June 2020 - Wine-bugs - list.winehq.org

[Bug 48834] New: Rockstar Games Launcher CEF helper crashes (x11drv use-after-free for HWND_MESSAGE)
by WineHQ Bugzilla 14 Aug '20

14 Aug '20

https://bugs.winehq.org/show_bug.cgi?id=48834 Bug ID: 48834 Summary: Rockstar Games Launcher CEF helper crashes (x11drv use-after-free for HWND_MESSAGE) Product: Wine Version: 5.4 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: winex11.drv Assignee: wine-bugs(a)winehq.org Reporter: bshanks(a)codeweavers.com Distribution: --- Created attachment 66751 --> https://bugs.winehq.org/attachment.cgi?id=66751 Valgrind output showing backtraces of UAF The problem: When the Rockstar Games Launcher is launched, 3 of its helper processes (SocialClubHelper.exe) crash in XDeleteContext(). SocialClubHelper.exe is part of CEF, and the code causing the crash is ANGLE's D3D9 renderer.<https://github.com/google/angle/blob/6dfdca836806b661cd0d0e090ef2cf1dc06a2e…> Here's what I've figured out: * ANGLE creates an HWND_MESSAGE window. <https://github.com/google/angle/blob/6dfdca836806b661cd0d0e090ef2cf1dc06a2e…> In X11DRV_create_win_data(), win_data is not created for the window (comment: "don't create win data for HWND_MESSAGE windows") * ANGLE uses the window as the focus window and device window when initializing D3D9. * The wined3d CS thread starts and calls wined3d_swapchain_gl_create_context(), leading to x11drv create_gl_drawable(), then create_client_window(). create_client_window() creates win_data (comment is "explicitly create data for HWND_MESSAGE windows since they can be used for OpenGL"), using the current thread's (the CS thread's) Display pointer. I believe this is when the CS thread calls XOpenDisplay(). * This works ok, until ANGLE shuts down. It first releases all the D3D9 objects: <https://github.com/google/angle/blob/6dfdca836806b661cd0d0e090ef2cf1dc06a2e…> Releasing D3D9 triggers wined3d to stop the CS thread, which ends with calling FreeLibraryAndExitThread(). This eventually calls X11DRV_ThreadDetach(), which closes the CS thread's Display. * ANGLE then calls DestroyWindow() on the device/focus window. This leads to x11drv destroy_whole_window(), which calls XDeleteContext() using the Display from the win_data. This was the CS thread's Display, which has since been closed/freed, causing use-after-free and (in this case) a crash. Commenting out the HWND_MESSAGE exception in X11DRV_create_win_data() does fix the crash, but this is likely not the correct fix. I've attached part of a Valgrind output showing the crash and backtraces, and should be able to add an ANGLE sample exe later that reproduces the bug. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 1

[Bug 46742] New: The Sims 2 demo needs support for ProcessVertices() with software vertex shaders
by wine-bugs＠winehq.org 14 Aug '20

14 Aug '20

https://bugs.winehq.org/show_bug.cgi?id=46742 Bug ID: 46742 Summary: The Sims 2 demo needs support for ProcessVertices() with software vertex shaders Product: Wine Version: 0.9.35. Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: directx-d3d Assignee: wine-bugs(a)winehq.org Reporter: z.figura12(a)gmail.com Distribution: --- Split off from bug 8051: "Without ProcessVertices, characters will explode in family thumbnails (and same if you disable shaders through the game's cheat menu), and explosion of vertices will also happen with little icons that pop up above characters when they make a friend or get married (you can realiably observe it by loading Pleasant family). In both cases, this pops up: fixme:d3d:wined3d_device_process_vertices Output vertex declaration not implemented yet. err:d3d:get_flexible_vertex_size Unexpected position mask: 0x0" -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6

[Bug 33518] New: Some floors in Star Trek (2013) are completely black
by wine-bugs＠winehq.org 13 Aug '20

13 Aug '20

http://bugs.winehq.org/show_bug.cgi?id=33518 Bug #: 33518 Summary: Some floors in Star Trek (2013) are completely black Product: Wine Version: 1.5.29 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: directx-d3d AssignedTo: wine-bugs(a)winehq.org ReportedBy: eurekafag(a)eureka7.ru Classification: Unclassified This is how they look like in the game: http://i.imgur.com/sNy2z7l.png This is how they should look (at least on Xbox360): http://youtu.be/YQCUUcrLfPc?t=30m30s Outdoors and everything else seems to be ok: http://i.imgur.com/Rv2O8sM.png http://i.imgur.com/Ytoi8cC.png I see this repeating message in the terminal: fixme:d3d:resource_check_usage Unhandled usage flags 0x8. Sometimes another message appears: fixme:d3d:wined3d_swapchain_present Ignoring flags 0x80000000. These two spam the output but nothing else appears while playing. I've run the game with WINEDEBUG=+d3d and the resulting file is about 600M long compressed to 23M. Maybe it will help. I launched the game and entered to the buggy room from the screenshot above, then killed it to prevent extra output. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 15

[Bug 48799] New: HOTAS kit Saitek X52 Pro doesn't show all buttons
by WineHQ Bugzilla 13 Aug '20

13 Aug '20

https://bugs.winehq.org/show_bug.cgi?id=48799 Bug ID: 48799 Summary: HOTAS kit Saitek X52 Pro doesn't show all buttons Product: Wine Version: 5.4 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: joy.cpl Assignee: wine-bugs(a)winehq.org Reporter: patola(a)gmail.com Distribution: Ubuntu Created attachment 66714 --> https://bugs.winehq.org/attachment.cgi?id=66714 Selecting a button higher than 32 and wine thinking it's button 1 The HOTAS kit Saitek X52 Pro has 9 axes and 39 buttons. Wine only shows 32 and when a button higher than the 32th is pressed, it either registers it as button 1 or 2 or crashes outright with a dialog the messages: wine: L"C:\\windows\\system32\\joy.cpl" is a dll, not an executable wine: Unhandled page fault on write access to 00E06DB8 at address 7D612AE0 (thread 008e), starting debugger... wine: Unhandled page fault on write access to 00E06DB8 at address 7D611AE0 (thread 0088), starting debugger... 0090:fixme:dbghelp:elf_search_auxv can't find symbol in module Specifically, when button 35 is pressed (button 34 on jscal-gtk which counts from 0 to 38), the crash happens. The two screenshots show three applications using the joystick -- wine control panel, antimicro and jstest-gtk (which uses through linux input (js) instead of evdev but it's the same hardware). Also, enabling the js device "Logitech X52 Professional H.O.T.A.S. (js)" leads to an inconditional crash when selecting it on the "test joystick" tab but I understand this might be another issue. I need the HOTAS in evdev mode only. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 11

[Bug 49370] New: Sea Dogs: City of Abandoned Ships (GOG) installer silently exits
by WineHQ Bugzilla 12 Aug '20

12 Aug '20

https://bugs.winehq.org/show_bug.cgi?id=49370 Bug ID: 49370 Summary: Sea Dogs: City of Abandoned Ships (GOG) installer silently exits Product: Wine Version: 5.8 Hardware: x86-64 URL: https://www.gog.com/game/sea_dogs_city_of_abandoned_sh ips OS: Mac OS X Status: NEW Keywords: regression Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: gijsvrm(a)gmail.com CC: julliard(a)winehq.org Blocks: 27439 Regression SHA1: 526522caae103a27cd36740d6eca59387a189d02 Created attachment 67422 --> https://bugs.winehq.org/attachment.cgi?id=67422 output When going through the installer, clicking "Install" makes it exit silently. It works with wine-5.8 and doesn't with wine-5.9 (So it's not the same as Bug 49200). Bisection revealed: 526522caae103a27cd36740d6eca59387a189d02 is the first bad commit commit 526522caae103a27cd36740d6eca59387a189d02 Author: Alexandre Julliard <julliard(a)winehq.org> Date: Thu May 14 15:43:56 2020 +0200 loader: Try to load ntdll.so before libwine initialization. I'm using macOS 10.14, compiled with mingw and the 10.13 SDK. Console output is attached. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 3

[Bug 46770] New: Splinter Cell: Blacklist crashes in DX9 mode when using FAudio
by wine-bugs＠winehq.org 12 Aug '20

12 Aug '20

https://bugs.winehq.org/show_bug.cgi?id=46770 Bug ID: 46770 Summary: Splinter Cell: Blacklist crashes in DX9 mode when using FAudio Product: Wine Version: 4.3 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: xaudio2 Assignee: wine-bugs(a)winehq.org Reporter: andrey.goosev(a)gmail.com Distribution: --- Created attachment 63782 --> https://bugs.winehq.org/attachment.cgi?id=63782 log No crash in DX11 mode. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 11

[Bug 47254] New: Unhandled exception: page fault on write access in 32-bit code
by wine-bugs＠winehq.org 12 Aug '20

12 Aug '20

https://bugs.winehq.org/show_bug.cgi?id=47254 Bug ID: 47254 Summary: Unhandled exception: page fault on write access in 32-bit code Product: Wine Version: 4.0.1 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: scw189(a)cox.net Distribution: --- Created attachment 64540 --> https://bugs.winehq.org/attachment.cgi?id=64540 Back trace dump from Wine crash. Used to run Legacy9 (genealogy software). Mostly runs Ok. But, there are latency issues There is a problem with buffering keyboard input characters. If you select an input field and start typing too fast, the first two characters will generally be ignored. There also seem to be issues with background processes where after changing windows you need to wait 4-6 seconds before input keystrokes are accepted (they are also not buffered). Randomly, the system will display a message box about "the system has experienced a serious error..." and a crash dump is displayed: "Unhandled exception: page fault on write access to 0x6d4a95c8 in 32-bit code (0x7b476e81)." The message box allows a backtrace dump to be saved. The Legacy9 program is then locked on the last display screen and is un-responsive to keyboard or mouse clicks, although the mouse pointer is still active. The computer itself is not locked up. Closing the program error message box also closes the Legacy9 application. The Legacy9 application can be restarted at that time. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 4

[Bug 40945] New: Post provider setup of WMI core 1.5 installer needs
by wine-bugs＠winehq.org 12 Aug '20

12 Aug '20

https://bugs.winehq.org/show_bug.cgi?id=40945 Bug ID: 40945 Summary: Post provider setup of WMI core 1.5 installer needs Product: Wine Version: 0.9.34. Hardware: x86 URL: https://web.archive.org/web/*/http://download.microsof t.com/download/platformsdk/wmi9x/1.5/W9X/EN-US/wmi9x.e xe OS: Linux Status: NEW Keywords: download, Installer, patch Severity: minor Priority: P2 Component: advapi32 Assignee: wine-bugs(a)winehq.org Reporter: austinenglish(a)gmail.com Distribution: --- Follow up to bug 37429 You'll need to grab the exe from archive.org. Set your wineprefix to win98, and install. It will crash late in the process, with: Unhandled exception: page fault on read access to 0x00000004 in 32-bit code (0x7da6799f). Register dump: CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b EIP:7da6799f ESP:0033c590 EBP:0033c5c8 EFLAGS:00210202( R- -- I - - - ) EAX:7d895869 EBX:7da81000 ECX:0033c580 EDX:7ffdf000 ESI:01419738 EDI:00000000 Stack dump: 0x0033c590: 7d98a460 014192b8 00000000 014192e0 0x0033c5a0: 0033c630 01419b50 0000c5d0 7d98a460 0x0033c5b0: 00000020 7da67946 0033c5dc 00b81aa0 0x0033c5c0: 00000000 0033cbe0 0033c5f8 6206ccb5 0x0033c5d0: 00000000 0033cbe0 6206ccb5 01419b50 0x0033c5e0: 00000000 0033c630 00e90690 00000000 Backtrace: =>0 0x7da6799f class_object_SpawnInstance+0x6f(iface=<couldn't compute location>, lFlags=<couldn't compute location>, ppNewInstance=<couldn't compute location>) [/home/austin/wine-git/dlls/wbemprox/class.c:221] in wbemprox (0x0033c5c8) 1 0x6206ccb5 in mofd (+0xccb4) (0x0033c5f8) 2 0x6206e94a in mofd (+0xe949) (0x0033c680) 3 0x62062199 in mofd (+0x2198) (0x0033cbec) 4 0x62074d0a in mofd (+0x14d09) (0x0033d1bc) 5 0x003428bc in wbemupgd (+0x28bb) (0x0033d408) 6 0x003410ac in wbemupgd (+0x10ab) (0x0033d9a4) 7 0x00343528 in wbemupgd (+0x3527) (0x0033d9b8) 8 0x100150d0 in glc96e7.tmp (+0x150cf) (0x0033e3d8) 9 0x1000433e in glc96e7.tmp (+0x433d) (0x0033f1c8) 0x7da6799f class_object_SpawnInstance+0x6f [/home/austin/wine-git/dlls/wbemprox/class.c:221] in wbemprox: movl 0x4(%edi),%eax 221 if (!(record->fields = heap_alloc( table->num_cols * sizeof(struct field) ))) wine-1.9.14-15-g1bcc7ce austin(a)austin2:~$ sha1sum wmi9x.exe 62752e9c1b879688c26f205eebf07d3783906c3e wmi9x.exe austin(a)austin2:~$ du -sh wmi9x.exe 3.0M wmi9x.exe -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 8

[Bug 49337] New: patchinstall.sh fails to apply eventfd_synchronizatio (esync) patches
by WineHQ Bugzilla 12 Aug '20

12 Aug '20

https://bugs.winehq.org/show_bug.cgi?id=49337 Bug ID: 49337 Summary: patchinstall.sh fails to apply eventfd_synchronizatio (esync) patches Product: Wine-staging Version: 5.10 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: shtetldik(a)gmail.com CC: leslie_alistair(a)hotmail.com, z.figura12(a)gmail.com Distribution: --- Running it like this errors out: ./patchinstall.sh DESTDIR=$HOME/build/wine eventfd_synchronization ERROR: Unknown commandline argument eventfd_synchronization. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 5

[Bug 49366] New: ARM builds fail against latest ntdll patchsets
by WineHQ Bugzilla 12 Aug '20

12 Aug '20

https://bugs.winehq.org/show_bug.cgi?id=49366 Bug ID: 49366 Summary: ARM builds fail against latest ntdll patchsets Product: Wine-staging Version: 5.10 Hardware: aarch64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: mike(a)cchtml.com CC: leslie_alistair(a)hotmail.com, z.figura12(a)gmail.com Distribution: --- ARM 32-bit and 64-bit builds fail to compile with wine-staging 5.10. /usr/bin/ld: loader.o: in function `LdrInitializeThunk': /builddir/build/BUILD/wine-5.10/dlls/ntdll/loader.c:4050: undefined reference to `__wine_syscall_dispatcher' /usr/bin/ld: /builddir/build/BUILD/wine-5.10/dlls/ntdll/loader.c:4050: undefined reference to `__wine_syscall_dispatcher' /usr/bin/ld: thread.o: in function `thread_init': /builddir/build/BUILD/wine-5.10/dlls/ntdll/thread.c:275: undefined reference to `__wine_syscall_dispatcher' /usr/bin/ld: /builddir/build/BUILD/wine-5.10/dlls/ntdll/thread.c:275: undefined reference to `__wine_syscall_dispatcher' clang-10: error: linker command failed with exit code 1 (use -v to see invocation) winegcc: /usr/bin/clang failed make[1]: *** [Makefile:1129: ntdll.dll.so] Error 2 Disabling the following patchsets allows the build to complete: - ntdll-NtContinue - ntdll-Syscall_Emulation - winebuild-Fake_Dlls I believe this is related to f12808c094ef06ba7151d35e6c6e70ae965ac2c3. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2