bug#5333: 23.1.91; NextStep/Mac OS X: emacs -nw crash in input_available_signal + 67 (keyboard.c:7514)

[YAMAMOTO Mitsuharu]

>>>>> On Thu, 7 Jan 2010 10:09:43 -0500, steve@srevilak.net said:

> I'd like to report an emacs 23.1.91.1 crash on Mac OS X 10.6.2.
> Unfortunately, I cannot provide a test case that reproduces the crash
> reliably.  However, I can provide some observations about the context
> in which the crashes occur.

>   * The crashes occur with "emacs -nw", never with the "windowed"
>     emacs.

>   * The crashes always occur while I'm holding down the DOWN arrow on
>     my keyboard, to scroll through a section of text.

>   * I can provide a stack trace for Mac OS X's crash reporter.  (below)
>     You'll noticed that Emacs is running as a child process of Mutt.  I
>     use Mutt as a MUA, and Mutt is configured to use "emacs -nw" as an
>     editor.  The crash occurred when I was writing a response to an
>     email message.

>   * I've observed the crashes in pretest versions 23.1.90.1 and
>     23.1.91.1, but not in 23.1.50.1.  However, this may or may not be a
>     conincidence.

According to the stack trace, the crash seems to happen by
dereferencing NULL pointer (with some offset) in a non-main thread
executing the following code in the SIGIO handler.

  if (input_available_clear_time)
    EMACS_SET_SECS_USECS (*input_available_clear_time, 0, 0);

EMACS_SET_SECS_USECS consists of multiple instructions, and
input_available_clear_time might be cleared to NULL by the main thread
between the NULL-check and the completion of EMACS_SET_SECS_USECS in a
non-main thread.

Could you try the following patch for a while to see if it can avoid
the issue?

                                     YAMAMOTO Mitsuharu
                                mituharu@math.s.chiba-u.ac.jp

=== modified file 'src/keyboard.c'
*** src/keyboard.c      2010-01-05 14:04:04 +0000
--- src/keyboard.c      2010-01-09 01:33:20 +0000
***************
*** 7503,7513 ****
    signal (signo, input_available_signal);
  #endif /* USG */
  
  #ifdef SYNC_INPUT
    interrupt_input_pending = 1;
    pending_signals = 1;
- #else
-   SIGNAL_THREAD_CHECK (signo);
  #endif
  
    if (input_available_clear_time)
--- 7503,7513 ----
    signal (signo, input_available_signal);
  #endif /* USG */
  
+   SIGNAL_THREAD_CHECK (signo);
+ 
  #ifdef SYNC_INPUT
    interrupt_input_pending = 1;
    pending_signals = 1;
  #endif
  
    if (input_available_clear_time)