ksh crashes with segfault in job_clear()

Issue

• ksh crashes with segfault in job_clear().

Core was generated by `/bin/ksh /users/GTP/gtv/bin/gtvd5a0X.sh'.
Program terminated with signal 11, Segmentation fault.
[New process 8030]
[New process 8031]
#0  job_clear () at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/jobs.c:1051
1051            jpnext = jp->next;
(gdb) bt
#0  job_clear () at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/jobs.c:1051
#1  0x00000000004333da in _sh_fork (parent=1702065455, flags=508307808, jobid=0x7fff9d9ee014)
    at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:2148
#2  0x0000000000433f59 in sh_ntfork (t=0x1e4cf890, argv=0x1e4cf908, jobid=0x7fff9d9ee014, flag=0)
    at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:2972
#3  0x00000000004351f4 in sh_exec (t=0x1e4cf890, flags=5) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:1056
#4  0x000000000043679f in sh_exec (t=0x1e4cf960, flags=<value optimized out>) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:1165
#5  0x0000000000436263 in sh_exec (t=0x1e4cfcb0, flags=4) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:1294
#6  0x0000000000436177 in sh_exec (t=0x472f73726573752f, flags=508307808) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:1598
#7  0x0000000000436151 in sh_exec (t=0x1e4d0400, flags=6) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:1334
#8  0x0000000000439393 in sh_funscope (argn=<value optimized out>, argv=0x1e4c0428, fun=0, arg=0x7fff9d9ef830, execflg=4)
    at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:2365
#9  0x000000000043959f in sh_funct (np=0x1e4bfd70, argn=2, argv=0x1e4c0428, envlist=0x0, execflg=4)
    at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:2431
#10 0x0000000000438747 in sh_exec (t=0x1e4a38b0, flags=<value optimized out>) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:985
#11 0x0000000000436c8a in sh_exec (t=0x1e4a3910, flags=<value optimized out>) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:1220
#12 0x00000000004362ca in sh_exec (t=0x472f73726573752f, flags=4) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:1315
#13 0x0000000000436151 in sh_exec (t=0x1e4c6910, flags=4) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:1334
#14 0x0000000000439ff5 in sh_eval (iop=0x1e4c71d0, mode=0) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:461
#15 0x0000000000444810 in b_dot_cmd (n=<value optimized out>, argv=<value optimized out>, extra=<value optimized out>)
    at /usr/src/debug/ksh-20080202/src/cmd/ksh93/bltins/misc.c:291
#16 0x000000000043708b in sh_exec (t=0x1e4a33d0, flags=<value optimized out>) at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/xec.c:849
#17 0x0000000000407723 in exfile ()
#18 0x0000000000406c2c in sh_main ()
#19 0x0000003468e1d994 in __libc_start_main (main=<value optimized out>, argc=<value optimized out>, ubp_av=<value optimized out>, 
    init=<value optimized out>, fini=<value optimized out>, rtld_fini=<value optimized out>, stack_end=Could not find the frame base for "__libc_start_main".
) at libc-start.c:231
#20 0x0000000000405f39 in _start ()
(gdb) f 0
#0  job_clear () at /usr/src/debug/ksh-20080202/src/cmd/ksh93/sh/jobs.c:1051
1051            jpnext = jp->next;
(gdb) l
1046                free((void*)px);
1047            }
1048        }
1049        for(jp=bck.list; jp;jp=jpnext)
1050        {
1051            jpnext = jp->next;
1052            free((void*)jp);
1053        }
1054        bck.list = 0;
1055        if(njob_savelist < NJOB_SAVELIST)