[PATCH v6 0/1] MR1456: imm32: Prevent deadlock on unload

[Fabian Maurer (＠DarkShadow44)]

We need to make sure all (important) cleanup is finished when we exit DllMain,
otherwise we might already unload krnl386 and deadlock
Since we can't have a synchronous DestroyWindow, use an extra message

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52511
Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de>


Code flow is like follows:

- DOSVM_Exit -> RtlExitUserThread -> LdrShutdownThread
- acquire loader lock
- send DLL_THREAD_DETACH to imm32
- - calls DestroyWindow on its window
- - WM_DESTROY is handled asynchonously!
- send DLL_THREAD_DETACH to krnl386.exe 
- - TASK_ExitTask
- -  try get win16 lock, is blocked by ime32

meanwhile, at ime32

- handles WM_DESTROY
- already have win16 lock from user32
- __wine_ime_wnd_proc (WM_DESTROY) -> imm_couninit_thread -> CoRevokeInitializeSpy
- LdrGetProcedureAddress (want CoRevokeInitializeSpy)
- try get loader_lock, is blocked

Solution is to wait in ime32 DllMain until the cleanup as happened, aka CoRevokeInitializeSpy has finished.

--
  v6: imm32: Prevent deadlock on unload
 
https://gitlab.winehq.org/wine/wine/-/merge_requests/1456

[PATCH v6 1/1] imm32: Prevent deadlock on unload

[Fabian Maurer]

From: Fabian Maurer <dark.shadow4(a)web.de>

ole32 is delay loaded, which can cause race conditions against
krnl386.exe when unloading.
This is because imm32 tries to get the loader lock while holding the win16 mutex,
and kernel386 does the opposite.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52511
Signed-off-by: Fabian Maurer <dark.shadow4(a)web.de>
---
 dlls/imm32/imm.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/dlls/imm32/imm.c b/dlls/imm32/imm.c
index 780d544c0e9..9c1e70fbb35 100644
--- a/dlls/imm32/imm.c
+++ b/dlls/imm32/imm.c
@@ -80,6 +80,9 @@ typedef struct _tagImmHkl{
     DWORD (WINAPI *pImeGetImeMenuItems)(HIMC, DWORD, DWORD, IMEMENUITEMINFOW *, IMEMENUITEMINFOW *, DWORD);
 } ImmHkl;
 
+static HRESULT (WINAPI*pCoRevokeInitializeSpy)(ULARGE_INTEGER cookie);
+static void (WINAPI *pCoUninitialize)(void);
+
 typedef struct tagInputContextData
 {
         HIMC            handle;
@@ -249,7 +252,7 @@ static void imm_couninit_thread(BOOL cleanup)
 
     if (cleanup && spy->cookie.QuadPart)
     {
-        CoRevokeInitializeSpy(spy->cookie);
+        pCoRevokeInitializeSpy(spy->cookie);
         spy->cookie.QuadPart = 0;
     }
 
@@ -261,7 +264,7 @@ static void imm_couninit_thread(BOOL cleanup)
     {
         spy->apt_flags &= ~IMM_APT_CREATED;
         if (spy->apt_flags & IMM_APT_CAN_FREE)
-            CoUninitialize();
+            pCoUninitialize();
     }
     if (cleanup)
         spy->apt_flags = 0;
@@ -366,6 +369,13 @@ static void imm_coinit_thread(void)
 
     TRACE("implicit COM initialization\n");
 
+    if (!pCoRevokeInitializeSpy)
+    {
+        HMODULE module_ole32 = GetModuleHandleA("ole32");
+        pCoRevokeInitializeSpy = (void*)GetProcAddress(module_ole32, "CoRevokeInitializeSpy");
+        pCoUninitialize = (void*)GetProcAddress(module_ole32, "CoUninitialize");
+    }
+
     if (!(spy = get_thread_coinit_spy()))
     {
         if (!(spy = HeapAlloc(GetProcessHeap(), 0, sizeof(*spy)))) return;
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/1456

[PATCH v6 1/1] imm32: Prevent deadlock on unload

[Marvin]

Hi,

It looks like your patch introduced the new failures shown below.
Please investigate and fix them before resubmitting your patch.
If they are not new, fixing them anyway would help a lot. Otherwise
please ask for the known failures list to be updated.

The tests also ran into some preexisting test failures. If you know how
to fix them that would be helpful. See the TestBot job for the details:

The full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=126581

Your paranoid android.


=== debian11 (32 bit report) ===

d3d8:
stateblock: Timeout
visual: Timeout

d3d9:
d3d9ex: Timeout
device: Timeout
stateblock: Timeout
visual: Timeout

d3dcompiler_43:
asm: Timeout
blob: Timeout
hlsl_d3d11: Timeout
hlsl_d3d9: Timeout
reflection: Timeout

d3dcompiler_46:
asm: Timeout
blob: Timeout
hlsl_d3d11: Timeout
hlsl_d3d9: Timeout
reflection: Timeout

d3dcompiler_47:
asm: Timeout
blob: Timeout
hlsl_d3d11: Timeout
hlsl_d3d9: Timeout
reflection: Timeout

d3drm:
d3drm: Timeout

Report validation errors:
d3drm:vector timeout

=== debian11 (build log) ===

WineRunWineTest.pl:error: The task timed out

[Piotr Caban (＠piotr)]

Piotr Caban (@piotr) commented about dlls/imm32/imm.c:
> DWORD (WINAPI *pImeGetImeMenuItems)(HIMC, DWORD, DWORD, IMEMENUITEMINFOW *, IMEMENUITEMINFOW *, DWORD);
>  } ImmHkl;
>
> +static HRESULT (WINAPI*pCoRevokeInitializeSpy)(ULARGE_INTEGER cookie);

```suggestion:-0+0
static HRESULT (WINAPI *pCoRevokeInitializeSpy)(ULARGE_INTEGER cookie);
```

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/1456#note_16937

[Piotr Caban (＠piotr)]

Piotr Caban (@piotr) commented about dlls/imm32/imm.c:
> TRACE("implicit COM initialization\n");
>
> +    if (!pCoRevokeInitializeSpy)
> +    {
> +        HMODULE module_ole32 = GetModuleHandleA("ole32");
> +        pCoRevokeInitializeSpy = (void*)GetProcAddress(module_ole32, "CoRevokeInitializeSpy");
> +        pCoUninitialize = (void*)GetProcAddress(module_ole32, "CoUninitialize");
> +    }

Please use e.g. InitOnceExecuteOnce to initialize the variables. In theory, one thread may set pCoRevokeInitializeSpy, second thread may assume at this point that pCoUninitialize is already set while it's not.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/1456#note_16938