Bug 2225954

Patch https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=738f7b867341c1da87ee667d48815822715c3e75
[XIM: Make Xim handle NEED_SYNC_REPLY flag] should handle the condition user
is experimenting. Checking newer patches on top of libX11 does not show any
extra fixes, so, issue probably will happen on newer RHEL releases as well.

We can provide extra data inspection or access to coredump to debug internal
data structure states:

(gdb) bt
#0  0x00007f6e8befac3d in poll () at ../sysdeps/unix/syscall-template.S:81
#1  0x00007f6e6e00a022 in poll (__timeout=-1, __nfds=1, __fds=0x7f6e6cd90ff0) at /usr/include/bits/poll2.h:46
#2  _xcb_conn_wait (c=c@entry=0x7f6e841b3240, cond=cond@entry=0x7f6e841b3280, vector=vector@entry=0x0, count=count@entry=0x0) at xcb_conn.c:479
#3  0x00007f6e6e00bc6f in xcb_wait_for_event (c=0x7f6e841b3240) at xcb_in.c:697
#4  0x00007f6e6e889dc8 in _XReadEvents (dpy=dpy@entry=0x7f6e841b1ff0) at xcb_io.c:400
#5  0x00007f6e6e871851 in XIfEvent (dpy=0x7f6e841b1ff0, event=event@entry=0x7f6e6cd91230, predicate=predicate@entry=0x7f6e6e8b96b0 <_CheckCMEvent>, arg=arg@entry=0x7f6e3405c580 "@&\270nn\177") at IfEvent.c:68
#6  0x00007f6e6e8b9e44 in _XimXRead (im=0x7f6e3405c580, recv_buf=0x7f6e6cd91e50 "", buf_len=2048, ret_len=0x7f6e6cd91364) at imTrX.c:476
#7  0x00007f6e6e8baac0 in _XimReadData (im=im@entry=0x7f6e3405c580, len=len@entry=0x7f6e6cd913c6, buf=buf@entry=0x7f6e6cd91e50 "", 
    buf_size=buf_size@entry=2048) at imTransR.c:165
#8  0x00007f6e6e8badb1 in _XimRead (im=im@entry=0x7f6e3405c580, len=len@entry=0x7f6e6cd91462, buf=buf@entry=0x7f6e6cd91e50 "", buf_size=buf_size@entry=2048, predicate=predicate@entry=0x7f6e6e8a8070 <_XimCreateICCheck>, arg=arg@entry=0x0) at imTransR.c:235
#9  0x00007f6e6e8a98fd in _XimProtoCreateIC (xim=0x7f6e3405c580, arg=0x0) at imDefIc.c:1558
#10 0x00007f6e6e89680c in XCreateIC (im=0x7f6e3405c580) at ICWrap.c:250
#11 0x00007f6e6edcf502 in createXIC (env=0x7f6e8427f2d0, w=48234524, pX11IMData=0x7f6e3405ee30) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.262.b10-1.el7.x86_64/openjdk/jdk/src/solaris/native/sun/awt/awt_InputMethod.c:977
#12 Java_sun_awt_X11_XInputMethod_createXICNative (env=0x7f6e8427f2d0, this=0x7f6e6cd928f8, window=48234524) at /usr/src/debug/java-1.8.0-openjdk-1.8.0.262.b10-1.el7.x86_64/openjdk/jdk/src/solaris/native/sun/awt/awt_InputMethod.c:1411
#13 0x00007f6e75018427 in ?? ()

(gdb) f 8
#8  0x00007f6e6e8badb1 in _XimRead (im=im@entry=0x7f6e3405c580, len=len@entry=0x7f6e6cd91462, buf=buf@entry=0x7f6e6cd91e50 "", buf_size=buf_size@entry=2048, 
    predicate=predicate@entry=0x7f6e6e8a8070 <_XimCreateICCheck>, arg=arg@entry=0x0) at imTransR.c:235
235             ret_code = _XimReadData(im, &read_len, buf, buf_size);
(gdb) p im
$1 = (struct _Xim *) 0x7f6e3405c580
(gdb) p/t im.private.proto.flag
$2 = 1

Should match src/xlibi18n/XimintP.h:
...
/*
 * bit mask for the flag of XIMPrivateRec
 */
#define SERVER_CONNECTED        (1L)
#define DYNAMIC_EVENT_FLOW      (1L << 1)
#define USE_AUTHORIZATION_FUNC  (1L << 2)
#ifdef XIM_CONNECTABLE
#define DELAYBINDABLE           (1L << 3)
#define RECONNECTABLE           (1L << 4)
#endif /* XIM_CONNECTABLE */
#define FABRICATED              (1L << 5)
#define NEED_SYNC_REPLY         (1L << 6)
...

  Do not see anything special in frame 5 where, heuristically, there could be
some hang:

(gdb) f 5
#5  0x00007f6e6e871851 in XIfEvent (dpy=0x7f6e841b1ff0, event=event@entry=0x7f6e6cd91230, predicate=predicate@entry=0x7f6e6e8b96b0 <_CheckCMEvent>, 
    arg=arg@entry=0x7f6e3405c580 "@&\270nn\177") at IfEvent.c:68
68                  _XReadEvents(dpy);
(gdb) list XIfEvent
...
53              while (1) {
54                  for (qelt = prev ? prev->next : dpy->head;
55                       qelt;
56                       prev = qelt, qelt = qelt->next) {
57                      if(qelt->qserial_num > qe_serial
58                         && (*predicate)(dpy, &qelt->event, arg)) {
59                          *event = qelt->event;
60                          _XDeq(dpy, prev, qelt);
61                          _XStoreEventCookie(dpy, event);
62                          UnlockDisplay(dpy);
63                          return 0;
64                      }
65                  }
66                  if (prev)
67                      qe_serial = prev->qserial_num;
68                  _XReadEvents(dpy);
69                  if (prev && prev->qserial_num != qe_serial)
70                      /* another thread has snatched this event */
71                      prev = NULL;
72              }
(gdb) ptype prev
type = struct _XSQEvent {
    struct _XSQEvent *next;
    XEvent event;
    unsigned long qserial_num;
} *
(gdb) p prev.event.type
$3 = 6

Should be a:

#define MotionNotify            6

so, to better debug, it could be required to somehow have it easily
reproducible.

The java program is different but the C stack matches
https://bugs.openjdk.org/browse/JDK-6506617?focusedCommentId=12130327&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-12130327

The issue is very difficult to reproduce, it might need up to 200 times
to reproduce the issue.

The issue happens when loging out and login back in gnome. It looks as
if some state was not properly cleared in some point.

It is possible to reproduce with C locale and very clean and small rhel7
installatoin, but should be easier to reproduce with Korean, Chinese or
Japanese input methods.

We have some "brute" force workarounds, but it would be better to have
some idea of what triggers the problem, and how to correct it.