Another one to do with namerefs. :-)
Looks like it's when the target of the ref is local to the same scope.
$ gdb -q -ex 'run -c "function f { typeset x; typeset -n x; x=y; }; f"' ./bash
Reading symbols from ./bash...done.
Starting program: /home/smorg/doc/programs/bash/bash -c "function f { typeset
x; typeset -n x; x=y; }; f"
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
Program received signal SIGSEGV, Segmentation fault.
strlen () at ../sysdeps/x86_64/strlen.S:106
106 movdqu (%rax), %xmm12
(gdb) bt
#0 strlen () at ../sysdeps/x86_64/strlen.S:106
#1 0x00000000004b4842 in mbschr (s=0x0, c=91) at mbschr.c:60
#2 0x0000000000473a35 in valid_array_reference (name=0x0) at arrayfunc.c:826
#3 0x0000000000441fae in bind_variable_internal (name=0x72c538 "x",
value=0x72c498 "y", table=0x73d9e8, hflags=0, aflags=0)
at variables.c:2533
#4 0x00000000004424d0 in bind_variable (name=0x72c558 "x", value=0x72c498 "y",
flags=0) at variables.c:2662
#5 0x0000000000458139 in do_assignment_internal (word=0x73dca8, expand=1) at
subst.c:2866
#6 0x0000000000458247 in do_word_assignment (word=0x73dca8, flags=0) at
subst.c:2906
#7 0x000000000046651c in expand_word_list_internal (list=0x739fe8, eflags=31)
at subst.c:9623
#8 0x0000000000465aaa in expand_words (list=0x739fe8) at subst.c:9234
#9 0x000000000043bc80 in execute_simple_command (simple_command=0x73d2c8,
pipe_in=-1, pipe_out=-1, async=0, fds_to_close=0x73c948)
at execute_cmd.c:3991
#10 0x0000000000435f9f in execute_command_internal (command=0x73d288,
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
at execute_cmd.c:787
#11 0x0000000000438f08 in execute_connection (command=0x73d088, asynchronous=0,
pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
at execute_cmd.c:2487
#12 0x00000000004362f5 in execute_command_internal (command=0x73d088,
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
at execute_cmd.c:945
#13 0x00000000004362cb in execute_command_internal (command=0x73d048,
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
at execute_cmd.c:937
#14 0x000000000043ced9 in execute_function (var=0x739928, words=0x739e48,
flags=0, fds_to_close=0x73c948, async=0, subshell=0)
at execute_cmd.c:4530
#15 0x000000000043d3b6 in execute_builtin_or_function (words=0x739e48,
builtin=0x0, var=0x739928, redirects=0x0, fds_to_close=0x73c948,
flags=0) at execute_cmd.c:4760
#16 0x000000000043c22f in execute_simple_command (simple_command=0x73ca48,
pipe_in=-1, pipe_out=-1, async=0, fds_to_close=0x73c948)
at execute_cmd.c:4161
#17 0x0000000000435f9f in execute_command_internal (command=0x73ca08,
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
at execute_cmd.c:787
#18 0x0000000000438f08 in execute_connection (command=0x73cac8, asynchronous=0,
pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
at execute_cmd.c:2487
#19 0x00000000004362f5 in execute_command_internal (command=0x73cac8,
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
at execute_cmd.c:945
#20 0x0000000000490145 in parse_and_execute (string=0x73bd08 "function f {
typeset x; typeset -n x; x=y; }; f",
from_file=0x4dcc50 "-c", flags=4) at evalstring.c:367
#21 0x000000000041f6ee in run_one_command (command=0x7fffffffd5fe "function f {
typeset x; typeset -n x; x=y; }; f") at shell.c:1339
#22 0x000000000041e9e0 in main (argc=3, argv=0x7fffffffd108,
env=0x7fffffffd128) at shell.c:694
--
Dan Douglas
