http://bugs.winehq.org/show_bug.cgi?id=60115 --- Comment #2 from Seth2313@gmail.com <Seth2313@gmail.com> --- hanks for confirming, and especially for the steps - "LFO assigned to an EQ parameter in Serum 2, then play a note" is the most reliable trigger anyone has reported for this bug. Your log matches mine exactly: hundreds of "Triangle not found" lines followed by the stack overflow at stack 0x108c0 (0x10000-0x11000-0x110000). The animation matters because every redraw builds new path geometry, so every frame is another chance to hit a degenerate one. UPDATE SINCE THE ORIGINAL REPORT 1. Still present upstream. dlls/d2d1/geometry.c is byte-identical in 11.15, 11.19 and 11.20, so your build and current Wine are affected alike. 2. The workaround in the description is not enough, and it has a bug of its own. Fuzzing the triangulation with random degenerate paths found four more places that don't terminate or crash: - d2d_cdt_insert_segment: the skip paths of my first workaround returned TRUE without setting *edge, so the caller carried on with a stale or freed edge (page fault). Fixed by returning a valid edge at the target vertex, or failing cleanly. Please don't use the snippet from the description any more. - d2d_cdt_cut_edges: unbounded non-tail recursion on cyclic topology (stack overflow). Now iterative - collect the crossed edges, delete them in reverse order (same order as the recursion), bounded by edge_count. - d2d_cdt_fixup: the face walk never gets back to its origin (infinite loop). Now bounded, returns FALSE like the existin path. - d2d_geometry_resolve_beziers: overlapping control forever and memory grows without bound. Now a budg 16 * bezier_count + 1024 splits per geometry; any gives a slightly imprecise fill instead of a hang. Every bail-out ends in an existing error path (one segment skipped, or that single geometry's fill fails with E_FAIL) - nev 3. Results: stock 11.19 overflows the stack or hangs in 10,000 fuzz seeds; with the patch, 240,000 seeds run conformance tests (17,475 checks) give identical res without the patch. REPRODUCER WITHOUT FL STUDIO The original report had no minimal test case. There is one now: tools/d2d1_fuzz.cpp in https://github.com/Sethtekk/fl-studio-wine-linux It is a ~30-line MinGW program that builds random fille (many duplicate and collinear points, 1-4 figures, line fill modes) and closes them. It prints "seed N" before last line before a crash or hang identifies the input. x86_64-w64-mingw32-g++ -O2 d2d1_fuzz.cpp -ld2d1 -stat wine d2d1_fuzz.exe 1 10000 THE FIX Patch against vanilla 11.19 (applies unchanged to 11.15 https://github.com/Sethtekk/fl-studio-wine-linux/bloby-fix.patch Technical notes per defect, measurements and test-suite https://github.com/Sethtekk/fl-studio-wine-linux/bloby-fix.md The patch also contains an optional, separate hunk that d2d_geometry_intersect_self() for D2D1_FIGURE_BEGIN_HOL strokePath() creates one on every call and only draws i micro-benchmark that cuts Close() from 3.32 ms to <0.01 but inside FL Studio I could not measure a difference, so it is not part of the bug fix. I'm happy to split this into separate patches and turn seeds into conformance tests for dlls/d2d1/tests if tha upstream. USING THE FIX TODAY (ANY WINE PREFIX) Until this is fixed upstream, the patched DLL can be dr existing 64-bit prefix. d2d1 is a pure PE DLL, so it do exact Wine build: the DLL built from 11.19 runs here on and the earlier one built from 11.9 ran unchanged up to version of the fix has been in daily use with FL Studio May, the current one since mid-October. Easiest way, with the script from the repository (backs DLL, installs the patched one and sets the override): git clone https://github.com/Sethtekk/fl-studio-wine- cd fl-studio-wine-linux WINEPREFIX=/path/to/your/prefix bash scripts/04-apply Or by hand - prebuilt x86_64 DLL from 11.19 with the pa fd197f30b36451714e5fc5a7afc148c9: https://github.com/Sethtekk/fl-studio-wine-linux/raw/ed cp $WINEPREFIX/drive_c/windows/system32/d2d1.dll d2d1 cp d2d1.dll.patched $WINEPREFIX/drive_c/windows/syste WINEPREFIX=... wine reg add 'HKCU\Software\Wine\DllOvuiltin /f The "Wine builtin DLL" marker at offset 0x40 is already If you build the DLL yourself, zero it, otherwise Wine copy: dd if=/dev/zero of=d2d1.dll bs=1 seek=64 count=16 conv=notrunc To confirm the guard is working, run once with WINEDEBU "Iteration limit exceeded, skipping segment" lines inst it caught the degenerate geometry. @synatedic - in Bottles it is the same: copy the DLL into the bottle's drive_c/windows/system32 and add d2d1 = native,builtin DLL overrides. It should work with your kron4ek 11.15 r haven't tested that exact runner, so I'd be glad to hea test survives with it. Two related notes: - Wine's d2d logs "fixme:d2d:d2d_device_context_DrawGeo style" for every line Serum 2 draws (I measured ~11,000 lines/s with the plugin window open). Not a crash, but the logging cos WINEDEBUG=fixme-all is worth setting. - I haven't tested Serum 2 with DXVK disabled, so I can part. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.