[Bug 49062] New: Dolphin EasyReader for Windows 6.04 (TTS app) crashes on startup
https://bugs.winehq.org/show_bug.cgi?id=49062 Bug ID: 49062 Summary: Dolphin EasyReader for Windows 6.04 (TTS app) crashes on startup Product: Wine Version: 5.7 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: mshtml Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, found a crash report by a user (pastebin) but can't remember where it was linked from/mentioned. WineHQ forums maybe? https://pastebin.com/1ShBrrDs Vendor website: https://yourdolphin.com/en-gb/support/legacy-demos ("EasyReader for Windows 6.04 Legacy Downloads") Download: https://yourdolphin.com/downloads/product?demo=true&lid=1&pvid=9 https://web.archive.org/web/20200430183420/https://yourdolphin.com/downloads... Trace log: --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files (x86)/Dolphin/EasyReader604 $ WINEDEBUG=+seh,+relay,+mshtml,+ieframe wine ./Dolphin\ EasyReader.exe
log.txt 2>&1 ... 003f:trace:ieframe:WebBrowser_get_Document (02831D18)->(0032D4B0) 003f:trace:mshtml:HTMLDocumentObj_QueryInterface (0284F3D8)->(IID_IDispatch 0032D480) 003f:trace:mshtml:HTMLDocumentObj_AddRef (0284F3D8) ref = 3 003f:trace:mshtml:HTMLDocumentObj_QueryInterface (0284F3D8)->(IID_IHTMLDocument2 0032D47C) 003f:trace:mshtml:HTMLDocumentObj_AddRef (0284F3D8) ref = 4 003f:trace:mshtml:HTMLDocumentObj_Release (0284F3D8) ref = 3 003f:trace:mshtml:HTMLDocumentObj_QueryInterface (0284F3D8)->(IID_IHTMLDocument2 0032D4AC) 003f:trace:mshtml:HTMLDocumentObj_AddRef (0284F3D8) ref = 4 003f:Call oleaut32.VariantInit(0032d4b8) ret=0044d38e 003f:Ret oleaut32.VariantInit() retval=01bd4080 ret=0044d38e 003f:trace:mshtml:HTMLDocument_get_bgColor (0284F3D8)->(0032D4B8) 003f:trace:mshtml:HTMLDocument_get_body (0284F3D8)->(0032D480) 003f:trace:mshtml:HTMLDOMNode_AddRef (06584328) ref=4 003f:trace:mshtml:HTMLDOMNode_AddRef (06584328) ref=5 003f:trace:mshtml:HTMLDOMNode_Release (06584328) ref=4 003f:trace:mshtml:HTMLBodyElement_QI (06584328)->(IID_IHTMLBodyElement 0032D47C) 003f:trace:mshtml:HTMLDOMNode_AddRef (06584328) ref=5 003f:trace:mshtml:HTMLBodyElement_get_bgColor (06584328)->(0032D4B8) 003f:trace:mshtml:HTMLDOMNode_Release (06584328) ref=4 003f:trace:mshtml:HTMLDOMNode_Release (06584328) ref=3 003f:trace:seh:raise_exception code=c0000005 flags=0 addr=0x402c80 ip=00402c80 tid=003f 003f:trace:seh:raise_exception info[0]=00000000 003f:trace:seh:raise_exception info[1]=00000000 003f:trace:seh:raise_exception eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=0032d570 edi=00000002 003f:trace:seh:raise_exception ebp=0032d5a4 esp=0032d490 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010246 003f:trace:seh:call_vectored_handlers calling handler at 0x6ca5bba0 code=c0000005 flags=0 003f:trace:seh:call_vectored_handlers handler at 0x6ca5bba0 returned 0 003f:trace:seh:call_vectored_handlers calling handler at 0x661e99a0 code=c0000005 flags=0 003f:trace:seh:call_vectored_handlers handler at 0x661e99a0 returned 0 003f:trace:seh:call_vectored_handlers calling handler at 0x70aa8710 code=c0000005 flags=0 003f:trace:seh:call_vectored_handlers handler at 0x70aa8710 returned 0 003f:trace:seh:call_stack_handlers calling handler at 0x7e0609 code=c0000005 flags=0 003f:Call KERNEL32.GetLastError() ret=0067247d 003f:Ret KERNEL32.GetLastError() retval=00000000 ret=0067247d 003f:trace:seh:call_stack_handlers handler at 0x7e0609 returned 1 --- snip ---
The app code: --- snip --- 0044D383 | lea ecx,dword ptr ss:[esp+1C] | 0044D387 | push ecx | 0044D388 | call dword ptr ds:[<&VariantInit>] | 0044D38E | mov eax,dword ptr ss:[esp+10] | 0044D392 | mov edx,dword ptr ds:[eax] | 0044D394 | mov edx,dword ptr ds:[edx+74] | 0044D397 | lea ecx,dword ptr ss:[esp+1C] | 0044D39B | push ecx | 0044D39C | push eax | 0044D39D | call edx | HTMLDocument_get_bgColor 0044D39F | mov ax,word ptr ss:[esp+1C] | 0044D3A4 | cmp ax,8 | vt == VT_BSTR? 0044D3A8 | jne dolphin easyreader.44D4DC | 0044D3A8 | jne dolphin easyreader.44D4DC | 0044D3AE | mov eax,dword ptr ss:[esp+24] | val 0044D3B2 | lea ecx,dword ptr ss:[esp+D4] | 0044D3B9 | call dolphin easyreader.402C60 | *crash proc* 0044D3BE | mov dword ptr ss:[esp+100],ebx | 0044D3C5 | cmp dword ptr ss:[esp+E8],ebx | 0044D3CC | jbe dolphin easyreader.44D4C3 | ... 00402C60 | push esi | 00402C61 | mov esi,ecx | 00402C63 | xor ecx,ecx | 00402C65 | mov dword ptr ds:[esi+18],7 | 00402C6C | mov dword ptr ds:[esi+14],0 | 00402C73 | mov word ptr ds:[esi+4],cx | 00402C77 | mov ecx,eax | 00402C79 | push edi | 00402C7A | lea edi,dword ptr ds:[ecx+2] | 00402C7D | lea ecx,dword ptr ds:[ecx] | *boom* 00402C80 | mov dx,word ptr ds:[ecx] | 00402C83 | add ecx,2 | 00402C86 | test dx,dx | 00402C89 | jne dolphin easyreader.402C80 | 00402C8B | sub ecx,edi | 00402C8D | sar ecx,1 | 00402C8F | push ecx | 00402C90 | call dolphin easyreader.403590 | 00402C95 | pop edi | 00402C96 | mov eax,esi | 00402C98 | pop esi | 00402C99 | ret | ... --- snip --- --- snip --- $+1C 0031D5F8 00000008 ; vt = VT_BSTR, wReserved1 $+20 0031D5FC 0031D620 ; wReserved2, wReserved3 $+24 0031D600 00000000 ; value = NULL --- snip --- Looks like the app gets a NULL bstr from 'HTMLBodyElement::get_bgColor'. The app code doesn't really do error checking, except for vt == 8 (VT_BSTR) and accesses variant value (BSTR) directly. I would have expected at least an empty bstr since the property/method returned S_OK. https://source.winehq.org/git/wine.git/blob/cf8a6eb2769d2c4ba5bb837d29db89f6... --- snip --- 407 static HRESULT WINAPI HTMLBodyElement_get_bgColor(IHTMLBodyElement *iface, VARIANT *p) 408 { 409 HTMLBodyElement *This = impl_from_IHTMLBodyElement(iface); 410 nsAString strColor; 411 nsresult nsres; 412 HRESULT hres; 413 414 TRACE("(%p)->(%p)\n", This, p); 415 416 nsAString_Init(&strColor, NULL); 417 nsres = nsIDOMHTMLBodyElement_GetBgColor(This->nsbody, &strColor); 418 if(NS_SUCCEEDED(nsres)) { 419 const PRUnichar *color; 420 421 nsAString_GetData(&strColor, &color); 422 V_VT(p) = VT_BSTR; 423 hres = nscolor_to_str(color, &V_BSTR(p)); 424 }else { 425 ERR("SetBgColor failed: %08x\n", nsres); 426 hres = E_FAIL; 427 } 428 429 nsAString_Finish(&strColor); 430 return hres; 431 } --- snip --- 'nsIDOMHTMLBodyElement_GetBgColor' obviously succeeded. https://source.winehq.org/git/wine.git/blob/cf8a6eb2769d2c4ba5bb837d29db89f6... https://source.winehq.org/git/wine.git/blob/cf8a6eb2769d2c4ba5bb837d29db89f6... While at it, small thing: trace messages for 'get_bgColor' refer to 'SetBgColor'. Probably copy/pasta. $ sha1sum EasyReader_for_Windows_6.04_English_\(United_Kingdom\)_DEMO.exe 19d0911a8b05bb0966ce80e2c0e62c48cd039c2c EasyReader_for_Windows_6.04_English_(United_Kingdom)_DEMO.exe $ du -sh EasyReader_for_Windows_6.04_English_\(United_Kingdom\)_DEMO.exe 104M EasyReader_for_Windows_6.04_English_(United_Kingdom)_DEMO.exe $ wine --version wine-5.7-118-gcf8a6eb276 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49062 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://web.archive.org/web | |/20200430183420/https://you | |rdolphin.com/downloads/prod | |uct?demo=true&lid=1&pvid=9 Keywords| |download -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49062 Jacek Caban <jacek(a)codeweavers.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED CC| |jacek(a)codeweavers.com Status|NEW |RESOLVED Fixed by SHA1| |d90c1e1c7fad0178a921d5737c9 | |a4769c34046dc --- Comment #1 from Jacek Caban <jacek(a)codeweavers.com> --- This should be fixed by: https://source.winehq.org/git/wine.git/commitdiff/d90c1e1c7fad0178a921d5737c... The application is crashing for another reason now. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49062 --- Comment #2 from Anastasius Focht <focht(a)gmx.net> --- Hello Jacek, --- quote --- This should be fixed by: https://source.winehq.org/git/wine.git/commitdiff/d90c1e1c7fad0178a921d5737c... --- quote --- indeed, thanks. --- quote --- The application is crashing for another reason now. --- quote --- I've created bug 49335 for that crash. Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49062 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #3 from Alexandre Julliard <julliard(a)winehq.org> --- Closing bugs fixed in 5.11. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla