[Bug 59963] New: DWARF unwinding crashes on i386
http://bugs.winehq.org/show_bug.cgi?id=59963 Bug ID: 59963 Summary: DWARF unwinding crashes on i386 Product: Wine Version: 10.17 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: kernel32 Assignee: wine-bugs@list.winehq.org Reporter: me@purplesyringa.moe Target Milestone: --- Distribution: --- Created attachment 81351 --> http://bugs.winehq.org/attachment.cgi?id=81351 Binary reproducer My exception-heavy code written in Rust using the GNU toolchain has started crashing somewhere between 10.0 packaged by Debian and the current wine-devel packaged by winehq for Debian. The debug logs go through multiple fixmes, eventually reaching "Unhandled page fault on read access", seemingly while parsing DWARF, and then winedbg handles this crash and has an internal crash at the same address. This only reproduces on i386. The binary works fine on Windows. I've attached the binary that reproduces this issue, built by CI (https://github.com/iex-rs/lithium/actions/runs/28744479549/job/85233130634). Alternatively, you can build the binary from source by running `LITHIUM_BACKEND=panic cargo build --tests --target i686-pc-windows-gnu` in the corresponding repo. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 --- Comment #1 from Alisa Sireneva <me@purplesyringa.moe> --- Created attachment 81352 --> http://bugs.winehq.org/attachment.cgi?id=81352 Error log -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 --- Comment #2 from Alisa Sireneva <me@purplesyringa.moe> --- Correction: I was mistaken, this reproduces on 10.0 packaged by Debian as well. I can't say what change exactly caused this to start failing then, probably an LLVM update. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 Austin English <austinenglish@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, source -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 --- Comment #3 from Ken Sharp <imwellcushtymelike@gmail.com> --- Does this occur on upstream Wine compiled from source, or just the packaged versions? If you can recreate this in the latest git then a regression test would help. https://gitlab.winehq.org/wine/wine/-/wikis/Regression-Testing -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 --- Comment #4 from Alisa Sireneva <me@purplesyringa.moe> --- I'm not sure how a regression test can help here, since this reproduces on the earliest version I tried (10.0 packaged by Debian). I doubt this is a regression in Wine, it's probably been broken forever. What did regress this is a rustc update. I bisected it to https://github.com/rust-lang/rust/pull/156405, which is a pretty nonsensical result, chances are some of the changes affected which functions got inlined, triggering an edge case in Wine. I can try bisecting further, but since this rollup PR doesn't include anything directly related to DWARF generation, I doubt that'd be useful. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 Eric Pouech <eric.pouech@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |eric.pouech@gmail.com --- Comment #5 from Eric Pouech <eric.pouech@gmail.com> --- Created attachment 81364 --> http://bugs.winehq.org/attachment.cgi?id=81364 tentative patch tentative patch -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 --- Comment #6 from Eric Pouech <eric.pouech@gmail.com> --- not sure I covered all the aspects: - running './wine winedbg repro(.exe)' crashes inside winedbg (actually in dwarf's reader in dbghelp DLL) - with the patch applied on tip, './wine winedbg repro(.exe)' no longer crash - with and without the patch applied, './wine repro(.exe)' doesn't crash can you confirm the outcome? TIA -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 --- Comment #7 from Alisa Sireneva <me@purplesyringa.moe> --- On my PC, `wine repro` crashes on tip (cba7652eac8f) and works fine with the patch applied. `winedbg repro` crashes neither on tip nor with the patch (but if winedbg is started automatically after `wine repro` crashes, it does also crash on tip). -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 Eric Pouech <eric.pouech@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Ever confirmed|0 |1 Status|UNCONFIRMED |ASSIGNED --- Comment #8 from Eric Pouech <eric.pouech@gmail.com> --- (In reply to Alisa Sireneva from comment #7)
On my PC, `wine repro` crashes on tip (cba7652eac8f) and works fine with the patch applied. `winedbg repro` crashes neither on tip nor with the patch (but if winedbg is started automatically after `wine repro` crashes, it does also crash on tip).
Thanks for testing. Basically, what happens is: - repro at some point catches some exception (triggered by the tests), then uses dbghelp.StackWalk to capture callstack, - dbghelp dwarf reader's thrashes memory when reading the repro dwarf's debug info, - which causes another exception, - since uncaught (or exception in exception), Wine's kernel32 launches winedbg (default registry settings) - winedbg loads dbghelp, and calls also dbghelp.StackWalk which triggers the same memory thrashing when reading repro's dwarf debug info (but in winedbg process this time) - winedbg catches this exception and quits What's "strange" is that in my yesterday testing (yet on Wine-11.0), the memory thrashing in the repro process doesn't generate a fault, while the one ine winedbg process seemt to happen always Just retested on wine's tip, and the crash happens in repro process (without the patch) Didn't chase further the root of discrenpancy, but could be different memory layout, or... Will upload the patch. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 --- Comment #9 from Alisa Sireneva <me@purplesyringa.moe> --- Last time I tried to reproduce this bug, I failed to do so on a recent Wine version, so I had assumed the bug was fixed. But then something must've updated and it reproduced again. In my original tests, the crash occurred somewhere around realloc, more specifically heap allocation headers seemed to be corrupted. That seems consistent with the patch fixing OOB access (if I understand it correctly) and the exception only arising with some memory layouts. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 --- Comment #10 from Eric Pouech <eric.pouech@gmail.com> --- MR https://gitlab.winehq.org/wine/wine/-/merge_requests/11348 has been raised -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 Bernhard Übelacker <bernhardu@mailbox.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bernhardu@mailbox.org --- Comment #11 from Bernhard Übelacker <bernhardu@mailbox.org> --- The merge request got committed as: https://gitlab.winehq.org/wine/wine/-/commit/b333745f61a6b54f304b15a5f3bf5e6... Is included in wine-11.13 and later. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=59963 Alisa Sireneva <me@purplesyringa.moe> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|ASSIGNED |RESOLVED --- Comment #12 from Alisa Sireneva <me@purplesyringa.moe> --- Can confirm it's been fixed -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla