ksh: segfault in read builtin incrementing negative subscript

typeset -a a
integer b=-1
IFS= read -r 'a[++b]' <<<foo
typeset -p a

This seems to be another that’s fixed in v- but I couldn’t find it noted in the changelog.

About this issue

I found the root cause of the problem: the arithmetic expression that is the array index gets evaluated twice (via sh_arith()).

I could guess the next sentence there. Good find.

Hand testing completed. All good that I can see.