Eshell password input + C-g breaks Emacs

[Carl Henrik Lunde]

Symptoms:
Emacs crashes

Steps to reproduce:
emacs -f eshell
sudo -k # To make sure sudo will ask for a password
sudo -l
# Password prompt appears
C-g

"Fatal error (11)"
"Error in echo-area-clear-hook: (void-function nil)"

Emacs is now broken, any keyboard input is displayed directly 
(C-x is shown as ^X etc.)

This has been tested on emacs built from CVS on 2005-05-22 and today
on multiple configurations.

If I start emacs with the -Q option it segfaults after C-g, here's the
top of the full backtrace:

#0  0xffffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0x407708cd in select () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#2  0x081823a3 in wait_reading_process_output (time_limit=0, microsecs=0, 
read_kbd=-1, do_display=1, wait_for_cell=137379857, wait_proc=0x0,
    just_wait_proc=0) at process.c:4356
        usecs = -1073760048
        timeout_reduced_for_timers = 0
        channel = 7
        nfds = -1
        Available = {fds_bits = {65, 0 <repeats 31 times>}}
        Connecting = {fds_bits = {0 <repeats 32 times>}}
        check_connect = 0
        check_delay = 1
        no_avail = 0
        xerrno = 4
        proc = 0
        timeout = {tv_sec = 99999, tv_usec = 665000}
        end_time = {tv_sec = -1073760024, tv_usec = 135224490}
        wait_channel = -1
        got_some_input = 0
        saved_waiting_for_user_input_p = -1
#3  0x080f2dce in kbd_buffer_get_event (kbp=0xbfffb9dc, used_mouse_menu=0x0) at 
keyboard.c:3928
        obj = 1
#4  0x080f157e in read_char (commandflag=0, nmaps=0, maps=0x0, 
prev_event=137379857, used_mouse_menu=0x0) at keyboard.c:2855
        kb = (KBOARD *) 0x8
        c = 137379857
        count = -1073759712
        local_getcjmp = {{__jmpbuf = {0, 0, 0, -1073759352, -1073759856, 
135205064}, __mask_was_saved = 0, __saved_mask = {__val = {3223648, 137441376, 
0,
        3221207816, 134570427, 137441760, 0, 1, 137441376, 0, 1, 3221207864, 
134666133, 137441376, 1, 1, 0, 140053923, 15, 137442108, 0, 0, 1, 3221207928,
        134659508, 0, 140053923, 15, 1, 24, 0, 140053923}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, -1073750776, -1073751280, 
135205064}, __mask_was_saved = 0, __saved_mask = {__val = {0, 0, 3221216388,
        3221216392, 135842989, 0, 4294967295, 137379857, 140039980, 140039980, 
632, 3221216472, 135857987, 140039976, 137379857, 2, 0, 3221217104, 0, 2,
        1, 0, 0, 3221216472, 135527379, 137722313, 137537986, 40, 139260485, 
139260496, 137465833, 3221216552}}}}
        key_already_recorded = 0
        tem = 1
        save = -1073759712
        previous_echo_area_message = 137379857
        also_record = 137379857
        reread = 0
        gcpro1 = {next = 0x4068c9b5, var = 0x406a18e0, nvars = -1073759688}
        gcpro2 = {next = 0x8, var = 0x407c7120, nvars = -1073759720}
        polling_stopped_here = 1
5  0x08165e1f in read_filtered_event (no_switch_frame=1, ascii_required=1, 
error_nonascii=0, input_method=1) at lread.c:470
        val = 137104696
        delayed_switch_frame = 137379857
#6  0x08166075 in Fread_char_exclusive (prompt=0, 
inherit_input_method=137379905) at lread.c:584
No locals.
#7  0x081522f6 in Ffuncall (nargs=3, args=0xbfffbc64) at eval.c:2793
        fun = 137104696
        funcar = 0
        numargs = 2
        lisp_numargs = 0
        val = 0
        backtrace = {next = 0xbfffbd70, function = 0xbfffbc60, args = 
0xbfffbc64, nargs = 2, evalargs = 0 '\0', debug_on_exit = 0 '\0'}
        internal_args = (int *) 0xbfffbc64
        i = 0
#8  0x0817b4de in Fbyte_code (bytestr=137677241, vector=2, 
maxdepth=-1073759136) at bytecode.c:689
        op = 2
        vectorp = (int *) 0x81c8920
        stack = {pc = 0x81c8871 "\211\026#=8d5U\204=8fd", top = 0xbfffbc68, 
bottom = 0xbfffbc60, byte_string = 136087539, 
  byte_string_start = 0x81c8800 "=8c6\030\t\203V", constants = 136087836, next 
= 0xbfffbf20}
        top = (int *) 0xbfffbc60
#9  0x0815176c in Feval (form=137106008) at eval.c:2139
        numargs = 3
        args_left = 137379857
        i = 3
        maxargs = 3
        argvals = {136087539, 136087836, 56, 139845416, 1081928160, 1081925688, 
1081928160, 139844904}
        fun = 137106008
        val = 0
        original_fun = 137489961
        original_args = 136087533
        funcar = 0
        backtrace = {next = 0xbfffbfd0, function = 0xbfffbd1c, args = 
0xbfffbd20, nargs = 3, evalargs = 1 '\001', debug_on_exit = 0 '\0'}
        gcpro1 = {next = 0x8139b25, var = 0x82f0cd4, nvars = 1081928160}
        gcpro2 = {next = 0x0, var = 0xbfffbd5c, nvars = 1078757443}
        gcpro3 = {next = 0xbfffbd5c, var = 0xbfffbd20, nvars = 3}
(....)

(getenv "TERM") => screen

In GNU Emacs 22.0.50.1 (i686-pc-linux-gnu, GTK+ Version 2.6.4)
 of 2005-05-22 on nemi
configured using `configure '--with-gtk''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: C
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US
  locale-coding-system: iso-latin-1
  default-enable-multibyte-characters: t

Major mode: Group

Minor modes in effect:
  gnus-topic-mode: t
  gnus-undo-mode: t
  auto-image-file-mode: t
  show-paren-mode: t
  icomplete-mode: t
  iswitchb-mode: t
  encoded-kbd-mode: t
  auto-compression-mode: t
  menu-bar-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  unify-8859-on-encoding-mode: t
  column-number-mode: t
  line-number-mode: t
  next-error-follow-minor-mode:  Fol