bash crashes when forking jobs and dynamically switching posix mode

[Mike Frysinger]

in light of the recent discussion, i thought i could switch posix mode on/off 
on the fly so that i restricted myself to this mode only when using `wait`.  
unfortunately, that randomly crashes bash :).  simple test case:

$ cat test.sh
#!/bin/bash
max=20
num=0
set -m
#set -o posix
trap ': $(( --num ))' CHLD
while : ; do
        sleep 0.$(( $RANDOM % 10 ))s &
        : $(( ++num ))
        if [[ $num -ge $max ]] ; then
                set -o posix
                wait
                set +o posix
        fi
done

$ bash --version | head -1
GNU bash, version 4.1.5(1)-release (x86_64-pc-linux-gnu)
$ ./test.sh
malloc: ../bash/execute_cmd.c:3555: assertion botched
free: called with already freed block argument
Aborting...Aborted (core dumped)

i've also seen various corruption like:
*** glibc detected *** /bin/bash: malloc(): memory corruption (fast): 
0x0000000001a1ee90 ***

or:
*** glibc detected *** /bin/bash: double free or corruption (fasttop): 
0x00000000013ea130 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x773e5)[0x7fe20e8a03e5]
/bin/bash(pop_stream+0x5d)[0x419f8d]
/bin/bash[0x44e479]
/bin/bash(run_unwind_frame+0x22)[0x44e5e2]
/bin/bash(parse_string+0x131)[0x4677b1]
/bin/bash(xparse_dolparen+0x65)[0x424125]
/bin/bash[0x447938]
/bin/bash[0x448a26]
/bin/bash[0x449f5c]
/bin/bash(expand_string_assignment+0x6a)[0x44a0ca]
/bin/bash[0x44429a]
/bin/bash[0x44465f]
/bin/bash[0x44b2ed]
/bin/bash(execute_command_internal+0x1755)[0x42bff5]
/bin/bash(execute_command+0x4e)[0x42ee2e]
/bin/bash[0x42f4b4]
/bin/bash(execute_command_internal+0xa06)[0x42b2a6]
/bin/bash[0x42f593]
/bin/bash(execute_command_internal+0xa06)[0x42b2a6]
/bin/bash(execute_command+0x4e)[0x42ee2e]
/bin/bash[0x42f55e]
/bin/bash(execute_command_internal+0xa06)[0x42b2a6]
/bin/bash(execute_command+0x4e)[0x42ee2e]
/bin/bash[0x42f55e]
/bin/bash(execute_command_internal+0xa06)[0x42b2a6]
/bin/bash(execute_command+0x4e)[0x42ee2e]
/bin/bash[0x42f55e]
/bin/bash(execute_command_internal+0xa06)[0x42b2a6]
/bin/bash(execute_command+0x4e)[0x42ee2e]
/bin/bash(execute_command_internal+0x12bf)[0x42bb5f]
/bin/bash(execute_command+0x4e)[0x42ee2e]
/bin/bash(reader_loop+0x8c)[0x418fcc]
/bin/bash(main+0xdb9)[0x417919]
/lib64/libc.so.6(__libc_start_main+0xed)[0x7fe20e84a3ed]
/bin/bash[0x4181dd]
-mike

signature.asc
Description: This is a digitally signed message part.