http://bugs.winehq.org/show_bug.cgi?id=53795 --- Comment #5 from daoxiang <15959866515@163.com> --- Still reproducible on Wine 11.17, and the mechanism can now be measured from inside the failing process rather than inferred from a backtrace. Second application, independent of Naver LINE: **NetEase UU Remote 4.40.1** (`GameViewer.exe`, a Qt 5.15.12 shell). Under Wine 11.17 on Arch Linux, clicking "enter desktop" terminates it within 1-3 s, every time. The fault is the same one described here: ``` EXCEPTION 0xc0000005 at Qt5Core.dll+0xbf11b 0xbf0f0 = ?fromUtf16@QString@@SA?AV1@PEBGH@Z -> +0x2b is `cmp WORD PTR [rdx],cx` rdx = an unmapped pointer, different on every run ``` Hooking `GetOutlineTextMetricsW` inside the process shows what the two calls Qt makes actually return. Qt calls it twice -- once to size the buffer, once to fill it (`qwindows.dll+0x7041f` and `+0x7043a`): ``` [GetOutlineTextMetricsW] QUERY caller=qwindows+0x7041f cbData=0 otm=NULL -> ret=0 FAILED, face=[Noto Color Emoji] [GetOutlineTextMetricsW] FILL caller=qwindows+0x7043a cbData=0 otm=00007F0EDD83FCA0 -> ret=0 FAILED, face=[Noto Color Emoji] ``` So the query returns 0, Qt does not test it and calls `malloc(0)`, the fill writes nothing, and Qt then reads `otm->otmpFullName` out of that zero-size block and hands `otm + otmpFullName` to `QString::fromWCharArray(..., -1)`. The buffer pointer in the `FILL` line above is byte-for-byte the `rdi` observed at the crashing call, which is what pins the sequence. The font is the one already named in this report: **Noto Color Emoji**. It is a bitmap-only SFNT face, FreeType reports it as not scalable, and Wine consequently returns 0. Removing the font makes the crash disappear here as well. **There is a fix under review:** <https://gitlab.winehq.org/wine/wine/-/merge_requests/11388> ("win32u: Return outline metrics for bitmap-only SFNT fonts") reads `unitsPerEm` from the `head` table and builds `OUTLINETEXTMETRIC` for these faces. It is still a draft with no review, and it is not linked from this report, which is why the connection is worth making explicitly. Attached: a standalone probe that reproduces the protocol without any application (`uuyc-otmprobe.c`, build with `x86_64-w64-mingw32-gcc -O2 -o uuyc-otmprobe.exe uuyc-otmprobe.c -lgdi32`) and its full output. The probe runs Qt's exact two-call protocol over every font in a prefix and validates that the four name offsets land inside the buffer that was allocated; it can assert the post-fix behaviour for bitmap-only faces without a GUI. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.