib64/ media/ opt/ root/ srv/ tmp/ var/
vmlinuz.old
  marciso@kubus:~$ ls /
  malloc: ../bash/subst.c:4198: assertion botched
  realloc: start and end chunk sizes differ
  last command: ping 192.168.0.1
  Aborting...

  Warning: Program '/bin/bash' crashed.


  </cut>

Repeat-By:
  Type 'ls /' or 'less /etc/p', for example, and press tab. Keep tab pressed
for a while. In my case bash
  crashed after 126 iterations. It also crashes if there is no matching
names.
  It doesn't crash if the first part isn't a correct, existing command.
  For example, it doesn't crash if you tab-complete '/' or
'an-unexisting-command /'.

  Let me know if you need any other details or if you cannot reproduce the
problem.
  I could debug it on my machine.

  Cheers
  Marcin