May 2014 - Wine-Bugs - list.winehq.org

[Bug 36319] New: valgrind shows several possible leaks in quartz/tests/misc.c
by wine-bugs＠winehq.org Feb. 12, 2021

Feb. 12, 2021

https://bugs.winehq.org/show_bug.cgi?id=36319 Bug ID: 36319 Summary: valgrind shows several possible leaks in quartz/tests/misc.c Product: Wine Version: 1.7.18 Hardware: x86 OS: Linux Status: NEW Keywords: download, source, testcase Severity: normal Priority: P2 Component: quartz Assignee: wine-bugs(a)winehq.org Reporter: austinenglish(a)gmail.com Created attachment 48405 --> https://bugs.winehq.org/attachment.cgi?id=48405 valgrind log ==27568== 5,744 bytes in 148 blocks are possibly lost in loss record 643 of 655 ==27568== at 0x7BC50A9B: RtlAllocateHeap (heap.c:255) ==27568== by 0x4ECBA52: alloc_bstr (oleaut.c:162) ==27568== by 0x4ECC255: SysAllocStringByteLen (oleaut.c:413) ==27568== by 0x4EF7C4F: ITypeLib2_Constructor_MSFT (typelib.c:2254) ==27568== by 0x4EFB20B: LoadTypeLibEx (typelib.c:3460) ==27568== by 0x4EFCDF2: LoadTypeLib (typelib.c:454) ==27568== by 0x4EFD4AA: LoadRegTypeLib (typelib.c:537) ==27568== by 0x647CAD3: ??? ==27568== by 0x6483475: ??? ==27568== by 0x6413806: ??? ==27568== by 0x6413AC0: ??? ==27568== by 0x53134DD: CoCreateInstance (unknwn.h:226) ==27568== by 0x64832A8: ??? ==27568== by 0x6486644: ??? ==27568== by 0x641A819: ??? ==27568== by 0x6413AC0: ??? ==27568== by 0x53134DD: CoCreateInstance (unknwn.h:226) ==27568== by 0x4D6F01A: test_aggregation (misc.c:81) ==27568== by 0x4D70125: func_misc (misc.c:174) ==27568== by 0x4D723D4: run_test (test.h:584) ==27568== ==9329== 288 bytes in 2 blocks are definitely lost in loss record 485 of 657 ==9329== at 0x7BC50A9B: RtlAllocateHeap (heap.c:255) ==9329== by 0x654C126: ??? ==9329== by 0x6544704: ??? ==9329== by 0x64ECFB7: ??? ==9329== by 0x64E7667: ??? ==9329== by 0x53134DD: CoCreateInstance (unknwn.h:226) ==9329== by 0x4D6F01A: test_aggregation (misc.c:81) ==9329== by 0x4D70125: func_misc (misc.c:174) ==9329== by 0x4D723D4: run_test (test.h:584) ==9329== by 0x4D727C3: main (test.h:654) ==9329== etc. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 4

[Bug 35033] New: Alpha Protocol: Game hangs with black screen at startup
by wine-bugs＠winehq.org Feb. 12, 2021

Feb. 12, 2021

http://bugs.winehq.org/show_bug.cgi?id=35033 Bug #: 35033 Summary: Alpha Protocol: Game hangs with black screen at startup Product: Wine Version: 1.7.7 Platform: Other OS/Version: Mac OS X Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: ipickert55(a)gmail.com Classification: Unclassified Created attachment 46703 --> http://bugs.winehq.org/attachment.cgi?id=46703 Wine Log Game just sits there with a black screen, no sound or menus or anything. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 12

[Bug 29252] New: ICBC Internet Banking Assistant ICBCEBankAssist.exe can't open embed iexplore
by wine-bugs＠winehq.org Feb. 12, 2021

Feb. 12, 2021

http://bugs.winehq.org/show_bug.cgi?id=29252 Bug #: 29252 Summary: ICBC Internet Banking Assistant ICBCEBankAssist.exe can't open embed iexplore Product: Wine Version: 1.3.34 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: fracting(a)gmail.com Classification: Unclassified Created attachment 37828 --> http://bugs.winehq.org/attachment.cgi?id=37828 Log: start ICBC Assistant wine-1.3.34-39-g95f81d1 1. Download ICBC Internet Banking Assistant installer ( ICBCSetupIntegration.msi ) from https://mybank.icbc.com.cn/icbc/enperbank/index.jsp $ wget http://www.icbc.com.cn/icbc/html/download/EbankToolsSoftware/ICBCSetupInteg… 2. install ICBC Internet Banking Assistant $ msiexec /i ICBCSetupIntegration.msi 3. Start Internet Banking Assistant cd to "Program Files/ICBCEbankTools/ICBCSetupIntegration" $ wine ICBCEBankAssist.exe 4. Click on "One-key Installation for Non-USBKey User" Expect result: open a embed iexplore, user can install ActiveX controls from the Assistant Actual result: nothing happen winetricks wininet doesn't work, winetricks ie7 doesn't work -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 7

[Bug 25579] New: Microsoft Flight Simulator X: cannot activate product
by wine-bugs＠winehq.org Feb. 12, 2021

Feb. 12, 2021

http://bugs.winehq.org/show_bug.cgi?id=25579 Summary: Microsoft Flight Simulator X: cannot activate product Product: Wine Version: 1.3.9 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: austinenglish(a)gmail.com Terminal shows some wininet fixme's: fixme:wininet:CommitUrlCacheEntryInternal entry already in cache - don't know what to do! fixme:wininet:CommitUrlCacheEntryInternal entry already in cache - don't know what to do! fixme:wininet:CommitUrlCacheEntryInternal entry already in cache - don't know what to do! fixme:wininet:CommitUrlCacheEntryInternal entry already in cache - don't know what to do! fixme:wininet:CommitUrlCacheEntryInternal entry already in cache - don't know what to do! fixme:wininet:CommitUrlCacheEntryInternal entry already in cache - don't know what to do! so I tried native wininet, no dice. Next was a winhttp error: err:winhttp:netconn_secure_connect couldn't verify server certificate (12057) so 'winetricks winhttp'. Still no luck: austin(a)aw21 ~/.wine/drive_c/Program Files/Microsoft Games/Microsoft Flight Simulator X $ wine fsx.exe fixme:heap:HeapSetInformation 0x750000 0 0x32f36c 4 fixme:heap:HeapSetInformation 0x110000 0 0x32f368 4 fixme:heap:HeapSetInformation 0x330000 0 0x32f364 4 fixme:ole:CoInitializeSecurity ((nil),-1,(nil),(nil),0,3,(nil),0,(nil)) - stub! fixme:ras:RasEnumConnectionsW (0x204b90,0x1e1e454,0x1fd2004),stub! fixme:ras:RasEnumConnectionsW RAS support is not implemented! Configure program to use LAN connection/winsock instead! fixme:secur32:schan_InitializeSecurityContextW Using hardcoded "NORMAL" priority fixme:wintrust:HTTPSCertificateTrust (0x1ef968) fixme:wintrust:HTTPSFinalProv (0x1ef968) didn't try beyond that. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 9

[Bug 29849] New: oleaut32's OLEPictureImpl_Load fails when Stat() method is missing
by wine-bugs＠winehq.org Feb. 12, 2021

Feb. 12, 2021

http://bugs.winehq.org/show_bug.cgi?id=29849 Bug #: 29849 Summary: oleaut32's OLEPictureImpl_Load fails when Stat() method is missing Product: Wine Version: 1.4-rc2 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: oleaut32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: michael.blumenkrantz(a)gmail.com Classification: Unclassified Created attachment 38772 --> http://bugs.winehq.org/attachment.cgi?id=38772 test case Without a Stat() method, this function should only read the parts of a file that are needed. Instead, it continues to read and eventually crashes. Find attached a test case which takes an image file as an argument, then crashes. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 23

[Bug 35927] New: Win Toolkit v.1.4.37.20 requires administrative privilegies on startup.
by wine-bugs＠winehq.org Feb. 12, 2021

Feb. 12, 2021

http://bugs.winehq.org/show_bug.cgi?id=35927 Bug ID: 35927 Summary: Win Toolkit v.1.4.37.20 requires administrative privilegies on startup. Product: Wine Version: 1.6.2 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: sov.info(a)mail.ru Created attachment 47977 --> http://bugs.winehq.org/attachment.cgi?id=47977 screenshot I tried to login as root and run wine, but this error still present. You can see it on screenshot... Ubuntu 14.04 beta x64, wine x86-x64, ver. 1.6.2 from proposed. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 7

[Bug 36434] New: Regression: Capture NX-D fails with "Initialization error (E010)"
by wine-bugs＠winehq.org Feb. 12, 2021

Feb. 12, 2021

http://bugs.winehq.org/show_bug.cgi?id=36434 Bug ID: 36434 Summary: Regression: Capture NX-D fails with "Initialization error (E010)" Product: Wine Version: unspecified Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: fordfrog(a)fordfrog.com i'm using latest wine from source repository. this bug is probably week or so old. when launching Nikon Capture NX-D, it fails with "Initialization error (E010)". i have wine compiled with both 32bit and 64 versions (using gentoo live ebuild), but for the app i am using 32 bit version (64bit version does not work due to some missing implementation in wine). i'm running the app using following command: WINEPREFIX=~/.wine32 WINEARCH=win32 wine .wine32/drive_c/Program\ Files/Nikon/Capture\ NX-D/Module/CaptureNX-D.exe .wine32 directory is initialized for 32bit arch and windows 8. before week or so the app started without any issue and it was usable. but few days ago it stopped to launch. this is the output before the bug occurs: $ WINEPREFIX=~/.wine32 WINEARCH=win32 wine .wine32/drive_c/Program\ Files/Nikon/Capture\ NX-D/Module/CaptureNX-D.exe fixme:msvcp:_Locinfo__Locinfo_ctor_cat_cstr (0x33fbcc 1 C) semi-stub fixme:heap:HeapSetInformation (nil) 1 (nil) 0 fixme:thread:GetThreadPreferredUILanguages 52, 0x33f9c0, 0x33fa30 0x33f9c8 fixme:heap:HeapSetInformation (nil) 1 (nil) 0 fixme:msvcp:_Locinfo__Locinfo_ctor_cat_cstr (0x33edc0 1 C) semi-stub fixme:msvcp:_Locinfo__Locinfo_ctor_cat_cstr (0x33ee50 1 C) semi-stub fixme:msvcp:_Locinfo__Locinfo_ctor_cat_cstr (0x33ec80 1 C) semi-stub fixme:msvcrt:__clean_type_info_names_internal (0x788b0e54) stub fixme:msvcrt:__clean_type_info_names_internal (0x1001e33c) stub fixme:thread:SetThreadIdealProcessor (0xfffffffe): stub the complete process of installation and running is the same as in bug #35864. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 7

[Bug 14697] New: wineserver: debug events can block completion of queued user APCs
by wine-bugs＠winehq.org Feb. 11, 2021

Feb. 11, 2021

http://bugs.winehq.org/show_bug.cgi?id=14697 Summary: wineserver: debug events can block completion of queued user APCs Product: Wine Version: CVS/GIT Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: wineserver AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Hello, consider the following scenario... A debugger is attached to a debuggee. The debuggee has two threads. The debugger processes debug events and queries virtual memory info of remote process using VirtualQueryEx in its main loop. VirtualQueryEx -> NtQueryVirtualMemory -> enqueues APC_VIRTUAL_QUERY user APC for remote process (debuggee). The calling thread is blocked until the APC is completed. Following is the "good" case: tid=0009 (debugger process, calling thread, main debugger loop) tid=001a (debuggee thread 1) --- snip --- .. 0009: queue_apc( thread=(nil), process=0x54, call={APC_VIRTUAL_QUERY,addr=0x7fff0000} ) 001a: *wakeup* signaled=192 cookie=0x7ffdb7b4 0009: queue_apc() = 0 { handle=0x68, self=0 } 0009: select( flags=4, cookie=0x32d30c, signal=(nil), prev_apc=(nil), timeout=infinite, result={}, handles={0x68} ) 0009: select() = PENDING { apc_handle=(nil), timeout=infinite, call={APC_NONE} } 001a: select( flags=4, cookie=0x7ffdb7b4, signal=(nil), prev_apc=(nil), timeout=1c8f097946d2824 (-0.1787600), result={}, handles={} ) 001a: select() = USER_APC { apc_handle=0x68, timeout=1c8f097946d2824 (-0.1787600), call={APC_VIRTUAL_QUERY,addr=0x7fff0000} } 001a: select( flags=4, cookie=0x7ffdb7b4, signal=(nil), prev_apc=0x68, timeout=1c8f097946d2824 (-0.1792110), result={APC_VIRTUAL_QUERY,status=40000002,base=(nil),alloc_base=(nil),size=0,state=0,prot=0,alloc_prot=0,alloc_type=0}, handles={} ) 0009: *wakeup* signaled=0 cookie=0x32d30c 001a: select() = PENDING { apc_handle=(nil), timeout=1c8f097946d2824 (-0.1792110), call={APC_NONE} } 0009: get_apc_result( handle=0x68 ) 0009: get_apc_result() = 0 { result={APC_VIRTUAL_QUERY,status=40000002,base=(nil),alloc_base=(nil),size=0,state=0,prot=0,alloc_prot=0,alloc_type=0} } --- snip --- Now the interesting one, which ultimately leads to block of calling thread ... tid=0009 (debugger process, calling thread, main debugger loop) tid=001a (debuggee thread 1) tid=001b (debuggee thread 2) --- snip --- 0009: continue_debug_event( pid=0019, tid=001a, status=65538 ) 001a: *wakeup* signaled=258 cookie=0x7ffdb7b4 001b: *wakeup* signaled=258 cookie=0x7ffd77b4 0009: continue_debug_event() = 0 .. 0009: read_process_memory( handle=0x54, addr=0x7ffd8000 ) 001a: *signal* signal=19 0009: read_process_memory() = 0 { data= {} } 0009: read_process_memory( handle=0x54, addr=0x7ffd4000 ) 001a: *signal* signal=19 0009: read_process_memory() = 0 { data={} } 0009: queue_apc( thread=(nil), process=0x54, call={APC_VIRTUAL_QUERY,addr=(nil)} ) 001b: *wakeup* signaled=192 cookie=0x7ed44874 0009: queue_apc() = 0 { handle=0x68, self=0 } 001a: load_dll( handle=(nil), base=0x61090000, size=102400, dbg_offset=0, dbg_size=0, name=0x13e468, filename=L"C:\\windows\\system32\\msacm32.dll" ) 001a: *sent signal* signal=10 001b: *sent signal* signal=10 001a: load_dll() = 0 .. 0009: select( flags=4, cookie=0x32d30c, signal=(nil), prev_apc=(nil), timeout=infinite, result={}, handles={0x68} ) 0009: select() = PENDING { apc_handle=(nil), timeout=infinite, call={APC_NONE} } 001a: set_thread_context( handle=0xfffffffe, flags=00010007, suspend=1, context= {...}) 001a: set_thread_context() = 0 { self=1 } 001b: select( flags=4, cookie=0x7ed44874, signal=(nil), prev_apc=(nil), timeout=infinite, result={}, handles={0x4c} ) 001b: select() = USER_APC { apc_handle=0x68, timeout=infinite, call={APC_VIRTUAL_QUERY,addr=(nil)} } 001a: select( flags=4, cookie=0x7ffdb7b4, signal=(nil), prev_apc=(nil), timeout=0, result={}, handles={} ) 001a: select() = PENDING { apc_handle=(nil), timeout=1c8f09794c8b694 (+0.0000000), call={APC_NONE} } 001b: set_thread_context( handle=0xfffffffe, flags=00010007, suspend=1, context= {...}) 001b: set_thread_context() = 0 { self=1 } 001b: select( flags=4, cookie=0x7ffd77b4, signal=(nil), prev_apc=(nil), timeout=0, result={}, handles={} ) 001b: select() = PENDING { apc_handle=(nil), timeout=1c8f09794c90dc4 (+0.0000000), call={APC_NONE} } ... --- snip --- At this point, tid=0009 (debugger) is blocked forever. When the APC_VIRTUAL_QUERY user APC is queued, remote thread 001b is selected/destined to carry out the APC. After thread 001a and 001b woke up, a dynamic library is loaded from thread 001a which results in LOAD_DLL_DEBUG_EVENT dispatched. This initiates the suspension of all threads in the child process (SIGUSR1 is sent for 001a and 001b). Thread 001a is suspended first, 001b next. The suspension of 001b happens to a time when 001b is about to carry out the APC_VIRTUAL_QUERY. Meanwhile thread 0009 (calling process) is waiting for APC completion result forever because it's blocked by VirtualQueryEx in debugger loop, unable to receive and process any debug event. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 21

[Bug 10249] New: Battlefield2/SafeDisc 4. x and Punkbuster services cause lockup: child processes debugging misconception
by wine-bugs＠winehq.org Feb. 11, 2021

Feb. 11, 2021

http://bugs.winehq.org/show_bug.cgi?id=10249 Summary: Battlefield2/SafeDisc 4.x and Punkbuster services cause lockup: child processes debugging misconception Product: Wine Version: CVS/GIT Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: wine-kernel AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Created an attachment (id=8876) --> (http://bugs.winehq.org/attachment.cgi?id=8876) WINEDEBUG=-all,+server,+tid,+loaddll,+seh wine ./BF2.exe +fullscreen 0 +szx 800 +szy 600 &>/tmp/debug_pipe Hello, while testing some PunkBuster stuff on popular games, I came across Battlefield 2 which employs SafeDisc 4.x It seems there is a problem with debuggers in chained child processes. Consider following scenario: --- snip process list --- pid threads parent executable (all id:s are in hex) 0000001b 1 00000008 'PnkBstrA.exe' 0000000c 2 00000008 'explorer.exe' 0000000a 2 00000008 '~e5.0001' 00000008 4 00000000 'BF2.exe' --- snip process list --- --- snip thread list --- process tid prio (all id:s are in hex) 0000001b 0000001c 0 0000000c 00000010 0 0000000d 0 0000000a 00000012 0 0000000b 0 00000008 0000001a 1 00000014 15 00000013 0 00000009 0 --- snip thread list --- "BF2.exe" = parent (game) "~e5.0001" = 1st child = SafeDisc 4.x process = "debugger" "PnkBstrA.exe" = 2nd child = PunkBuster Update Service The 1st child acts as debugger for the parent "BF2.exe" and receives all debug events (process, thread creation, dll load/unload...) There are lots of breakpoint events triggered from parent. This is part of SafeDisc 4.x and used for on-the-fly decryption of code sections (child decrypts code of father). When PunkBuster is initialized (loading of pbcl = client, pbag = agent), the following services should get started: PnkBstrA.exe, PnkBstrB.exe and finally the kmode driver PnkBstrK.exe The service process "PnkBstrA.exe" is started from main process "BF2.exe" (which is a debuggee itself). No debug flags (DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS) are specified in process creation flags. The debugger (child of parent, receives the process creation event) does not make debugger_attach() to the newly created child process. The child process seems to inherit the state of being a "debuggee": wine server -> new_process -> set_process_debugger( process, parent->debugger ); The parent got its process->debugger from debugger_attach(). This leads to a problem in child process startup code: "dlls/kernel32/process.c:start_process()" checks the PEB->BeingDebugged field and if set, a system breakpoint is encountered before the entry code is called. This breakpoint results in debug event - seen by debugger. Unfortunately this event is _not_ expected by debugger because it didn't expect another debuggee (child) to be created. Ok, long story short solution: If you debug a process by attaching to an already created process, you _must_ treat default debugging flags as if the process has been created with DEBUG_ONLY_THIS_PROCESS, meaning that all childs created by debuggee will NOT automagically become debuggees. Short and (hopefully) acceptable patch snippet: --- snip --- diff --git a/server/debugger.c b/server/debugger.c index a64a17a..c59f3a0 100644 --- a/server/debugger.c +++ b/server/debugger.c @@ -444,6 +444,7 @@ static int debugger_attach( struct process *process, struct thread *debugger ) resume_process( process ); return 0; } + process->create_flags |= DEBUG_ONLY_THIS_PROCESS; return 1; error: --- snip --- And yes, the patch (snippet) works as intended (tm) ;-) Attached for sake of completeness is relevant server trace. Search for "001c:trace:seh:raise_exception code=80000003 flags=0 addr=0x7b870ed8 " to the point where the entry system breakpoint is triggered. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 17

[Bug 36012] New: OllyDbg 2.x debugger crashes with Wine builtin dbghelp
by wine-bugs＠winehq.org Feb. 11, 2021

Feb. 11, 2021

https://bugs.winehq.org/show_bug.cgi?id=36012 Bug ID: 36012 Summary: OllyDbg 2.x debugger crashes with Wine builtin dbghelp Product: Wine Version: 1.7.16 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: dbghelp Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Hello folks, noticed this a while ago ... reporting now :) Ollydbg v2.x crashes for me with Wine builtin dbghelp. Interestingly the old Ollydbg v1.x doesn't crash with builtin. So I ended up with: Ollydbg 1.x debugging Ollydbg 2.x debugging Wine builtin 'notepad' :) Relevant part of tracelog (with some helper traces added by me): --- snip --- $ WINEDEBUG=+tid,+seh,+dbghelp,+dbghelp_symt wine ./ollydbg.exe >>log2.txt 2>&1 ... 0023:trace:dbghelp_symt:symt_new_function Adding global function L"kernel32<elf>":WCEL_InsertChar @7b83839a-7b8383c8 0023:trace:dbghelp_symt:symt_add_func_local Adding local symbol (L"kernel32<elf>":WCEL_InsertChar): ctx 0x20acd44 0023:trace:dbghelp_symt:symt_add_func_local Adding local symbol (L"kernel32<elf>":WCEL_InsertChar): c 0x20aaba0 0023:trace:dbghelp_symt:symt_add_func_local Adding local symbol (L"kernel32<elf>":WCEL_InsertChar): buffer 0x20ad7f0 ... 0023:trace:dbghelp_symt:symt_add_func_line (0x20ae608)WCEL_InsertChar:0 /home/focht/projects/wine/wine.repo/src/dlls/kernel32/editline.c:328 0023:trace:dbghelp_symt:symt_add_func_line (0x20ae608)WCEL_InsertChar:d /home/focht/projects/wine/wine.repo/src/dlls/kernel32/editline.c:331 0023:trace:dbghelp_symt:symt_add_func_line (0x20ae608)WCEL_InsertChar:15 /home/focht/projects/wine/wine.repo/src/dlls/kernel32/editline.c:332 0023:trace:dbghelp_symt:symt_add_func_line (0x20ae608)WCEL_InsertChar:1b /home/focht/projects/wine/wine.repo/src/dlls/kernel32/editline.c:333 0023:trace:dbghelp_symt:symt_add_func_line (0x20ae608)WCEL_InsertChar:2d /home/focht/projects/wine/wine.repo/src/dlls/kernel32/editline.c:334 ... 0023:trace:dbghelp_symt:symt_new_public Adding public symbol L"kernel32<elf>":WCEL_InsertChar @7b83839a ... 0023:trace:dbghelp:SymMatchStringW L"WCEL_InsertChar" L"*" N 0023:trace:dbghelp_symt:symt_fill_sym_info 0x20ae608 => WCEL_InsertChar 47 7b83839a 0023:trace:dbghelp:send_symbol se->cb=0x7d7f4fd1 se->sym_info=0x335fd8, se->sym_info->Size=47 se->user=0x33683c 0023:trace:dbghelp:sym_enumW sew->cb=0x4c90bc sew->sym_info=0x336848 size=47 sew->ctx=0x337098 0023:trace:dbghelp:SymSetContext Setting same frame {rtn=0 frm=0 stk=0} 0023:trace:dbghelp:symt_enum_locals_helper pair=0x3312fc match=0x7d800bd2 se=0x331398 func=0x20ae608 v=0x20ae63c vlen=4 0023:trace:dbghelp:symt_enum_locals_helper i=0 lsym=0x20ae66c, lsym->tag=0x7 0023:trace:dbghelp:SymMatchStringW L"ctx" L"*" Y 0023:trace:dbghelp_symt:symt_fill_sym_info 0x20ae66c => ctx 4 4 0023:trace:dbghelp:send_symbol se->cb=0x7d7f4fd1 se->sym_info=0x3313b8, se->sym_info->Size=4 se->user=0x331c1c 0023:trace:dbghelp:sym_enumW sew->cb=0x4c8f54 sew->sym_info=0x331c28 size=4 sew->ctx=0x33250c 0023:trace:dbghelp:symt_enum_locals_helper i=1 lsym=0x20ae6e4, lsym->tag=0x7 0023:trace:dbghelp:SymMatchStringW L"c" L"*" Y 0023:trace:dbghelp_symt:symt_fill_sym_info 0x20ae6e4 => c 2 ffffffe0 0023:trace:dbghelp:send_symbol se->cb=0x7d7f4fd1 se->sym_info=0x3313b8, se->sym_info->Size=2 se->user=0x331c1c 0023:trace:dbghelp:sym_enumW sew->cb=0x4c8f54 sew->sym_info=0x331c28 size=2 sew->ctx=0x33250c 0023:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7d7f1208 ip=7d7f1208 tid=0023 0023:trace:seh:raise_exception info[0]=00000000 0023:trace:seh:raise_exception info[1]=00000064 0023:trace:seh:raise_exception eax=00000058 ebx=7d80d000 ecx=003311f0 edx=fffffd6f esi=00000040 edi=0033689c 0023:trace:seh:raise_exception ebp=00331248 esp=00331248 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010202 0023:trace:seh:call_stack_handlers calling handler at 0x4e87c0 code=c0000005 flags=0 --- snip --- 'WCEL_InsertChar' seems to be the offender. Populating the symbol info for that function causes the crash in the debugger callback. http://source.winehq.org/git/wine.git/blob/fc38254fed5dbc07a2a61a2411bfaadc… --- snip --- 327 static void WCEL_InsertChar(WCEL_Context* ctx, WCHAR c) 328 { 329 WCHAR buffer[2]; 330 331 buffer[0] = c; 332 buffer[1] = 0; 333 WCEL_InsertString(ctx, buffer); 334 } --- snip --- During symbol evaluation of second function parameter 'c', the debugger syminfo callback corrupts parts of the caller stack hence the next for-loop iteration 'vector_length(v)' which ought to prepare 'buffer' local symbol info crashes. Source: http://source.winehq.org/git/wine.git/blob/d0665616255ae8b720e14e02072996b7… --- snip --- 909 static BOOL symt_enum_locals_helper(struct module_pair* pair, 910 const WCHAR* match, const struct sym_enum* se, 911 struct symt_function* func, const struct vector* v) 912 { 913 struct symt* lsym = NULL; 914 DWORD pc = pair->pcs->ctx_frame.InstructionOffset; 915 unsigned int i; 916 WCHAR* nameW; 917 BOOL ret; 918 919 for (i=0; i<vector_length(v); i++) 920 { 921 lsym = *(struct symt**)vector_at(v, i); 922 switch (lsym->tag) 923 { ... 933 case SymTagData: 934 nameW = symt_get_nameW(lsym); 935 ret = SymMatchStringW(nameW, match, 936 !(dbghelp_options & SYMOPT_CASE_INSENSITIVE)); 937 HeapFree(GetProcessHeap(), 0, nameW); 938 if (ret) 939 { 940 if (send_symbol(se, pair, func, lsym)) return FALSE; 941 } 942 break; ... 951 } 952 } 953 return TRUE; 954 } --- snip --- Dump of symbol info for second parameter 'c': --- snip --- Wine-dbg>p *se.sym_info {SizeOfStruct=0x58, TypeIndex=0x20a2b90, Reserved={0, 0}, info=0x20a66d4, Size=0x2, ModBase=0x7b810000, Flags=0xd0, Value=0, Address=0xffffffe0, Register=0x15, Scope=0, Tag=0x7, NameLen=0x1, MaxNameLen=0x7d0, Name=""} --- snip --- Flags: 0xD0 = SYMFLAG_LOCAL | SYMFLAG_PARAMETER | SYMFLAG_REGREL Register: 0x15 = CV_REG_ESP Disassembly of 'WCEL_InsertChar': --- snip --- $ objdump -d editline.o 00000cba <WCEL_InsertChar>: cba: 55 push %ebp cbb: 89 e5 mov %esp,%ebp cbd: 83 ec 28 sub $0x28,%esp cc0: 8b 45 0c mov 0xc(%ebp),%eax ; parameter 'c' cc3: 66 89 45 e4 mov %ax,-0x1c(%ebp) ; 'c' as stack variable cc7: 0f b7 45 e4 movzwl -0x1c(%ebp),%eax ccb: 66 89 45 f4 mov %ax,-0xc(%ebp) ; buffer[0] = c ccf: 66 c7 45 f6 00 00 movw $0x0,-0xa(%ebp) ; buffer[1] = 0 cd5: 8d 45 f4 lea -0xc(%ebp),%eax cd8: 89 44 24 04 mov %eax,0x4(%esp) cdc: 8b 45 08 mov 0x8(%ebp),%eax ; 'ctx' parameter passthru cdf: 89 04 24 mov %eax,(%esp) ce2: e8 30 fe ff ff call b17 <WCEL_InsertString> ce7: c9 leave ce8: c3 ret --- snip --- DWARF(2) symbol info: --- snip --- $ objdump -W editline.o <1><cf7>: Abbrev Number: 43 (DW_TAG_subprogram) <cf8> DW_AT_name : (indirect string, offset: 0x25b): WCEL_InsertChar <cfc> DW_AT_decl_file : 3 <cfd> DW_AT_decl_line : 327 <cff> DW_AT_prototyped : 1 <d00> DW_AT_low_pc : 0xcba <d04> DW_AT_high_pc : 0xce9 <d08> DW_AT_frame_base : 0x3b8 (location list) <d0c> DW_AT_sibling : <0xd3c> <2><d10>: Abbrev Number: 27 (DW_TAG_formal_parameter) <d11> DW_AT_name : ctx <d15> DW_AT_decl_file : 3 <d16> DW_AT_decl_line : 327 <d18> DW_AT_type : <0x847> <d1c> DW_AT_location : 2 byte block: 91 0 (DW_OP_fbreg: 0) <2><d1f>: Abbrev Number: 27 (DW_TAG_formal_parameter) <d20> DW_AT_name : c <d22> DW_AT_decl_file : 3 <d23> DW_AT_decl_line : 327 <d25> DW_AT_type : <0xf7> <d29> DW_AT_location : 2 byte block: 91 5c (DW_OP_fbreg: -36) <2><d2c>: Abbrev Number: 44 (DW_TAG_variable) <d2d> DW_AT_name : (indirect string, offset: 0x67a): buffer <d31> DW_AT_decl_file : 3 <d32> DW_AT_decl_line : 329 <d34> DW_AT_type : <0xa2a> <d38> DW_AT_location : 2 byte block: 91 6c (DW_OP_fbreg: -20) --- snip --- DW_AT_frame_base = 0x3b8 -> Location list for 0x3b8 --- snip --- $ objdump --dwarf=loc editline.o editline.o: file format elf32-i386 Contents of the .debug_loc section: ... 000003b8 00000cba 00000cbb (DW_OP_breg4 (esp): 4) 000003c4 00000cbb 00000cbd (DW_OP_breg4 (esp): 8) 000003d0 00000cbd 00000ce8 (DW_OP_breg5 (ebp): 8) 000003dc 00000ce8 00000ce9 (DW_OP_breg4 (esp): 4) 000003e8 <End of list> ... --- snip --- What might be the culprit here (see disassembly) is that 'c' is actually both: a function parameter ('DW_TAG_formal_parameter' -> 'cc0:') and a local variable ('cc3:'). The DWARF symbol info contains only one entry. Maybe that's something that confuses the debugger (function parameter handler combined with negative addressing mode which ought to apply for local variable). $ sha1sum odbg201.zip d41fe77a2801d38476f20468ab61ddce14c3abb8 odbg201.zip $ du -sh odbg201.zip 6.7M odbg201.zip $ wine --version wine-1.7.16-178-g7e874ae Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 9