http-backend: Don't infinite loop during die()

If stdout has already been closed by the CGI and die() gets called,
the CGI will fail to write the "Status: 500 Internal Server Error" to
the pipe, which results in die() being called again (via safe_write).
This goes on in an infinite loop until the stack overflows and the
process is killed by SIGSEGV.

Instead set a flag on the first die() invocation and if we came back to
the handler, just die silently, as it only means we failed to report the
failure---we cannot report anything anyway in such a case.  This way
failures to write the error messages to the stdout pipe do not result in
an infinite loop.

We also now report on the death to stderr before we report to stdout,
to increase the chances that the cause of the die() invocation will
appear in the server's error log.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

fixup! http-backend.c: Don't infinite loop

Now die_webcgi() actually can return during a recursive call into it,
causing

    http-backend.c:554: error: 'noreturn' function does return

The only reason we would come back to the die handler is because we
failed during it, so we cannot report anything anyway.

Signed-off-by: Junio C Hamano <gitster@pobox.com>

http-backend.c

@@ -538,15 +538,19 @@ static void service_rpc(char *service_name)
 
 static NORETURN void die_webcgi(const char *err, va_list params)
 {
-	char buffer[1000];
+	static int dead;
 
-	http_status(500, "Internal Server Error");
-	hdr_nocache();
-	end_headers();
+	if (!dead) {
+		char buffer[1000];
+		dead = 1;
 
-	vsnprintf(buffer, sizeof(buffer), err, params);
-	fprintf(stderr, "fatal: %s\n", buffer);
-	exit(0);
+		vsnprintf(buffer, sizeof(buffer), err, params);
+		fprintf(stderr, "fatal: %s\n", buffer);
+		http_status(500, "Internal Server Error");
+		hdr_nocache();
+		end_headers();
+	}
+	exit(0); /* we successfully reported a failure ;-) */
 }
 
 static char* getdir(void)