C-g crash redux

[Romain Francoise]

I can crash Emacs reliably with current (Aug 2nd) sources by hitting C-g
while it's preparing a partial-completion-mode prompt.  I just did it
three times in a row.  The Lisp backtrace shows that it's indeed related
to sit-for:

| (gdb) xbacktrace
| "sit-for" (0x10)
| "PC-temp-minibuffer-message" (0x874d3fb)
| "PC-do-completion" (0x837f8c9)
| "PC-complete" (0x837f8c9)
| "call-interactively" (0x85eaac9)
| "completing-read" (0x889ea6b)
| "setq" (0x874320d)
| "let" (0x87431fd)
| "call-interactively" (0x8447709)
| (gdb)

In GNU Emacs 22.0.50.22 (i686-pc-linux-gnu, GTK+ Version 2.8.18)
 of 2006-08-02 on pacem
X server distributor `The X.Org Foundation', version 11.0.70000000
configured using `configure '--with-gtk' 'CFLAGS=-O0 -g''

Unfortunately, the regular backtrace doesn't make much sense to me.
Can someone suggest what to do to get more info?
(I'm pretty sure I bootstrapped this Emacs at least once since the
sit-for changes were installed, I can do that again if it helps.
I usually build with `make bootfast'.)

| (gdb) bt
| #0  0xffffe410 in __kernel_vsyscall ()
| #1  0xa7653cc6 in kill () from /lib/tls/i686/cmov/libc.so.6
| #2  0x08124fb4 in fatal_error_signal (sig=6) at emacs.c:430
| #3  <signal handler called>
| #4  0xffffe410 in __kernel_vsyscall ()
| #5  0xa7653cc6 in kill () from /lib/tls/i686/cmov/libc.so.6
| #6  0x08124fd4 in abort () at emacs.c:464
| #7  0x081e70fd in Fbyte_code (bytestr=136529099, vector=136529116, 
maxdepth=40)
|     at bytecode.c:1666
| #8  0x081ad855 in funcall_lambda (fun=136529036, nargs=1, 
|     arg_vector=0xafda15a4) at eval.c:3169
| #9  0x081ad315 in Ffuncall (nargs=2, args=0xafda15a0) at eval.c:3028
| #10 0x081e46a2 in Fbyte_code (bytestr=141874683, vector=141478564, 
maxdepth=16)
|     at bytecode.c:679
| #11 0x081ad855 in funcall_lambda (fun=141478732, nargs=1, 
|     arg_vector=0xafda18a4) at eval.c:3169
| #12 0x081ad315 in Ffuncall (nargs=2, args=0xafda18a0) at eval.c:3028
| #13 0x081e46a2 in Fbyte_code (bytestr=141871139, vector=141522028, 
maxdepth=56)
|     at bytecode.c:679
| #14 0x081ad855 in funcall_lambda (fun=141522612, nargs=1, 
|     arg_vector=0xafda1bb4) at eval.c:3169
| #15 0x081ad315 in Ffuncall (nargs=2, args=0xafda1bb0) at eval.c:3028
| #16 0x081e46a2 in Fbyte_code (bytestr=141870627, vector=141503852, 
maxdepth=40)
|     at bytecode.c:679
| #17 0x081ad855 in funcall_lambda (fun=141504020, nargs=0, 
|     arg_vector=0xafda1ef4) at eval.c:3169
| #18 0x081ad315 in Ffuncall (nargs=1, args=0xafda1ef0) at eval.c:3028
| #19 0x081acbf9 in apply1 (fn=140421833, arg=137885897) at eval.c:2723
| #20 0x081a7102 in Fcall_interactively (function=140421833, 
|     record_flag=137885897, keys=137926396) at callint.c:408
| #21 0x081378be in Fcommand_execute (cmd=140421833, record_flag=137885897, 
|     keys=137885897, special=137885897) at keyboard.c:9782
| #22 0x08129cb8 in command_loop_1 () at keyboard.c:1790
| #23 0x081aacba in internal_condition_case (bfun=0x81288ea <command_loop_1>, 
|     handlers=137930561, hfun=0x81283b6 <cmd_error>) at eval.c:1469
| #24 0x08128761 in command_loop_2 () at keyboard.c:1326
| #25 0x081aa775 in internal_catch (tag=137953105, 
|     func=0x812873e <command_loop_2>, arg=137885897) at eval.c:1210
| #26 0x081286bf in command_loop () at keyboard.c:1293
| #27 0x08128134 in recursive_edit_1 () at keyboard.c:1003
| #28 0x08157a53 in read_minibuf (map=137873781, initial=137885897, 
|     prompt=143256171, backup_n=0, expflag=0, histvar=138030145, histpos=0, 
|     defalt=137885897, allow_props=0, inherit_input_method=0) at minibuf.c:725
| #29 0x08159776 in Fcompleting_read (prompt=143256171, table=137886948, 
|     predicate=141832861, require_match=137885945, initial_input=137885897, 
|     hist=137885897, def=137885897, inherit_input_method=137885897)
|     at minibuf.c:1771
| #30 0x081ac41d in Feval (form=141832725) at eval.c:2341
| #31 0x081a9526 in Fsetq (args=141832717) at eval.c:537
| #32 0x081ac068 in Feval (form=141832709) at eval.c:2260
| #33 0x081a93b8 in Fprogn (args=141549117) at eval.c:435
| #34 0x081aa3fc in Flet (args=141832701) at eval.c:1052
| #35 0x081ac068 in Feval (form=141832629) at eval.c:2260
| #36 0x081a6ff9 in Fcall_interactively (function=138704649, 
|     record_flag=137885897, keys=137926396) at callint.c:380
| #37 0x081378be in Fcommand_execute (cmd=138704649, record_flag=137885897, 
|     keys=137885897, special=137885897) at keyboard.c:9782
| #38 0x08129cb8 in command_loop_1 () at keyboard.c:1790
| #39 0x081aacba in internal_condition_case (bfun=0x81288ea <command_loop_1>, 
|     handlers=137930561, hfun=0x81283b6 <cmd_error>) at eval.c:1469
| #40 0x08128761 in command_loop_2 () at keyboard.c:1326
| #41 0x081aa775 in internal_catch (tag=137926769, 
|     func=0x812873e <command_loop_2>, arg=137885897) at eval.c:1210
| #42 0x08128717 in command_loop () at keyboard.c:1305
| #43 0x08128134 in recursive_edit_1 () at keyboard.c:1003
| #44 0x08128276 in Frecursive_edit () at keyboard.c:1064
| #45 0x08126b36 in main (argc=1, argv=0xafda35b4) at emacs.c:1794

...

| (gdb) bt full
| #0  0xffffe410 in __kernel_vsyscall ()
| No symbol table info available.
| #1  0xa7653cc6 in kill () from /lib/tls/i686/cmov/libc.so.6
| No symbol table info available.
| #2  0x08124fb4 in fatal_error_signal (sig=6) at emacs.c:430
| No locals.
| #3  <signal handler called>
| No symbol table info available.
| #4  0xffffe410 in __kernel_vsyscall ()
| No symbol table info available.
| #5  0xa7653cc6 in kill () from /lib/tls/i686/cmov/libc.so.6
| No symbol table info available.
| #6  0x08124fd4 in abort () at emacs.c:464
| No locals.
| #7  0x081e70fd in Fbyte_code (bytestr=136529099, vector=136529116, 
maxdepth=40)
|     at bytecode.c:1666
|         count = 43
|         op = 135
|         vectorp = (Lisp_Object *) 0x82344e0
|         bytestr_length = 58
|         stack = {
|   pc = 0x8329d59 "", 
|   top = 0x0, 
|   bottom = 0xafda1290, 
|   byte_string = 136529099, 
|   byte_string_start = 0x8329d1f "\b\204\t", 
|   constants = 136529116, 
|   next = 0xafda1638
| }
|         top = (Lisp_Object *) 0xafda128c
|         result = 137885897
| #8  0x081ad855 in funcall_lambda (fun=136529036, nargs=1, 
|     arg_vector=0xafda15a4) at eval.c:3169
|         val = 142854916
|         syms_left = 137885897
|         next = 138193681
|         count = 40
|         i = 1
|         optional = 1
|         rest = 0
| #9  0x081ad315 in Ffuncall (nargs=2, args=0xafda15a0) at eval.c:3028
|         fun = 136529036
|         original_fun = 138193489
|         funcar = -1344662136
|         numargs = 1
|         lisp_numargs = 137885897
|         val = 137953722
|         backtrace = {
|   next = 0xafda184c, 
|   function = 0xafda15a0, 
|   args = 0xafda15a4, 
|   nargs = 1, 
|   evalargs = 0 '\0', 
|   debug_on_exit = 0 '\0'
| }
|         internal_args = (Lisp_Object *) 0x83901ba
|         i = -1344662136
| #10 0x081e46a2 in Fbyte_code (bytestr=141874683, vector=141478564, 
maxdepth=16)
|     at bytecode.c:679
|         count = 38
|         op = 1
|         vectorp = (Lisp_Object *) 0x86ecaa8
|         bytestr_length = 57
|         stack = {
|   pc = 0x887063d "\210\nd|\210\f\2057", 
|   top = 0xafda15a4, 
|   bottom = 0xafda15a0, 
|   byte_string = 141874683, 
|   byte_string_start = 0x8870614 "\b\203\020", 
|   constants = 141478564, 
|   next = 0xafda1948
| }
|         top = (Lisp_Object *) 0xafda15a0
|         result = -1344661880
| #11 0x081ad855 in funcall_lambda (fun=141478732, nargs=1, 
|     arg_vector=0xafda18a4) at eval.c:3169
|         val = -1344661368
|         syms_left = 137885897
|         next = 138001313
|         count = 37
|         i = 1
|         optional = 0
|         rest = 0
| #12 0x081ad315 in Ffuncall (nargs=2, args=0xafda18a0) at eval.c:3028
|         fun = 141478732
|         original_fun = 140422241
|         funcar = 10
|         numargs = 1
|         lisp_numargs = 0
|         val = 137885897
|         backtrace = {
|   next = 0xafda1b5c, 
|   function = 0xafda18a0, 
|   args = 0xafda18a4, 
|   nargs = 1, 
|   evalargs = 0 '\0', 
|   debug_on_exit = 0 '\0'
| }
|         internal_args = (Lisp_Object *) 0xafda1800
|         i = 1
| #13 0x081e46a2 in Fbyte_code (bytestr=141871139, vector=141522028, 
maxdepth=56)
|     at bytecode.c:679
|         count = 20
|         op = 1
|         vectorp = (Lisp_Object *) 0x86f7470
|         bytestr_length = 1652
|         stack = {
|   pc = 0x874d02d 
"\210\307\202q\006\016M\211\026NA\204\266\003\016Q\373>\203/address@hidden"\204\001\004\311\201p",
 
|   top = 0xafda18a4, 
|   bottom = 0xafda18a0, 
|   byte_string = 141871139, 
|   byte_string_start = 0x874cc8c "\b\204\a", 
|   constants = 141522028, 
|   next = 0xafda1c58
| }
|         top = (Lisp_Object *) 0xafda18a0
|         result = 137885897
| #14 0x081ad855 in funcall_lambda (fun=141522612, nargs=1, 
|     arg_vector=0xafda1bb4) at eval.c:3169
|         val = 137885897
|         syms_left = 137885897
|         next = 138140825
|         count = 17
|         i = 1
|         optional = 1
|         rest = 0
| #15 0x081ad315 in Ffuncall (nargs=2, args=0xafda1bb0) at eval.c:3028
|         fun = 141522612
|         original_fun = 140422145
|         funcar = 138045474
|         numargs = 1
|         lisp_numargs = 0
|         val = 137885921
|         backtrace = {
|   next = 0xafda1e6c, 
|   function = 0xafda1bb0, 
|   args = 0xafda1bb4, 
|   nargs = 1, 
|   evalargs = 0 '\0', 
|   debug_on_exit = 0 '\0'
| }
|         internal_args = (Lisp_Object *) 0x2
|         i = 138045474
| #16 0x081e46a2 in Fbyte_code (bytestr=141870627, vector=141503852, 
maxdepth=40)
|     at bytecode.c:679
|         count = 16
|         op = 1

-- 
Romain Francoise <address@hidden> | The sea! the sea! the open
it's a miracle -- http://orebokech.com/ | sea! The blue, the fresh, the
                                        | ever free! --Bryan W. Procter