CVS HEAD dumps core on simple tsvector input example

regression=# SELECT 'a very fat cat sat:4 on:5 a:6 mat:7'::tsvector;
tsvector
-----------------------------------------------
'a' 'on':5 'cat' 'fat' 'mat':7 'sat':4 'very'
(1 row)

regression=# SELECT 'a very fat cat sat:4 on:5 a:6 mat:7'::tsvector;
server closed the connection unexpectedly

Notice it's the same input both times --- only the second one crashes.
The coredump happens inside repalloc, making me suspect a memory clobber
is involved.

BTW, why does the 'a':6 lexeme disappear? To the extent that I
understand how this should work, I'd have expected 'a' and 'a':6
to merge into 'a':6 not plain 'a'.

regards, tom lane