[Bug 59434] New: mozglue bypasses NtCreateThreadEx, leading to uninitialized x87/SSE FPU state and SIGFPE (0xc000008f) in Gecko

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59434

            Bug ID: 59434
           Summary: mozglue bypasses NtCreateThreadEx, leading to
                    uninitialized x87/SSE FPU state and SIGFPE
                    (0xc000008f) in Gecko
           Product: Wine-gecko
           Version: unspecified
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: major
          Priority: P2
         Component: wine-gecko-unknown
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 80407
  --> http://bugs.winehq.org/attachment.cgi?id=80407
Combined winedbg showing info about FPU settings of gecko thread, svg rendering
thread, and backtrace

In wine-gecko, mozglue creates threads by calling the host's pthread_create
directly instead of going through Wine's internal thread management
(NtCreateThreadEx). Because these threads are spawned outside of Wine's
lifecycle management, they do not receive the standard Windows FPU environment
initialization.

Specifically, new threads inherit the host's default Linux FPU state rather
than the Windows-standard FPU Control Word (0x037f) and MXCSR (0x1f80). When
Gecko’s layout engine (xul.dll) performs transcendental math operations (such
as FSINCOS), it triggers a SIGFPE (translated to a 0xc000008f Inexact Result
exception) because the precision exceptions are not correctly masked.

Steps to Reproduce:
Run an application utilizing wine-gecko with Direct2D SVG rendering enabled
(e.g., Solid Edge 2026 Ribbon UI).

Trigger a complex SVG render or layout calculation that invokes transcendental
math instructions in xul.dll.

The application will crash with 0xc000008f (Inexact Result) or a SIGFPE when a
math instruction is executed on a thread spawned by mozglue.

Actual Result:
Threads created via mozglue have uninitialized or "dirty" FPU status/control
flags, leading to catastrophic floating-point exceptions in Gecko components.

Expected Result:
Every thread, including those spawned by mozglue, should have an initialized
FPU state consistent with Windows defaults (0x037f) to prevent exceptions
during standard math operations.

Proof of Concept / Workaround:
I have verified that preloading a custom wrapper to intercept pthread_create
and explicitly calling fninit (and potentially ldmxcsr) at the start of the
thread resolves the stability issues entirely.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59434] mozglue bypasses NtCreateThreadEx, leading to uninitialized x87/SSE FPU state and SIGFPE (0xc000008f) in Gecko

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59434

--- Comment #1 from Jakub Woźniak <[e-mail]> ---
Created attachment 80408
  --> http://bugs.winehq.org/attachment.cgi?id=80408
Workaround source code.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59434] mozglue bypasses NtCreateThreadEx, leading to uninitialized x87/SSE FPU state and SIGFPE (0xc000008f) in Gecko

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59434

Jakub Woźniak <[e-mail]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
       Distribution|---                         |Mint

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.