[Bug 34982] New: Horizon (xbox tool) installer crashes on startup
http://bugs.winehq.org/show_bug.cgi?id=34982 Bug #: 34982 Summary: Horizon (xbox tool) installer crashes on startup Product: Wine Version: 1.7.7 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: mshtml AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, reported in WineHQ forums. Clean WINEPREFIX, no prerequisites used (yet). --- snip --- $ WINEDEBUG=+tid,+seh,+loaddll,+process,+jscript,+mshtml wine ./horizon-setup.exe >>log.txt 2>&1 ... 0009:trace:mshtml:dispex_query_interface (0x6ed09ec)->(IID_IDispatchJS 0x33c048) returning NULL 0009:trace:mshtml:HTMLWindow2_QueryInterface (0x6ed09b8)->(IID_IDispatchEx 0x33c08c) 0009:trace:mshtml:HTMLWindow2_AddRef (0x6ed09b8) ref=13 0009:trace:mshtml:WindowDispEx_GetDispID (0x6ed09b8)->(L"_external" 10000001 0x33c10c) 0009:trace:jscript:JScript_GetScriptDispatch (0x6ef7a68)->(0x33befc) 0009:trace:jscript:DispatchEx_QueryInterface (0x6f15a88)->(IID_IDispatchEx 0x33bf38) 0009:trace:jscript:DispatchEx_GetDispID (0x6f15a88)->(L"_external" 10000001 0x33bfa0) 0009:trace:jscript:jsdisp_get_id not found L"_external" 0009:trace:mshtml:DispatchEx_GetDispID (0x6ed09ec)->(L"_external" 10000001 0x33c10c) 0009:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7d624547 ip=7d624547 tid=0009 0009:trace:seh:raise_exception info[0]=00000000 0009:trace:seh:raise_exception info[1]=00000048 0009:trace:seh:raise_exception eax=00000000 ebx=7d6f0000 ecx=80000002 edx=05d7fa8c esi=0033c060 edi=7c690f72 0009:trace:seh:raise_exception ebp=0033bfb8 esp=0033bf00 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010206 0009:trace:seh:call_stack_handlers calling handler at 0x7bc9dc13 code=c0000005 flags=0 wine: Unhandled page fault on read access to 0x00000048 at address 0x7d624547 (thread 0009), starting debugger... 0009:trace:seh:start_debugger Starting debugger "winedbg --auto 8 848" 0009:trace:seh:call_stack_handlers handler at 0x7bc9dc13 returned 1 Unhandled exception: page fault on read access to 0x00000048 in 32-bit code (0x7d624547). Register dump: CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b EIP:7d624547 ESP:0033bf00 EBP:0033bfb8 EFLAGS:00010206( R- -- I - -P- ) EAX:00000000 EBX:7d6f0000 ECX:80000002 EDX:05d7fa8c ESI:0033c060 EDI:7c690f72 Stack dump: 0x0033bf00: 06f112f8 00000000 0033bf40 7d5a1257 0x0033bf10: 7ffd8000 7bcea705 0033bf68 7d5a1495 0x0033bf20: 07263678 0714fae4 0033bf68 00000001 0x0033bf30: 0714fae4 00000009 00000001 7d6845a5 0x0033bf40: 06f11308 00000000 06ac5868 00000009 0x0033bf50: 00000000 070226b0 06f11308 0033bf40 000c: sel=0067 base=00000000 limit=00000000 16-bit --x Backtrace: =>0 0x7d624547 get_frame_by_name+0x282(This=0x6d03f78, name="_external", deep=0, ret=0x33bfec) [/home/focht/projects/wine/wine-git/dlls/mshtml/htmlwindow.c:420] in mshtml (0x0033bfb8) 1 0x7d62bdf5 WindowDispEx_GetDispID+0x162(iface=<couldn't compute location>, bstrName=<couldn't compute location>, grfdex=<couldn't compute location>, pid=<couldn't compute location>) [/home/focht/projects/wine/wine-git/dlls/mshtml/htmlwindow.c:2520] in mshtml (0x0033c048) 2 0x7c6961c9 disp_get_id+0x11b(ctx=0x6f12360, disp=0x6ed09b8, name="_external", name_bstr="_external", flags=0, id=0x33c10c) [/home/focht/projects/wine/wine-build32/dlls/jscript/../../include/dispex.h:296] in jscript (0x0033c0d8) 3 0x7c697d9d interp_member+0xc6(ctx=0x7256a78) [/home/focht/projects/wine/wine-git/dlls/jscript/engine.c:887] in jscript (0x0033c138) 4 0x7c69cfa1 enter_bytecode+0xfc(ctx=0x6f12360, code=0x72064c8, func=0x71499b8, ret=0x33c1e4) [/home/focht/projects/wine/wine-git/dlls/jscript/engine.c:2462] in jscript (0x0033c1a8) 5 0x7c69d37c exec_source+0x1ea(ctx=0x7256a78, code=0x72064c8, func=0x71499b8, from_eval=0, ret=0x33c6a0) [/home/focht/projects/wine/wine-git/dlls/jscript/engine.c:2534] in jscript (0x0033c208) 6 0x7c69f792 invoke_source+0x213(ctx=0x6f12360, function=0x7253968, this_obj=0x6f15a88, argc=0x2, argv=0x7182390, r=0x33c6a0) [/home/focht/projects/wine/wine-git/dlls/jscript/function.c:240] in jscript (0x0033c268) 7 0x7c69fc9e Function_invoke+0x194(func_this=0x7253968, jsthis=0x6f15a88, flags=0x1, argc=0x2, argv=0x7182390, r=0x33c6a0) [/home/focht/projects/wine/wine-git/dlls/jscript/function.c:357] in jscript (0x0033c2a8) 8 0x7c693351 jsdisp_call_value+0x53(jsfunc=0x7253968, jsthis=0x6f15a88, flags=0x1, argc=0x2, argv=0x7182390, r=0x33c6a0) [/home/focht/projects/wine/wine-git/dlls/jscript/dispex.c:1061] in jscript (0x0033c2e8) ... --- snip --- Crash location: http://source.winehq.org/git/wine.git/blob/0be56d27d2d4b22367313fa4c6f1e6586... $ sha1sum horizon-setup.exe d622f53253ee3ae8a3e4f180759e8e4e821a2466 horizon-setup.exe $ du -sh horizon-setup.exe 788K horizon-setup.exe $ wine --version wine-1.7.7-119-g3197262 Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34982 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, Installer URL| |https://www.xboxmb.com/down | |load -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34982 --- Comment #1 from Anastasius Focht <focht(a)gmx.net> 2013-11-23 06:36:15 CST --- Created attachment 46617 --> http://bugs.winehq.org/attachment.cgi?id=46617 WINEDEBUG=+tid,+seh,+loaddll,+process,+jscript,+mshtml wine ./horizon-setup.exe
log.txt 2>&1
tail -n 10000 log.txt -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34982 Rosanne DiMesio <dimesio(a)earthlink.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chaviusmiller(a)gmail.com --- Comment #2 from Rosanne DiMesio <dimesio(a)earthlink.net> --- *** Bug 35262 has been marked as a duplicate of this bug. *** -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34982 --- Comment #3 from Austin English <austinenglish(a)gmail.com> --- A user in #winehq asked about this, so I checked on it. Still in wine-1.7.11-237-g00aeadc. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34982 jobo <joenow(a)live.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |joenow(a)live.com -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=34982 --- Comment #4 from Anastasius Focht <focht(a)gmx.net> --- *** Bug 36522 has been marked as a duplicate of this bug. *** -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Horizon (xbox tool) |Multiple web-installers |installer crashes on |crash in |startup |'get_frame_by_name' with | |NULL 'HTMLOuterWindow' | |(Horizon XBOX tool, MAGIX | |Video Deluxe MX Plus 18) --- Comment #5 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, revisiting, still present. Can also be reproduced with MAGIX Video Deluxe MX Plus 18 web-installer (bootstrapper). --- snip --- $ WINEDEBUG=+tid,+seh,+relay,+mshtml,+ieframe,+jscript wine ./Magix_Video_Deluxe_Mx_Plus_18.exe >>log.txt 2>&1 ... 0041:Call KERNEL32.CreateProcessA(00d611a0 "C:\\users\\focht\\Temp\\netdownloader",0013e040 "\"C:\\users\\focht\\Temp\\netdownloader\"",00000000,00000000,00000001,01000204,00000000,00000000,0033fa0c,0033fa58) ret=10006f7f ... 0043:Call KERNEL32.__wine_kernel_init() ret=7bc5a89d 0041:Ret KERNEL32.CreateProcessA() retval=00000001 ret=10006f7f ... 0043:trace:jscript:interp_ident L"window" 0043:trace:jscript:identifier_eval L"window" 0043:trace:jscript:jsdisp_get_id not found L"window" 0043:trace:jscript:jsdisp_get_id not found L"window" 0043:trace:mshtml:HTMLWindow2_AddRef (0x12b3e180) ref=14 ... 0043:trace:jscript:interp_member 0043:trace:mshtml:HTMLWindow2_QueryInterface (0x12b3e180)->(IID_IDispatchJS 0x33bf08) 0043:trace:mshtml:HTMLWindow2_QueryInterface (0x12b3e180)->(IID_IDispatchEx 0x33bf4c) 0043:trace:mshtml:HTMLWindow2_AddRef (0x12b3e180) ref=15 0043:trace:mshtml:WindowDispEx_GetDispID (0x12b3e180)->(L"_external" 10000001 0x33bfcc) 0043:trace:jscript:JScript_GetScriptDispatch (0x12910d90)->(0x33bdbc) 0043:trace:jscript:DispatchEx_QueryInterface (0x12b68248)->(IID_IDispatchEx 0x33bdf8) 0043:trace:jscript:DispatchEx_GetDispID (0x12b68248)->(L"_external" 10000001 0x33be60) 0043:trace:jscript:jsdisp_get_id not found L"_external" 0043:trace:mshtml:DispatchEx_GetDispID (0x12b3e1b4)->(L"_external" 10000001 0x33bfcc) 0043:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7d5f4011 ip=7d5f4011 tid=0043 0043:trace:seh:raise_exception info[0]=00000000 0043:trace:seh:raise_exception info[1]=00000048 0043:trace:seh:raise_exception eax=00000000 ebx=7d6dc000 ecx=7d6dc000 edx=05d329e0 esi=0033bf20 edi=00000001 0043:trace:seh:raise_exception ebp=0033be78 esp=0033bdc0 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010206 ... Unhandled exception: page fault on read access to 0x00000048 in 32-bit code (0x7d5f4011). ... Backtrace: =>0 0x7d5f4011 get_frame_by_name+0x282(This=0x12904c28, name="_external", deep=0, ret=0x33beac) [/home/focht/projects/wine/wine.repo/src/dlls/mshtml/htmlwindow.c:409] in mshtml (0x0033be78) 1 0x7d5fbc3d WindowDispEx_GetDispID+0x162(iface=<couldn't compute location>, bstrName=<couldn't compute location>, grfdex=<couldn't compute location>, pid=<couldn't compute location>) [/home/focht/projects/wine/wine.repo/src/dlls/mshtml/htmlwindow.c:2556] in mshtml (0x0033bf08) 2 0x7c97eead disp_get_id+0x11b(ctx=0x129102d0, disp=0x12b3e180, name="_external", name_bstr="_external", flags=0, id=0x33bfcc) [/home/focht/projects/wine/wine.repo/build-x86/dlls/jscript/../../include/dispex.h:296] in jscript (0x0033bf98) 3 0x7c980a25 interp_member+0xc6(ctx=0x12ff62f8) [/home/focht/projects/wine/wine.repo/src/dlls/jscript/engine.c:896] in jscript (0x0033bff8) 4 0x7c985c08 enter_bytecode+0xfc(ctx=0x129102d0, code=0x12e4db48, func=0x12d99390, ret=0x33c0a4) [/home/focht/projects/wine/wine.repo/src/dlls/jscript/engine.c:2471] in jscript (0x0033c068) 5 0x7c985fe3 exec_source+0x1ea(ctx=0x12ff62f8, code=0x12e4db48, func=0x12d99390, from_eval=0, ret=0x33c560) [/home/focht/projects/wine/wine.repo/src/dlls/jscript/engine.c:2543] in jscript (0x0033c0c8) 6 0x7c988462 invoke_source+0x27b(ctx=0x129102d0, function=0x12e9b1f8, this_obj=0x12b68248, argc=0x2, argv=0x12fffc60, r=0x33c560) [/home/focht/projects/wine/wine.repo/src/dlls/jscript/function.c:245] in jscript (0x0033c138) 7 0x7c98896e Function_invoke+0x194(func_this=0x12e9b1f8, jsthis=0x12b68248, flags=0x1, argc=0x2, argv=0x12fffc60, r=0x33c560) [/home/focht/projects/wine/wine.repo/src/dlls/jscript/function.c:362] in jscript (0x0033c178) 8 0x7c97b9f8 jsdisp_call_value+0x53(jsfunc=0x12e9b1f8, jsthis=0x12b68248, flags=0x1, argc=0x2, argv=0x12fffc60, r=0x33c560) [/home/focht/projects/wine/wine.repo/src/dlls/jscript/dispex.c:1061] in jscript (0x0033c1b8) ... 57 0x6aa33972 in xul (+0xdf3971) (0x05cfeb90) 0x7d5f4011 get_frame_by_name+0x282 [/home/focht/projects/wine/wine.repo/src/dlls/mshtml/htmlwindow.c:409] in mshtml: movl 0x48(%eax),%eax 409 hres = IHTMLElement_get_id(&window_iter->frame_element->element.IHTMLElement_iface, &id); Modules: Module Address Debug info Name (180 modules) PE 350000- 356000 Deferred system PE 3d0000- 3d9000 Deferred luaxml_lib PE 3e0000- 3f6000 Deferred 87a5250e7389d052be3fdc257872ebd8C:\users\focht\Temp\nst2161.tmp\87a5250e7389d052be3fdc257872ebd873ef2deb.dll PE 400000- 44c000 Deferred netdownloader ... Threads: process tid prio (all id:s are in hex) ... 0000003e netdownloader 0000003f 0 00000042 (D) C:\users\focht\Temp\netdownloader ... 00000043 0 <== --- snip --- Source: http://source.winehq.org/git/wine.git/blob/679ddf24d442885ff5dc943d6239278fb... At least a NULL check along with a FIXME/WARN should be added. $ sha1sum Magix_Video_Deluxe_Mx_Plus_18.exe 1c05058b5dfc7084b361784353dc3e71d132fbf9 Magix_Video_Deluxe_Mx_Plus_18.exe $ du -sh Magix_Video_Deluxe_Mx_Plus_18.exe 3.6M Magix_Video_Deluxe_Mx_Plus_18.exe $ wine --version wine-1.7.35-24-g3873c93 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 Béla Gyebrószki <gyebro69(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |gyebro69(a)gmail.com --- Comment #6 from Béla Gyebrószki <gyebro69(a)gmail.com> --- Affects Microsoft Chat 2.5 web installer: http://www.tucows.com/preview/193891 Backtrace: =>0 0x7cb18cd9 get_frame_by_name+0x259(This=0xbf32a50, name="_external", deep=0, ret=0x33c48c) [/home/gyebro/sources/wine-git/dlls/mshtml/htmlwindow.c:409] in mshtml (0x0033c458) ... 46 0x6ac7da31 in xul (+0x103da30) (0x089fce50) 0x7cb18cd9 get_frame_by_name+0x259 [/home/gyebro/sources/wine-git/dlls/mshtml/htmlwindow.c:409] in mshtml: movl 0x00000048,%eax 409 hres = IHTMLElement_get_id(&window_iter->frame_element->element.IHTMLElement_iface, &id); Note: neither IE7 nor IE8 helps for me. The installer shows a blank screen with IE7 installed, crashes with IE8. Possibly duplicates: bug #32966 and bug #34808 wine-1.7.43-166-g39d71c5 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 Indrek <efbiaiinzinz(a)hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |efbiaiinzinz(a)hotmail.com --- Comment #7 from Indrek <efbiaiinzinz(a)hotmail.com> --- Sent in a test patch (not yet approved) https://source.winehq.org/patches/data/111605 Does this fix all the crashes? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 --- Comment #8 from Béla Gyebrószki <gyebro69(a)gmail.com> --- (In reply to Indrek from comment #7)
Sent in a test patch (not yet approved) https://source.winehq.org/patches/data/111605 Does this fix all the crashes?
1. the patch fixes the crash in the web installer from Tucows.com, but the installer hangs later (could a different issue). 2. the web page from bug #32966 loads properly, without crashing 3. the web page from bug #34808 crashes with a different backtrace in recent Wine versions, so can't test it with your patch (http://pastebin.com/Q0B10Pm4) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 --- Comment #9 from Indrek <efbiaiinzinz(a)hotmail.com> --- 1. Indeed, the tucows installer crash itself is gone but it seems to get in an endless loop, spamming the console with TranslateAccelerator fixme's. 2. Yes, that crash is gone and page load up correctly. 3. After a bit of digging it seems that nsstyle is released too soon (ref reaches zero, causing cleanup) but later on it is used again in a cleaned up state, causing the crash. I don't think my skill is high enough to fix it correctly. I got it to "work" by modding get_nsstyle_attr_nsval (line 482 in mshtml/htmlstyle.c) to return E_FAIL if nsstyle is NULL but this does not fix the issue with the early cleanup which is the root cause. Perhaps someone with more debugging experience can take a look at it. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 --- Comment #10 from Indrek <efbiaiinzinz(a)hotmail.com> --- Bit more digging in the logfile revealed the culprit line in jquery that causes misbehaviour. bx = function (a, b) { var c, d = a.currentStyle && a.currentStyle[b].. The first invocation of a.currentStyle before the && sign creates instance of HTMLCurrentStyle and then releases it (I guess since it is not stored into any variable), but for some reason, the second part of && ends up using the same reference to the now-released HTMLCurrentStyle which ends up as segfault, because nsstyle has been released already. Either the jscript releases the currentStyle too early or the mshtml incorrectly reuses the released currentStyle instance, will have to dig a bit more. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 --- Comment #11 from Indrek <efbiaiinzinz(a)hotmail.com> --- Ok, for 3rd bug I think I found the issue, seems to be a long known Gecko bug that causes crash in wine, sent the patch (not yet accepted). https://source.winehq.org/patches/data/111647 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 --- Comment #12 from Indrek <efbiaiinzinz(a)hotmail.com> --- Fix for the crash made it in http://source.winehq.org/git/wine.git/commit/2676488fcd95c70ff18404660877f63... Next issue seems to be the endless loop (visually looks like hanging) of the webinstallers. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 Nikolay Sivov <bunglehead(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |2676488fcd95c70ff1840466087 | |7f63ac6838789 Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #13 from Nikolay Sivov <bunglehead(a)gmail.com> --- Fixed with 2676488fcd95c70ff18404660877f63ac6838789. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=34982 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #14 from Alexandre Julliard <julliard(a)winehq.org> --- Closing bugs fixed in 1.7.45. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
wine-bugs＠winehq.org