Bug 132160

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7)
Gecko/20040803 Firefox/0.9.3

Description of problem:
After experiencing crashes in Motif apps whenever a GLwMDrawingArea
widget is destructed, I finally tracked down an imcompatibility
between the headers of xorg's bundled libGLw library and OpenMotif.

(OpenMotif) /lib/Xm/PrimitiveP.h defines XmPrimitivePart as:

typedef struct _XmPrimitivePart
{
   Pixel   foreground;

   Dimension   shadow_thickness;
   Pixel   top_shadow_color;
   Pixmap  top_shadow_pixmap;
   Pixel   bottom_shadow_color;
   Pixmap  bottom_shadow_pixmap;

   Dimension   highlight_thickness;
   Pixel   highlight_color;
   Pixmap  highlight_pixmap;

   XtCallbackList help_callback;
   XtPointer      user_data;

   Boolean traversal_on;
   Boolean highlight_on_enter;
   Boolean have_traversal;

   unsigned char unit_type;

   XmNavigationType navigation_type;

   Boolean highlight_drawn;
   Boolean highlighted;
   GC      highlight_GC;
   GC      top_shadow_GC;
   GC      bottom_shadow_GC;
   XtCallbackList   convert_callback;
   XtCallbackList   popup_handler_callback;
   XmDirection layout_direction;

   XmString tool_tip_string;  <--- this is a new addition

} XmPrimitivePart;


... the last line ("XmString tool_tip_string") is a recent addition to
this structure.  However, at compilation time, libGLw doesn't use this
file, it uses its own stripped-down motif header files.

The libGLw file:

/xc/lib/GLw/GLwXm/PrimitiveP.h

defines XmPrimitivePart as:

typedef struct {
    Pixel foreground;
    Dimension shadow_thickness;
    Pixel top_shadow_color;
    Pixmap top_shadow_pixmap;
    Pixel bottom_shadow_color;
    Pixmap bottom_shadow_pixmap;
    Dimension highlight_thickness;
    Pixel highlight_color;
    Pixmap highlight_pixmap;
    XtCallbackList help_callback;
    XtPointer user_data;
    Boolean traversal_on;
    Boolean highlight_on_enter;
    Boolean have_traversal;
    unsigned char unit_type;
    XmNavigationType navigation_type;
    Boolean highlight_drawn;
    Boolean highlighted;
    GC highlight_GC;
    GC top_shadow_GC;
    GC bottom_shadow_GC;
#if XmVERSION > 1
    XtCallbackList convert_callback; 
    XtCallbackList popup_handler_callback; 
    XmDirection layout_direction; 
#endif
} XmPrimitivePart;

... notice the missing tool_tip_string component.

When initializing a GLwMDrawingArea widget, motif will create the
XmPrimitivePart struct correctly, but when passed to GLw's
Initialize() function, the memory for the tool_tip_string pointer is
frequently overwritten, since GLw believes the struct is
sizeof(XmString *) bytes smaller than it actually is.

At the destruction stage, XtDestroyWidget() will attempt to
XmStringFree() the tool_tip_string, which, if it has been overwritten
by GLw, is now a dangling pointer -- and your app crashes.


Version-Release number of selected component (if applicable):
xorg-x11-6.7.0-2 openmotif-2.2.3-2

How reproducible:
Always

Steps to Reproduce:
1. Create a small Motif app that places a GLwMDrawingArea on an XmForm.
2. Call XtDestroyWidget() on either the GLwMDrawingArea, or the XmForm
(since it destroys children recursively)
3. Attempt to malloc() -- for any reason.
4. App will segfault
    

Actual Results:  Segmentation fault.

Expected Results:  App should behave as designed.

Additional info:

In my case, the app would not segfault until we attempted to malloc()
more memory - which made tracking down the bug especially difficult.