bug#22790: 24.5; Infinite loop involving malloc called from signal handler

[Andreas Gustafsson]

In March, Eli Zaretskii wrote:
> In any case, if those printf's are the culprit, they are no longer
> there in the current sources of what will soon become Emacs 25.1.
> They were replaced with direct calls to 'write'.  So if we are sure
> there's no other problem that causes these loops, we can close this
> bug.

Eliminating the printf calls has mostly fixed the problem for me, but
not completely.  I just had my emacs 24 (which I have patched to
eliminate the printf calls) go into a loop again, following a
control-G and the usual "Auto-save?" and "Abort (and dump core)?"
dialog, but now with the following backtrace:

  (gdb) where
  #0  pthread__mutex_spin (ptm=ptm@entry=0xaea860 <_malloc_mutex>, 
owner=<optimized out>) at 
/bracket/prod/7.0gson1/src/lib/libpthread/pthread_mutex.c:204
  #1  0x00007f7ff680b73b in pthread__mutex_lock_slow (ptm=0xaea860 
<_malloc_mutex>) at 
/bracket/prod/7.0gson1/src/lib/libpthread/pthread_mutex.c:288
  #2  0x00000000005c5307 in _free_internal (ptr=0x2a71000) at gmalloc.c:1268
  #3  0x00000000005c5362 in free (ptr=0x2a71000) at gmalloc.c:1283
  #4  0x0000000000533e4e in xfree (block=0x2a71000) at alloc.c:735
  #5  0x000000000055abd2 in unbind_to (count=4, value=11933746) at eval.c:3304
  #6  0x00000000005562e4 in unwind_to_catch (catch=0xfc4500, value=33964454) at 
eval.c:1161
  #7  0x0000000000557203 in Fsignal (error_symbol=12003810, data=11933746) at 
eval.c:1557
  #8  0x00000000004daf23 in handle_interrupt (in_signal_handler=true) at 
keyboard.c:10440
  #9  0x00000000004dac4a in handle_interrupt_signal (sig=2) at keyboard.c:10288
  #10 0x00000000004e8092 in deliver_process_signal (sig=2, handler=0x4dabfd 
<handle_interrupt_signal>) at sysdep.c:1570
  #11 0x00000000004dac66 in deliver_interrupt_signal (sig=2) at keyboard.c:10295
  #12 0x00007f7ff5c9f3f0 in _opendir (name=<optimized out>) at 
/bracket/prod/7.0gson1/src/lib/libc/gen/opendir.c:72
  #13 0x00007fff00000002 in ?? ()
  #14 0x0000000000000000 in ?? ()

Calling free() from a signal handler is of course incorrect for the
same reasons calling printf() is.

I have not yet checked if emacs 25 has the same bug.
-- 
Andreas Gustafsson, gson@gson.org