Thanks for the patch, but this handles only part of the problem, namely, the
memory allocated by emacs-module.c directly. We need a way for modules
themselves to allocate memory that is properly accounted for, and this
allocation should be nearly as convenient as xmalloc so that modules don't need
to check for failure after each allocation.
This is _impossible_ without using longjmp. We really don't want to allow longjmp to skip over module frames.
An interface that doesn't use longjmp but returns NULL on error is fine with me. It's something entirely different though: My patch is only for the internal Emacs code.