[Bug 58211] New: Bonsai-Rx Application Crashes Due to TREEVIEW_DoSelectItem Assertion
http://bugs.winehq.org/show_bug.cgi?id=58211 Bug ID: 58211 Summary: Bonsai-Rx Application Crashes Due to TREEVIEW_DoSelectItem Assertion Product: Wine Version: 10.7 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: comctl32 Assignee: wine-bugs(a)winehq.org Reporter: ncguilbeault(a)gmail.com Distribution: --- Created attachment 78524 --> http://bugs.winehq.org/attachment.cgi?id=78524 Crash log when launching Bonsai main editor or package manager Hi there, and thank you for all the amazing work on Wine! I'm a relatively new user and have encountered an issue when running a Windows application called Bonsai-Rx under Wine. Bonsai-Rx is a C#/.NET-based application widely used in neuroscience research. Traditionally, Bonsai running on Linux has relied on Mono, but I’m exploring the possibility of running Bonsai using Wine instead. System Details: Wine version: Built from source (latest master, 10.7) using Shared-WoW64 instructions Bonsai version: Installed from official site (latest, 2.8.5): https://bonsai-rx.org/docs/articles/installation.html Wine prefix setup: .NET Framework 4.8 installed via winetricks -q dotnet48 System: Ubuntu 24.04, x86_64, kernel 6.8.0-59-generic The Issue: Bonsai installs and launches correctly. The welcome menu displays, but selecting any option that would launch the main editor window or the package manager (e.g., New File, Open File, Manage Packages, etc.) causes the application to crash due to an assertion in the function: `TREEVIEW_DoSelectItem(TREEVIEW_INFO *infoPtr, INT action, HTREEITEM newSelect, INT cause)` Observations: If I comment out the assertion line in the above function and rebuild Wine, Bonsai functionality works as expected. I’ve tested several native DLL overrides (comctl32, comdlg32, vcrun6) without success. The issue persists in multiple Wine versions (10.3 through 10.7). Questions: What are the implications of removing this assertion in TREEVIEW_DoSelectItem? Could this point to a misbehaviour in Bonsai, or is it a Wine edge case that should be handled more gracefully? Is there a better workaround or fix for ensuring compatibility with this application? I’ve attached the full error stack trace for reference. Any guidance or insights would be greatly appreciated. Thanks again for your time and your excellent work! -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 --- Comment #1 from ncguilbeault(a)gmail.com --- The assertion line I am referring to is this one: https://gitlab.winehq.org/wine/wine/-/blob/master/dlls/comctl32/treeview.c?r... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 Austin English <austinenglish(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://bonsai-rx.org/docs/ | |articles/installation.html Keywords| |download -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 Michael <micetym@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |micetym@gmail.com -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 --- Comment #2 from Michael <micetym@gmail.com> --- Created attachment 81958 --> http://bugs.winehq.org/attachment.cgi?id=81958 Notepad++ 8.9.3 + NppFTP crash log (wine-staging 11.16), ends with the treeview.c assertion -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 --- Comment #3 from Michael <micetym@gmail.com> --- Created attachment 81959 --> http://bugs.winehq.org/attachment.cgi?id=81959 Notepad++ 8.9.3 + NppFTP crash log (wine-staging 11.16), ends with the treeview.c assertion -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 --- Comment #4 from Michael <micetym@gmail.com> --- Clicking anywhere in a TreeView whose owner rebuilds the tree from its NM_CLICK handler aborts the process: Assertion failed: newSelect == NULL || TREEVIEW_ValidItem(infoPtr, newSelect), file dlls/comctl32/treeview.c, line 4621 TREEVIEW_LButtonDown() computes ht.hItem via the hit test, then sends NM_CLICK to the application. The application may modify the tree from that handler, freeing the item ht.hItem refers to. ht.hItem is then passed unchecked to TREEVIEW_DoSelectItem(), whose entry assert aborts. TREEVIEW_SelectItem() (the TVM_SELECTITEM handler) already guards the same call with TREEVIEW_ValidItem() and returns FALSE for a stale handle; the mouse path does not. The code is unchanged in current master. Reproduced with Notepad++ 8.9.3 and the NppFTP plugin: the plugin populates its profile tree lazily, and the first click in the panel - on an entry or on empty space alike - kills Notepad++. Scrolling the list to the end and back first fully populates the tree, after which clicking is harmless; that timing dependency matches the analysis above. Attaching a trimmed log and a suggested four-line patch. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 --- Comment #5 from Michael <micetym@gmail.com> --- Created attachment 81963 --> http://bugs.winehq.org/attachment.cgi?id=81963 long list for NppFTP -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 --- Comment #6 from Michael <micetym@gmail.com> --- Confirmed on plain (non-staging) Wine, on a different machine. Wine: wine-11.0 (vanilla, not staging) Distro: Ubuntu 26.04.1 LTS So this is neither a wine-staging artefact nor specific to the machine I reported from: my earlier reports were wine-staging 11.16, this one is a stock 11.0 release. The affected code is identical across the versions involved: wine-11.0 unguarded call at treeview.c:4406, assert at treeview.c:4555 master unguarded call at treeview.c:4472, assert at treeview.c:4621 else if (do_select) { TREEVIEW_ITEM *selection = infoPtr->selectedItem; /* Select the current item */ TREEVIEW_DoSelectItem(infoPtr, TVGN_CARET, ht.hItem, TVC_BYMOUSE); ht.hItem is whatever the hit test returned before NM_CLICK was dispatched to the application; nothing revalidates it afterwards. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 Ken Sharp <imwellcushtymelike@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |win64 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 --- Comment #7 from Michael <micetym@gmail.com> --- A refinement of the reproduction condition, and a hint at where the bad item comes from. WHAT ACTUALLY MATTERS IS THAT THE LIST OVERFLOWS THE WINDOW Not the number of items as such. A tree short enough to fit in the visible area is fully functional immediately and never crashes. A tree longer than the window is mis-drawn until it is scrolled for the first time: items are painted incompletely and hover highlighting does not work at all. After one scroll the tree becomes fully functional, and clicking is then harmless. So the crash window is "long list, not yet scrolled", which is why a handful of entries never reproduces it and a few hundred does. WHERE THIS SEEMS TO COME FROM TREEVIEW_HitTestPoint() resolves a point purely through the visibility bookkeeping: row = pt.y / infoPtr->uItemHeight + infoPtr->firstVisible->visibleOrder; for (item = infoPtr->firstVisible; item != NULL; item = TREEVIEW_GetNextListItem(infoPtr, item)) { if (row >= item->visibleOrder && row < item->visibleOrder + item->iIntegral) break; } Newly inserted items start with visibleOrder = -1 and only get a real value from TREEVIEW_RecalculateVisibleOrder(), which is among other places called from the scroll handling path. That matches the observed behaviour exactly: before the first scroll the ordering is incomplete, which is both why the control paints and hovers incorrectly and why the hit test can hand back an item that TREEVIEW_ValidItem() subsequently rejects. I have not proven which of the two is the primary path - the NM_CLICK re-entrancy described earlier, or stale visibility bookkeeping - and they may well combine. But the guard proposed earlier is valid in either case, since it simply refuses to pass an item that TREEVIEW_ValidItem() does not accept, exactly as TREEVIEW_SelectItem() already does. Reproducing: use a tree with more entries than fit on screen, and click before scrolling. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 --- Comment #8 from Michael <micetym@gmail.com> --- Two small triage notes. The win64 keyword looks wrong: this is not architecture specific. I reproduce it both ways. 32-bit prefix (WINEARCH=win32, "#arch=win32" in the prefix registry), 32-bit Notepad++, wine-staging 11.16, Ubuntu 24.04 64-bit only a clean machine with no 32-bit Wine installed at all, plain wine-11.0, Ubuntu 26.04.1 Same assertion in both cases. Also, the Version field still reads 10.7 from the original report. It reproduces on 11.0 and 11.16 as well, if that is worth updating. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=58211 ncguilbeault@gmail.com changed: What |Removed |Added ---------------------------------------------------------------------------- Version|10.7 |11.16 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
WineHQ Bugzilla -
WineHQ Bugzilla