Bug 277381

Summary: SEGV error moving mouse over window related to XmToolTipGetLabel
Product: Red Hat Enterprise Linux 5 Reporter: Steve Hild <hild>
Component: openmotifAssignee: Thomas Woerner <twoerner>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: medium    
Version: 5.0CC: dkl, rkhadgar, tao
Target Milestone: rc   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: RHBA-2008-0453 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-05-21 17:23:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 246139    
Attachments:
Description Flags
Explanation of process to duplicate as well as possible fix code.
none
Test case for MZ#1388 none

Description Steve Hild 2007-09-04 20:53:33 UTC
Description of problem:

Open and Close windows in my application eventually will get a SEGV error when 
I move cursor over subsequent opened windows. Using gdb the stack shows error 
in XmToolTipGetLabel.

Version-Release number of selected component (if applicable):
openmotif 2.3.0 release 0.1.9.3

How reproducible: Using an application that creates a window and then destroys 
the window by clicking on the close control. (I cannot send actual code since 
we are using source from a 3rd party but in the attachment I describe the Xm 
calls to create and destroy window.) I can cause problem after opening and 
closing window 3 or 4 times. After opening one more window I move mouse over 
window, which results in SEGV.

Steps to Reproduce:
1. Open Window
2. Move mouse/cursor over window.
3. Close(Destroy window)
Repeat this until application fails.
  
Additional info:
I have done extensive debugging on this using the latest openmotif 2.3 source 
and this is what I found:
1. When a window/widget is created a XmQTtoolTipConfig trait is created for 
that top level widget. 
2. When you move the mouse over the widget a call to ToolTipGetData is made 
which checks to see if the "label" attribute associated to the top widget's 
XmQTtoolTipConfig trait is set yet. If not a shell and label widget are 
created and the widget handle is saved into the trait. 
3. When you close/destroy the window all associated widgets are destroyed 
including the ToolTip Label. The primitive widget destroy has a call to 
_XmToolTipLeave to clean up the associated toolTip. _XmToolTipLeave does not 
clear out the Label widget setting in the XmQTtoolTipConfig trait.
4. So, when you open a subsequent window and if the window widget handle 
happens to be the same address as a previous window you have destroyed you 
will get a SEGV.
5. This will occur because when you move the mouse over the new window it will 
call ToolTipGetData and it will find a XmQTtoolTipConfig trait and it will 
find that the Label attribute is set (it is the setting from the previous 
window). When you attempt to get the XTParent of the label it will probably 
fail because this Label widget has already been destroyed as well as its 
Parent.

I have included in the attachment some code that I tried in the Destroy 
function of the openmotif lib/Xm/Primitive.c file that checks to see if the 
widget being destroyed is the same Label widget that is associated to the 
Tiplabel and if it is I NULLed out the XmToolTipConfigTrait label setting. 
This seems to keep from getting the SEGV but I wasn't sure if this would be 
the proper way to fix this. 

We are not able to support RH Enterprise v5 (or any RH linux that currently 
ships this version of openmotif 2.3) until this is solved since we rely upon 
our customers installing the openmotif packaged with their RH release.

Comment 1 Steve Hild 2007-09-04 20:53:33 UTC
Created attachment 186611 [details]
Explanation of process to duplicate as well as possible fix code.

Comment 2 Steve Hild 2007-09-12 20:29:29 UTC
Also reported to bugs.motifzone.net and assigned bug# 1388.

Comment 3 Adam Jackson 2007-09-17 14:24:48 UTC
Nominating for 5.2.

Comment 5 Steve Hild 2007-10-11 13:23:32 UTC
Fix was integrated into OpenMotif 2.3.0 and HEAD. See bug #1388 at 
bugs.motifzone.net. I have downloaded the change and verified that it does 
solve the problem I was having.

Comment 6 RHEL Program Management 2007-12-03 20:45:56 UTC
This request was evaluated by Red Hat Product Management for
inclusion, but this component is not scheduled to be updated in
the current Red Hat Enterprise Linux release.  This request will
be reviewed for a future Red Hat Enterprise Linux release.

Comment 9 Thomas Woerner 2007-12-11 12:55:47 UTC
Please attach your test case.

Comment 10 Thomas Woerner 2007-12-11 13:04:46 UTC
BTW: Upstream has a different way to fix this. Please have a look at:
http://cvs.motifzone.net/cgi-bin/cvsweb.cgi/openmotif/lib/Xm/VendorS.c.diff?r1=1.12&r2=1.12.2.1&cvsroot=openmotif

Comment 14 Steve Hild 2007-12-11 14:17:50 UTC
(In reply to comment #9)
> Please attach your test case.

The best test case I can offer is described in my initial description of the 
problem.

Comment 15 Thomas Woerner 2007-12-11 15:18:50 UTC
Created attachment 284181 [details]
Test case for MZ#1388

Please test if this test case has the same problem, you had with your
application.

Comment 16 Thomas Woerner 2007-12-11 16:31:56 UTC
Please have a look at: http://people.redhat.com/twoerner/BZ/277381/

These packages contain the upstream patch, which is solving the problem for me
with the test case from #15.

----
Please remember that these are test packages, which might get pushed out 
as update packages later if the fixes are ok. For now, these packages 
are unsupported.


Comment 17 Steve Hild 2007-12-11 17:35:10 UTC
(In reply to comment #15)
Your test case does duplicate the problem we are having.


Comment 18 Thomas Woerner 2007-12-12 10:58:39 UTC
Is the upstream fix also working for you?

Comment 19 Steve Hild 2007-12-12 16:58:22 UTC
(In reply to comment #18)
Yes, it appears to fix the problems were were having. I tried it with your Test 
Case and with our application.


Comment 20 RHEL Program Management 2007-12-13 18:06:02 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 21 RHEL Program Management 2008-01-02 17:35:17 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 23 Steve Hild 2008-01-07 19:47:31 UTC
(In reply to comment #18)
> Is the upstream fix also working for you?

Someone on the motifzone bugzilla has questioned whether the OpenMotif fix will 
introduce a memory link. See the comment from pab at:
http://bugs.motifzone.net/show_bug.cgi?id=1388
I added a comment there that my suggested solution only NULLed out the Label 
and not the entire structure.


Comment 24 Thomas Woerner 2008-01-08 10:25:55 UTC
The current upstream fix is not good enough. I'll work with upstream to get a
real fix. The hotfix should be postponed until this is done.

Comment 25 Steve Hild 2008-01-08 14:31:48 UTC
I agree about postponing the hotfix :( Let me know when a new fix is available. 
I was in the process of making changes in anticipation of the hotfix.

Comment 26 Steve Hild 2008-01-23 19:38:42 UTC
Any status on an updated fix? Any info would be greatly appreciated.
Thanks, Steve

Comment 27 Thomas Woerner 2008-01-24 10:01:38 UTC
I have made a patch, which fixed the problem for the test case. Upstream is
currently working on an enhanced patch, because there are more problems with
this than those shown by the test case.

Comment 28 RHEL Program Management 2008-01-30 22:56:29 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 29 RHEL Program Management 2008-01-30 23:16:35 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 30 RHEL Program Management 2008-01-30 23:36:49 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 31 RHEL Program Management 2008-01-30 23:56:24 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 33 RHEL Program Management 2008-01-31 04:26:54 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 34 Steve Hild 2008-02-07 20:06:52 UTC
I see that there is new fix posted at bugs.motifzone.net for this problem.
How soon from the time something that is posted there makes it into the RedHat 
system?

Comment 35 Thomas Woerner 2008-02-13 11:33:44 UTC
I have tested the latest fix and it looks good. This is an OK form my side.

Comment 37 Steve Hild 2008-02-13 14:54:19 UTC
(In reply to comment #35)
> I have tested the latest fix and it looks good. This is an OK form my side.
Do you have a package with this new patch we could try here?


Comment 38 Thomas Woerner 2008-02-13 16:49:31 UTC
Here are updated test rpms:

http://people.redhat.com/twoerner/BZ/277381/

----
Please remember that these are test packages, which might get pushed out 
as update packages later if the fixes are ok. For now, these packages 
are unsupported.

Comment 39 Steve Hild 2008-02-13 20:24:37 UTC
(In reply to comment #38)
This latest patch works with the test case you had sent previously and with our 
application. Thanks. Now to get it into an update package.

Comment 41 Phil Knirsch 2008-02-27 16:20:44 UTC
Fixing missing Devel ACK now that we have a working and clean fix thats also
upstream.

Still requires a HOTFIX request though again.

Read ya, Phil

Comment 42 Thomas Woerner 2008-03-06 09:29:27 UTC
*** Bug 436178 has been marked as a duplicate of this bug. ***

Comment 43 Steve Hild 2008-03-17 21:28:02 UTC
How do I get another HotFix request? I have re-requested escalation on the 
RedHat Support Service Request 1767906 to request a HotFix and I have not seen 
any activity.
Steve

Comment 57 errata-xmlrpc 2008-05-21 17:23:26 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2008-0453.html


Comment 59 Phil Knirsch 2008-06-27 16:23:26 UTC
*** Bug 430492 has been marked as a duplicate of this bug. ***