[8.04 amd64] ls crashes on TAB completion coreutils: /bin/ls ; gdb: programming_error sh_xrealloc redirection_expand do_redirections execute_command_internal

ls crashes ALWAYS

Reproduce:
1. type ls
2. hold ENTER to see suggestions
3. append some directory name to obrain say ls foo and hold TAB
4. ls foo/bar/ and hold TAB
5. ls foo/ and hold TAB
6. after 5-10 steps like above with holding TAB while extending/shortering the path visible after ls, ls crashes

Seems to work better for dirs with few files and subdirs (at least 2-3 levels deep)

Linux limcore 2.6.24-22-generic #1 SMP Mon Nov 24 19:35:06 UTC 2008 x86_64 GNU/Linux
ii coreutils 6.10-3ubuntu2
Other bug is bug #308171 but looks like something different.

On my local file system (ext3, on luks/devmapper encrypted filesystem)

Crash looks like this ( I run: gdb bash )

rafal@limcore:~/geov/app$ ls views/
malloc: ../bash/subst.c:4198: assertion botched
realloc: start and end chunk sizes differ
last command: bash show.sh
Aborting...
Program received signal SIGABRT, Aborted.
0x00007f2d1586d095 in raise () from /lib/libc.so.6
(gdb) bt
#0 0x00007f2d1586d095 in raise () from /lib/libc.so.6
#1 0x00007f2d1586eaf0 in abort () from /lib/libc.so.6
#2 0x0000000000435624 in programming_error ()
#3 0x00000000004906b8 in ?? ()
#4 0x000000000045c7f0 in sh_xrealloc ()
#5 0x0000000000446d70 in ?? ()
#6 0x00000000004471f3 in ?? ()
#7 0x0000000000458d78 in redirection_expand ()
#8 0x00000000004592c8 in ?? ()
#9 0x0000000000459fc7 in do_redirections ()
#10 0x000000000042d092 in execute_command_internal ()
#11 0x000000000042ca56 in ?? ()
#12 0x000000000042d4ba in execute_command_internal ()
#13 0x000000000042bb4f in execute_command ()
#14 0x000000000042d457 in execute_command_internal ()
#15 0x000000000042ca56 in ?? ()
#16 0x000000000042d4ba in execute_command_internal ()
#17 0x000000000042bb4f in execute_command ()
#18 0x000000000042ca1f in ?? ()
#19 0x000000000042d4ba in execute_command_internal ()
#20 0x000000000042d61d in execute_command_internal ()
#21 0x000000000042e27f in ?? ()
#22 0x000000000042f521 in ?? ()
#23 0x000000000042d551 in execute_command_internal ()
#24 0x000000000042bb4f in execute_command ()
#25 0x000000000042d457 in execute_command_internal ()
#26 0x000000000042bb4f in execute_command ()
#27 0x000000000042d457 in execute_command_internal ()
#28 0x000000000042ca56 in ?? ()
#29 0x000000000042d4ba in execute_command_internal ()
#30 0x000000000042d61d in execute_command_internal ()
#31 0x000000000042e27f in ?? ()
#32 0x000000000042e775 in execute_shell_function ()
#33 0x000000000045b93f in gen_compspec_completions ()
#34 0x000000000045c187 in programmable_completions ()
#35 0x00000000004555b5 in ?? ()
#36 0x0000000000478420 in ?? ()
#37 0x000000000047958f in rl_complete_internal ()
#38 0x00000000004725cf in _rl_dispatch_subseq ()
#39 0x0000000000472c67 in readline_internal_char ()
#40 0x0000000000473006 in readline ()
#41 0x00000000004247fd in ?? ()
---Type <return> to continue, or q <return> to quit---
#42 0x000000000042062c in ?? ()
#43 0x0000000000421985 in ?? ()
#44 0x0000000000424d0f in yyparse ()
#45 0x000000000041e347 in parse_command ()
#46 0x000000000041e40a in read_command ()
#47 0x000000000041e58e in reader_loop ()
#48 0x000000000041e14e in main ()

I will get dbgsym soon.