Here is the xbacktrace after the hang:
(gdb) xbacktrace
"xmltok-forward" (0xffff93d0)
"nxml-token-after" (0xffff9908)
0x1255860 PVEC_COMPILED
"funcall" (0xffff9e20)
"nxml-forward-single-balanced-item" (0xffffa568)
"nxml-forward-balanced-item" (0xffffaa88)
"forward-sexp" (0xffffaf10)
"byte-code" (0xffffb6b0)
"sgml-parse-tag-backward" (0xffffbbf0)
"sgml-lexical-context" (0xffffc3d0)
"sgml-mode-flyspell-verify" (0xffffc8f0)
"flyspell-word" (0xffffce30)
"byte-code" (0xffffd330)
"flyspell-post-command-hook" (0xffffd980)


Turn off flyspell-mode and everything is fine.

2014/1/15 Levin Du <zslevin@gmail.com>

> 1. Starting from `emacs -Q'
>
> 2. open a xml file with contents shown below:
>
> <?xml version="1.0" encoding="UTF-8"?>
> <window>
>   <control>
>     <!--<visible>Player.HasAudio +
> !Skin.HasSetting(homepageMusicinfo)</visible>-->
>     <visible>false</visible>
>   </control>
> </window>
>
> 3. Turn on flyspell mode with `M-x flyspell-mode'
>
> 4. Move the cursor to the comment start '<!--', then begin to delete
>  comment start chars with C-d. When the line changes to :
>     <visible>Player.HasAudio +
> !Skin.HasSetting(homepageMusicinfo)</visible>-->
>
>    Emacs hangs.
>
> In GNU Emacs 24.3.50.1 (x86_64-unknown-linux-gnu, GTK+ Version 2.24.17)
>  of 2014-01-15 on DuJingwu
> Windowing system distributor `The X.Org Foundation', version 11.0.11303000
> System Description:     Ubuntu 13.04
>
> Configured using:
>  `configure --with-x-toolkit=gtk2 'CFLAGS=-O0 -g3''
>
> Important settings:
>   value of $LC_CTYPE: zh_CN.UTF-8
>   value of $LANG: en_US.UTF-8
>   value of $XMODIFIERS: @im=ibus
>   locale-coding-system: utf-8-unix
>
> Major mode: Lisp Interaction
>
> Minor modes in effect:
>   tooltip-mode: t
>   electric-indent-mode: t
>   mouse-wheel-mode: t
>   tool-bar-mode: t
>   menu-bar-mode: t
>   file-name-shadow-mode: t
>   global-font-lock-mode: t
>   font-lock-mode: t
>   blink-cursor-mode: t
>   auto-composition-mode: t
>   auto-encryption-mode: t
>   auto-compression-mode: t
>   line-number-mode: t
>   transient-mark-mode: t
>
> Recent input:
> M-x g n u - <backspace> - <tab> <tab> b u <tab> <backspace>
> <backspace> <backspace> <backspace> <backspace> <backspace>
> <backspace> <backspace> <backspace> <backspace> <backspace>
> C-g C-g C-g <help-echo> <help-echo> <help-echo> <help-echo>
> <help-echo> <help-echo> <help-echo> <help-echo> <help-echo>
> <help-echo> <help-echo> <help-echo> <help-echo> <help-echo>
> <help-echo> <help-echo> <help-echo> <help-echo> <help-echo>
> <help-echo> <help-echo> <help-echo> <help-echo> <help-echo>
> <menu-bar> <help-menu> <send-emacs-bug-report>
>
> Recent messages:
> For information about GNU Emacs and the GNU system, type C-h C-a.
> Making completion list...
> Quit [3 times]
> call-interactively: End of buffer
>
> Load-path shadows:
> None found.
>
> Features:
> (shadow sort gnus-util mail-extr emacsbug message format-spec rfc822 mml
> mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231 mailabbrev
> gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums mm-util
> help-fns mail-prsvr mail-utils help-mode easymenu time-date china-util
> tooltip electric uniquify ediff-hook vc-hooks lisp-float-type mwheel
> x-win x-dnd tool-bar dnd fontset image regexp-opt fringe tabulated-list
> newcomment lisp-mode prog-mode register page menu-bar rfn-eshadow timer
> select scroll-bar mouse jit-lock font-lock syntax facemenu font-core
> frame cham georgian utf-8-lang misc-lang vietnamese tibetan thai
> tai-viet lao korean japanese hebrew greek romanian slovak czech european
> ethiopic indian cyrillic chinese case-table epa-hook jka-cmpr-hook help
> simple abbrev minibuffer nadvice loaddefs button faces cus-face macroexp
> files text-properties overlay sha1 md5 base64 format env code-pages mule
> custom widget hashtable-print-readable backquote make-network-process
> dbusbind gfilenotify dynamic-setting system-font-setting
> font-render-setting move-toolbar gtk x-toolkit x multi-tty emacs)
>