<AWT Dev> Crash in "getNumButtons" (libawt_xawt.so) after applying Linux OS patch " libXi6-1.7.4-12.2.x86_64

Fri Nov 17 06:59:07 UTC 2017

Hi Sergey,

Thank you for the review and suggestions.
Function getNumButtons() make use of XInput extention to query for number
of buttons. In case if it is not available, it assumes that there are 3
mouse buttons. Hence, we returned 3 when XListInputDevices() fails.

if (local_num_buttons == 0 ) {
   local_num_buttons = 3;
}

I've verified that the testcase passes with the earlier provided patch.
Also, as per your suggestion I have initialized "ndevices" to zero just
before calling the XListInputDevices to verify whether it remains
unmodified in the error scenario or not.
But I can see that it gets modified in the error scenario too.
I am further testing this behaviour with different level of libXi6 versions
and will let you know the test results.

I have also attached hs_err log file which got generated without any patch.

(See attached file: hs_err_pid10187.log)

With Thanks and Regards,
Jitendra Singh.

From:	Sergey Bylokhov <Sergey.Bylokhov at oracle.com>
To:	Jitendra Singh <jitendra.enania at in.ibm.com>
Cc:	"awt-dev at openjdk.java.net" <awt-dev at openjdk.java.net>
Date:	11/15/2017 01:57 AM
Subject:	Re: <AWT Dev> Crash in "getNumButtons" (libawt_xawt.so) after
            applying Linux OS patch " libXi6-1.7.4-12.2.x86_64

Hi,
I have a question about this bug.
  - Why the value 3 is returned? Why it is not zero?

I think this is a bug which was discussed here:
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.x.org_archives_xorg-2Ddevel_2016-2DOctober_051607.html&d=DwIC-g&c=jf_iaSHvJObTbx-siA1ZOg&r=0L21t05E0bkqMNvRjqOT3QTh6xvEnZ4nyHVAbgIc7Fs&m=HwOFsW3gDW3R4uqf3cvbhQNhurE_3dAnM311_M_SV7M&s=vzSp7At08_KJFkEcjlNdO5mZb9xWc0-V3OCh9GxjP3k&e=

Those xix updates the spec of this method:
"+RETURN VALUE
+------------
+
+   XListInputDevices returns a pointer to an array of XDeviceInfo
+   structs and sets ndevices_return to the number of elements in
+   that array. To free the XDeviceInfo array created by
+   XListInputDevices, use XFreeDeviceList.
+
+   On error, XListInputDevices returns NULL and ndevices_return is
+   left unmodified."

Can you please confirm that by initialization of "ndevices" to zero
before calling the XListInputDevices.

On 10/11/2017 05:26, Jitendra Singh wrote:
> Hi,
>
> *DETAILS ABOUT THE PROBLEM*
> Crash in "getNumButtons" (libawt_xawt.so) after applying Linux OS patch
> " libXi6-1.7.4-12.2.x86_64.
>
> Inactive hide details for Java Call Stack:-Java Call Stack:-
> AWT-EventQueue-0 (java.awt.EventDispatchThread at 0xFFEEA8D8)
> sun/awt/X11/XToolkit.getNumberOfButtonsImpl ()I
> sun/awt/X11/XToolkit.getNumberOfButtons ()I(1483)
> sun/awt/X11/XToolkit.initializeDesktopProperties ()V(1466)
> java/awt/Toolkit.getDesktopProperty
> (Ljava/lang/String;)Ljava/lang/Object;(1801)
> sun/swing/SwingUtilities2$AATextInfo.getAATextInfo
> (Z)Lsun/swing/SwingUtilities2$AATextInfo;(163)
> javax/swing/plaf/metal/MetalLookAndFeel.initComponentDefaults
> (Ljavax/swing/UIDefaults;)V
> javax/swing/plaf/basic/BasicLookAndFeel.getDefaults
> ()Ljavax/swing/UIDefaults;(159)
> javax/swing/plaf/metal/MetalLookAndFeel.getDefaults
> ()Ljavax/swing/UIDefaults;(1588)
> javax/swing/UIManager.setLookAndFeel (Ljavax/swing/LookAndFeel;)V(550)
> javax/swing/UIManager.setLookAndFeel (Ljava/lang/String;)V(590)
> javax/swing/UIManager.initializeDefaultLAF (Ljava/util/Properties;)V
(1360)
> javax/swing/UIManager.initialize ()V(1470)
> javax/swing/UIManager.maybeInitialize ()V(1437)
> javax/swing/UIManager.getUI
> (Ljavax/swing/JComponent;)Ljavax/swing/plaf/ComponentUI;(1017)
> javax/swing/JPanel.updateUI ()V(137)
> javax/swing/JPanel.<init> (Ljava/awt/LayoutManager;Z)V(97)
> javax/swing/JPanel.<init> (Ljava/awt/LayoutManager;)V(106)
> com/ibm/acsp/monitor/MonitorPanel.<init> ()V
> com/ibm/acsp/monitor/Monitor.<init> ()V
> com/ibm/acsp/monitor/Monitor$4.run ()V
> java/awt/event/InvocationEvent.dispatch ()V(322)
> java/awt/EventQueue.dispatchEventImpl
> (Ljava/awt/AWTEvent;Ljava/lang/Object;)V(767)
> java/awt/EventQueue.access$500
> (Ljava/awt/EventQueue;Ljava/awt/AWTEvent;Ljava/lang/Object;)V(108)
> java/awt/EventQueue$3.run ()Ljava/lang/Void;(720)
> java/awt/EventQueue$3.run ()Ljava/lang/Object;(714)
> java/security/AccessController.doPrivileged
>
(Ljava/security/PrivilegedAction;Ljava/security/AccessControlContext;)Ljava/lang/Object;(529)

> java/security/ProtectionDomain$1.doIntersectionPrivilege
>
(Ljava/security/PrivilegedAction;Ljava/security/AccessControlContext;Ljava/security/AccessControlContext;)Ljava/lang/Object;(86)

> java/awt/EventQueue.dispatchEvent (Ljava/awt/AWTEvent;)V(737)
> java/awt/EventDispatchThread.pumpOneEventForFilters (I)V(212)
> java/awt/EventDispatchThread.pumpEventsForFilter
> (ILjava/awt/Conditional;Ljava/awt/EventFilter;)V(127)
> java/awt/EventDispatchThread.pumpEventsForHierarchy
> (ILjava/awt/Conditional;Ljava/awt/Component;)V(116)
> java/awt/EventDispatchThread.pumpEvents (ILjava/awt/Conditional;)V(112)
> java/awt/EventDispatchThread.pumpEvents (Ljava/awt/Conditional;)V(104)
> java/awt/EventDispatchThread.run ()V(93)
>
> Native Call Stack:-
>
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9prt28.so
> <signal handler called>
> getNumButtons () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/libawt_xawt.so
> Java_sun_awt_X11_XToolkit_getNumberOfButtonsImpl () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/libawt_xawt.so
> JVMprJavaSendNative () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9vm28.so
> ?? ()
> resolveSpecialMethodRefInto () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9vm28.so
> VM_BytecodeInterpreter::run(J9VMThread*) () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9vm28.so
> bytecodeLoop () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9vm28.so
>
> Inactive hide details for Native StackNative Stack
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9prt28.so
> <signal handler called>
> getNumButtons () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/libawt_xawt.so
> Java_sun_awt_X11_XToolkit_getNumberOfButtonsImpl () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/libawt_xawt.so
> JVMprJavaSendNative () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9vm28.so
> ?? ()
> resolveSpecialMethodRefInto () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9vm28.so
> VM_BytecodeInterpreter::run(J9VMThread*) () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9vm28.so
> bytecodeLoop () from
> ./opt/ibm/acsp-server/jvm64/jre/lib/amd64/compressedrefs/libj9vm28.so
>
> *RECREATION STEPS*
> Run the attached MouseInfo.java testcase on a linux box having Linux OS
> patch " libXi6-1.7.4-12.2.x86_64 or higher.
>
> *PROBLEM ANALYSIS*
> The reported issue started happening after applying the Linux OS patch "
> libXi6-1.7.4-12.2.x86_64.
> With our investigation this seems to be bug at the OS layer in which OS
> API ListInputDevices returns "null" even though the number of input
> devices are not zero.
> Although the crash is observed due to the failure of OS API, ideally JDK
> should not have been crashed. We need to take care of this "NULL"
> scenario at the JDK level.
>
> *Suggested Fix:-*
> Introduced a Null check in "getNumButtons" function (XToolkit.c).
> /(See attached file: webrev.zip)/
>
> Able to build the above fix against JDK 10 and triggered jtreg tests. I
> will share the test results soon.
>
> *Testcase:-*
> /(See attached file: MouseInfoTest.java)/
>
> With Thanks and Regards,
> Jitendra Singh.
>

--
Best regards, Sergey.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openjdk.java.net/pipermail/awt-dev/attachments/20171117/5b362761/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: graycol.gif
Type: image/gif
Size: 105 bytes
Desc: not available
URL: <http://mail.openjdk.java.net/pipermail/awt-dev/attachments/20171117/5b362761/graycol-0001.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hs_err_pid10187.log
Type: application/octet-stream
Size: 43387 bytes
Desc: not available
URL: <http://mail.openjdk.java.net/pipermail/awt-dev/attachments/20171117/5b362761/hs_err_pid10187-0001.log>