regression in cvs tip

I ran across a regression in unmodified cvs tip. On a 7.3.2 installation 
I can do:

create table tse(f1 int, f2 int[], f3 text[]);
insert into tse values(1,'{69,42,54}', '{g,d,e}');
# select * from tse where 1 in (select f1); f1 |     f2     |   f3
----+------------+---------  1 | {69,42,54} | {g,d,e}
(1 row)

On cvs tip (from this morning, no local changes) I get:

create table tse(f1 int, f2 int[], f3 text[]);
insert into tse values(1,array[69,42,54], array['g','d','e']);
# select * from tse where 1 in (select f1);
The connection to the server was lost. Attempting reset: Failed.
connection pointer is NULL
!#

Here's the backtrace:

Program received signal SIGABRT, Aborted.
0xffffe002 in ?? ()
(gdb) bt
#0  0xffffe002 in ?? ()
#1  0x42028b93 in abort () from /lib/tls/libc.so.6
#2  0x081aeac0 in ExceptionalCondition (conditionName=0x42131a14 " 
\031\023B@ç#@`Â",    errorType=0x6 <Address 0x6 out of bounds>, fileName=0x0, 
lineNumber=245) at assert.c:46
#3  0x080cb99a in markTargetListOrigin (pstate=0x831322c, res=0x8313a08, 
var=0x83139dc) at parse_target.c:245
#4  0x080cb920 in markTargetListOrigins (pstate=0x831322c, 
targetlist=0x8313934) at parse_target.c:225
#5  0x080b689f in transformSelectStmt (pstate=0x831322c, stmt=0x8312e6c) 
at analyze.c:1779
#6  0x080b485f in transformStmt (pstate=0x831322c, parseTree=0x8312e6c, 
extras_before=0xbfffd6a4, extras_after=0xbfffd6a8)    at analyze.c:407
#7  0x080b46d3 in do_parse_analyze (parseTree=0x8312e6c, 
pstate=0x831322c) at analyze.c:234
#8  0x080b4695 in parse_sub_analyze (parseTree=0x8312e6c, 
parentParseState=0x8312be0) at analyze.c:213
#9  0x080c351c in transformExpr (pstate=0x8312be0, expr=0x8312ef8) at 
parse_expr.c:420
#10 0x080c2df7 in transformWhereClause (pstate=0x8312be0, 
clause=0x42131a14) at parse_clause.c:956
#11 0x080b68aa in transformSelectStmt (pstate=0x8312be0, stmt=0x8312f78) 
at analyze.c:1782
#12 0x080b485f in transformStmt (pstate=0x8312be0, parseTree=0x8312f78, 
extras_before=0xbfffd7f4, extras_after=0xbfffd7f8)    at analyze.c:407
#13 0x080b46d3 in do_parse_analyze (parseTree=0x8312f78, 
pstate=0x8312be0) at analyze.c:234
#14 0x080b45ec in parse_analyze (parseTree=0x8312f78, paramTypes=0x0, 
numParams=0) at analyze.c:159
#15 0x0815a07c in pg_analyze_and_rewrite (parsetree=0x8312f78, 
paramTypes=0x0, numParams=0) at postgres.c:482
#16 0x0815a39f in exec_simple_query (query_string=0x83129c8 "select * 
from tse where 1 in (select f1);") at postgres.c:793
#17 0x0815c0b8 in PostgresMain (argc=4, argv=0x8299cb8, 
username=0x8299c80 "postgres") at postgres.c:2730
#18 0x0813a910 in BackendFork (port=0x82a6fe8) at postmaster.c:2473
#19 0x0813a44e in BackendStartup (port=0x82a6fe8) at postmaster.c:2095
#20 0x08138f00 in ServerLoop () at postmaster.c:1049
#21 0x0813875a in PostmasterMain (argc=5, argv=0x8299428) at 
postmaster.c:829
#22 0x08110183 in main (argc=5, argv=0xbfffe1b4) at main.c:211
#23 0x420156a4 in __libc_start_main () from /lib/tls/libc.so.6

Any ideas?

Thanks,

Joe