February 2003 - Wine-Devel - list.winehq.org

Debugging crashes in 16 bit code?

by Dan Kegel

How does one tell what DLL contains a particular segment of 16 bit code in winedbg? For instance, there's a nice juicy exception that happens towards the end of the Resource Hunter installer, available as a free trial download at http://www.boilsoft.com/rchunter.html In wine = win2k mode, it happens early enough to break the install, but in wine's win98 mode, the install doesn't crash until quite late, and you can actually use the product. Here's a log of an installer run that crashed (with "Windows" = "win2k"): $ ~/wine/wine setup.exe fixme:seh:check_resource_write Broken app is writing to the resource data, enabling work-around fixme:ntdll:NtOpenThreadToken (0xfffffffe,0x00000008,0x00000000,0x40791ba4): stub fixme:ntdll:NtQueryInformationToken (0xcafe,2,(nil),0,0x40791b90): stub fixme:ntdll:NtQueryInformationToken (0xcafe,2,0x40791b7c,12,0x40791b90): stub fixme:ntdll:NtOpenThreadToken (0xfffffffe,0x00000008,0x00000000,0x4079154c): stub fixme:ntdll:NtQueryInformationToken (0xcafe,2,(nil),0,0x40791538): stub fixme:ntdll:NtQueryInformationToken (0xcafe,2,0x40791524,12,0x40791538): stub fixme:ntdll:NtOpenThreadToken (0xfffffffe,0x00000008,0x00000000,0x4079135c): stub fixme:ntdll:NtQueryInformationToken (0xcafe,2,(nil),0,0x40791348): stub fixme:ntdll:NtQueryInformationToken (0xcafe,2,0x40791334,12,0x40791348): stub fixme:dialog:MSGBOX_OnInit task modal msgbox ! Not modal yet. wine: Unhandled exception, starting debugger... No debug information in 32bit DLL 'C:\WINDOWS\SYSTEM\CTL3D32.DLL' (0x41170000) ... Unhandled exception: privileged instruction in 16-bit code (0487:09b7). In 16-bit mode. 0x0487:0x09b7: ldsw 0x014a,%dx Wine-dbg> At that point, I know how to gather a few kinds of info helpful to people trying to track down the cause of the crash, namely 'bt', 'info regs' and 'disas' (giving the latter an address 0x20 or so lower than the crash address, to give a little context): Wine-dbg> info regs Register dump: CS:0487 SS:048f DS:048f ES:049f FS:0000 GS:0007 IP:09b7 SP:1768 BP:176e FLAGS:0246( - 00 I Z- -P1 ) AX:0000 BX:000b CX:0000 DX:0000 SI:01be DI:01be Wine-dbg> disas 0x0487:0x0977 0x0487:0x0977: movw $0x1be,%di 0x0487:0x097a: call 0x09d2 0x0487:0x097d: movw $0x1be,%si 0x0487:0x0980: movw $0x1be,%di 0x0487:0x0983: call 0x09e1 0x0487:0x0986: call 0x09a9 0x0487:0x0989: popw %ax 0x0487:0x098a: orb %ah,%ah 0x0487:0x098c: jnz 0x09a5 0x0487:0x098e: movw 0x4(%bp),%ax 0x0487:0x0991: movb $0x4c,%ah Wine-dbg> disas 0x0487:0x0993: testw $0x1,%cs:0x0794 0x0487:0x099a: jz 0x09a3 0x0487:0x099c: lcall 0x011f:0x0cdf 0x0487:0x09a1: jmp 0x09a5 0x0487:0x09a3: int $0x21 0x0487:0x09a5: popw %di 0x0487:0x09a6: popw %si 0x0487:0x09a7: popw %bp 0x0487:0x09a8: ret 0x0487:0x09a9: movw 0x01b4,%cx Wine-dbg> 0x0487:0x09ad: jcxz 0x09b6 0x0487:0x09af: movw $0x2,%bx 0x0487:0x09b2: lcall *0x1b2 -> 0x0000 0x0487:0x09b6: push %ds 0x0487:0x09b7: ldsw 0x014a,%dx 0x0487:0x09bb: movw $0x2500,%ax 0x0487:0x09be: testw $0x1,%cs:0x0794 0x0487:0x09c5: jz 0x09ce 0x0487:0x09c7: lcall 0x011f:0x0cdf 0x0487:0x09cc: jmp 0x09d0 That's fine and dandy, and maybe it'll help Marcus find the bug, but it leaves me scratching my head, wondering what DLL could be at fault, and how I could connect it to Wine source code or a vendor-supplied DLL. Which FM did I fail to R? I did have a look at http://www.winehq.org/docs/wine-devel/wine-debugger.shtml but it doesn't seem to even think winedbg can disassemble stuff by itself, so I wonder if that's not quite up to date. Thanks, Dan -- Dan Kegel http://www.kegel.com http://counter.li.org/cgi-bin/runscript/display-person.cgi?user=78045

Feb. 2, 2003

Re: small ctl3d fix

by Dmitry Timoshkov

"Rok Mandeljc" <rokmandeljc(a)hotmail.com> wrote: > I've finally found a bug which crashed Ultima IX at startup. > > ChangeLog: > - added debug messages There is no need to add useless FIXMEs and scare people too much. Ctl3d implementation on Windows versions 4 and above is supposed to do nothing. > - changed return of Ctl3dIsAutoSubclass from FALSE to TRUE This one is okay. -- Dmitry.

Feb. 2, 2003

new cvs build...

by Scott Jackson

I don't know *why* this happens to me now, err:win32:_EnterSysLevel (0x4093dfa0, level 2): Holding 0x409dfc64, level 3. Expect deadlock! in both FF8.exe and FF8Config.exe (Final Fantasy VIII) in the new CVS build. I'm kind of *active* on this list eh? :-D -- "De-fault! The two sweetest words in the English language." -- Homer Simpson Get Gaim for unix or win32 systems! gaim.sourceforge.net Scott "Action" Jackson - scott_j(a)ajackson.org

Feb. 2, 2003

question regarding appdb

by Michael Stefaniuc

Hello, I've just added a comment to the ACT!2000 appdb entry and even though i was logged in into the appdb (seen the cookie in mozilla) the entry was created with "anonymous coward" as sender. Is this a bug/feature or only plain pebcak? bye michael -- Michael Stefaniuc Tel.: +49-711-96437-199 System Administration Fax.: +49-711-96437-111 Red Hat GmbH Email: mstefani(a)redhat.com Hauptstaetterstr. 58 http://www.redhat.de/ D-70178 Stuttgart

Feb. 2, 2003

infinite loop in msvcrt dll

by Michael Stefaniuc

Hello, when starting ACT!2000 with wine the program freezes after the main window is brought up and one wine process goes mad and eats all the cpu. Running strace on that pid dosn't show any system call and even the relay output stops. I've attached with gdb to the wine process and got a backtrace with 3569 entries. I've captured the output with screen and attached it. Seems to be a loop in an exception handler (sigsegv's over and over again). I hope that somebody can do more with the output. The last entries in the relay output are tons of: 00000009:Call kernel32.TlsGetValue(00000000) ret=405d833e 00000009:Ret kernel32.TlsGetValue() retval=402a7810 ret=405d833e 00000009:Call msvcrt.__CxxFrameHandler(403821f0,40592c60,4038226c,40382180) ret=400c42b7 fs=008f eax=179c3008 ebx=400f6204 ecx=4010de20 edx=40382d54 esi=403821f0 edi=400f5fe1 ebp=40382150 esp=40382124 ds=002b es=002b gs=0007 flags=00000246 00000009:Ret msvcrt.__CxxFrameHandler() retval=00000001 ret=400c42b7 fs=008f eax=00000001 ebx=400f6204 ecx=4010de20 edx=40382d54 esi=403821f0 edi=400f5fe1 ebp=40382150 esp=40382124 ds=002b es=002b gs=0007 flags=00000246 00000009:Call msvcrt.__CxxFrameHandler(403821f0,40592ce8,4038226c,40382180) ret=400c42b7 fs=008f eax=179c3030 ebx=400f6204 ecx=4010de20 edx=40382d54 esi=403821f0 edi=400f5fe1 ebp=40382150 esp=40382124 ds=002b es=002b gs=0007 flags=00000246 In the "-debugmsg +msvcrt" output i see some: warn:msvcrt:msvcrt_mbc_to_wc MultiByteToWideChar failed on 73 lines, but i suspect this is not the problem. When running with "-dll msvcrt=n" the error dosn't occur. Any tips how to debug this further? bye michael -- Michael Stefaniuc Tel.: +49-711-96437-199 System Administration Fax.: +49-711-96437-111 Red Hat GmbH Email: mstefani(a)redhat.com Hauptstaetterstr. 58 http://www.redhat.de/ D-70178 Stuttgart

Feb. 1, 2003

Re: half-life

by Sylvain Petreolle

Isnt there a problem into the path here ? A \ is missing after C:\\Program > Hmmm. Maybe. I think here though this call is what is wrong: > > > 080787e0:Call kernel32.CreateFileA(40758c28 "C:\\Program > Files\\Half-Life\\valve\\gfx\\shell\\cb_disabled.bmp",80000000,00000003,40758b80,00000003,00000080,00000000) > ret=0048e4ee > > 080787e0:Ret kernel32.CreateFileA() retval=ffffffff ret=0048e4ee > > The very first ones you pasted in fact. MSDN says that CreateFile > should > return a handle to a file, but if it goes wrong it'll return > INVALID_HANDLE_VALUE. The calls to GetLastError immediately > afterwards > strongly suggest that's what's happening, and in fact the retval > section > is what you're interested in here: ffffffffff is -1 in hex (using > twos > compliment, thanks francois!). > > So basically it looks like it can't open cb_disabled.bmp, and that > leads > to a cascade failure. Remember that often apps will try to recover > from > an error but fail so you need to look quite a bit up the trace to > discover what's going on. > > > 080787e0:Call kernel32.GetLastError() ret=0048e4fa > > 080787e0:Ret kernel32.GetLastError() retval=00000002 ret=0048e4fa > > And in fact the app detects it went wrong, and calls GetLastError. > The > part you are interested in here is retval, which is 2. MSDN tells us > that is ERROR_FILE_NOT_FOUND, so it didn't find the file. Have a poke > around, make sure it installed correctly would be what I'd do next. > > thanks -mike > > ===== Sylvain Petreolle spetreolle(a)users.sourceforge.net Fight against Spam ! http://www.euro.cauce.org/en/index.html ICQ #170597259 "Don't think you are. Know you are." Morpheus, in "Matrix". ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

Feb. 1, 2003

Re: half-life

by Mike Hearn

> 080787e0:Call kernel32.LOCAL_Alloc(000001ff,00000002,00000068) ret=409cfbf8 > may be the offender in this case (this is the line right before err:local) Hmmm. Maybe. I think here though this call is what is wrong: > 080787e0:Call kernel32.CreateFileA(40758c28 "C:\\Program Files\\Half-Life\\valve\\gfx\\shell\\cb_disabled.bmp",80000000,00000003,40758b80,00000003,00000080,00000000) ret=0048e4ee > 080787e0:Ret kernel32.CreateFileA() retval=ffffffff ret=0048e4ee The very first ones you pasted in fact. MSDN says that CreateFile should return a handle to a file, but if it goes wrong it'll return INVALID_HANDLE_VALUE. The calls to GetLastError immediately afterwards strongly suggest that's what's happening, and in fact the retval section is what you're interested in here: ffffffffff is -1 in hex (using twos compliment, thanks francois!). So basically it looks like it can't open cb_disabled.bmp, and that leads to a cascade failure. Remember that often apps will try to recover from an error but fail so you need to look quite a bit up the trace to discover what's going on. > 080787e0:Call kernel32.GetLastError() ret=0048e4fa > 080787e0:Ret kernel32.GetLastError() retval=00000002 ret=0048e4fa And in fact the app detects it went wrong, and calls GetLastError. The part you are interested in here is retval, which is 2. MSDN tells us that is ERROR_FILE_NOT_FOUND, so it didn't find the file. Have a poke around, make sure it installed correctly would be what I'd do next. thanks -mike

Feb. 1, 2003

ndr_marshall.c: operation on `pMemory' may be undefined

by Gerald Pfeifer

Hi Ove, I'm now getting the following warnings in ndr_marshall.c, which seem a bit weird: ndr_marshall.c:1220: warning: operation on `pMemory' may be undefined ndr_marshall.c:1223: warning: operation on `pMemory' may be undefined ndr_marshall.c:1276: warning: operation on `pMemory' may be undefined ndr_marshall.c:1279: warning: operation on `pMemory' may be undefined ndr_marshall.c:1327: warning: operation on `pMemory' may be undefined ndr_marshall.c:1330: warning: operation on `pMemory' may be undefined ndr_marshall.c:1376: warning: operation on `pMemory' may be undefined ndr_marshall.c:1379: warning: operation on `pMemory' may be undefined Would you/someone else mind having a look at these and avoiding them, if possible? Thanks, Gerald -- Gerald "Jerry" pfeifer(a)dbai.tuwien.ac.at http://www.pfeifer.com/gerald/

Feb. 1, 2003

Missing messages and redraw problem in Btrieve Setup utility 6.15

by Dan Kegel

This seems like a nice little test case. The UI in question is a single large dialog box put up by the Btrieve 6.15 setup utility. The Btrieve 6.15 redistributables saved in a zip file are only about 500KB, so it's a pretty easy test case to send to anyone interested. Recipe: Start BTI setup. Press TAB three times to bring to settings combo box. Start logging messages to small readonly text control giving name of current setting (11th control in spy++). Press Uparrow to pick different setting. Note visual problem in Wine. The problem in Wine is that the bottom window ends up blank. The sequence appears to be: erase bottom window, draw right values for bottom window client areas but not frames, erase bottom window. On Windows, it seems to continue after that with: draw right values for client areas again, then draw frames. Those last two bits are missing in Wine. Here are message logs taken with spy++: Microsoft Windows Me <00001> 00000798 S .WM_SHOWWINDOW fShow:False fuStatus:0 (ShowWindow was called) [wParam:00000000 lParam:00000000] <00002> 00000798 R .WM_SHOWWINDOW lResult:00000000 <00003> 00000798 S .WM_WINDOWPOSCHANGING lpwp:007DF2BA [wParam:00000000 lParam:007DF2BA] <00004> 00000798 R .WM_WINDOWPOSCHANGING lResult:00000000 <00005> 00000798 S .WM_WINDOWPOSCHANGED lpwp:007DF2F6 [wParam:00000000 lParam:007DF2F6] <00006> 00000798 R .WM_WINDOWPOSCHANGED lResult:00000000 <00007> 00000798 S .WM_SHOWWINDOW fShow:True fuStatus:0 (ShowWindow was called) [wParam:00000001 lParam:00000000] <00008> 00000798 R .WM_SHOWWINDOW lResult:00000000 <00009> 00000798 S .WM_WINDOWPOSCHANGING lpwp:007DF2BA [wParam:00000000 lParam:007DF2BA] <00010> 00000798 R .WM_WINDOWPOSCHANGING lResult:00000000 <00011> 00000798 S .WM_WINDOWPOSCHANGED lpwp:007DF2F6 [wParam:00000000 lParam:007DF2F6] <00012> 00000798 R .WM_WINDOWPOSCHANGED lResult:00000000 <00013> 00000798 P WM_PAINT hdc:00000000 [wParam:00000000 lParam:00000000] <00014> 00000798 S WM_NCPAINT hrgn:00000001 [wParam:00000001 lParam:00000000] <00015> 00000798 R WM_NCPAINT lResult:00000000 <00016> 00000798 S WM_ERASEBKGND hdc:00000DDE [wParam:00000DDE lParam:00000000] <00017> 00000798 R WM_ERASEBKGND fErased:True [lResult:00000001] Wine <00001> 00020054 S .WM_SHOWWINDOW fShow:False fuStatus:0 (ShowWindow was called) [wParam:00000000 lParam:00000000] <00002> 00020054 R .WM_SHOWWINDOW lResult:00000000 <00003> 00020054 S .WM_WINDOWPOSCHANGING lpwp:40792458 [wParam:00000000 lParam:40792458] <00004> 00020054 R .WM_WINDOWPOSCHANGING lResult:00000000 <00005> 00020054 S .WM_WINDOWPOSCHANGED lpwp:40792458 [wParam:00000000 lParam:40792458] <00006> 00020054 R .WM_WINDOWPOSCHANGED lResult:00000000 <00007> 00020054 S .WM_SHOWWINDOW fShow:True fuStatus:0 (ShowWindow was called) [wParam:00000001 lParam:00000000] <00008> 00020054 R .WM_SHOWWINDOW lResult:00000000 <00009> 00020054 S .WM_WINDOWPOSCHANGING lpwp:40792458 [wParam:00000000 lParam:40792458] <00010> 00020054 R .WM_WINDOWPOSCHANGING lResult:00000000 <00011> 00020054 S .WM_WINDOWPOSCHANGED lpwp:40792458 [wParam:00000000 lParam:40792458] <00012> 00020054 R .WM_WINDOWPOSCHANGED lResult:00000000 ----------------------------------------------------- Same thing, but log messages to the 5th control in spy++. This is the VisualCtl that is the frame and background for the entire bottom part of the dialog. Microsoft Windows Me <00001> 00000780 P WM_PAINT hdc:00000000 [wParam:00000000 lParam:00000000] <00002> 00000780 S WM_NCPAINT hrgn:00000A48 [wParam:00000A48 lParam:00000000] <00003> 00000780 R WM_NCPAINT lResult:00000000 <00004> 00000780 S WM_ERASEBKGND hdc:00000C12 [wParam:00000C12 lParam:00000000] <00005> 00000780 R WM_ERASEBKGND fErased:True [lResult:00000001] Wine <00001> 0002005A P WM_PAINT hdc:00000000 [wParam:00000000 lParam:00000000] <00002> 0002005A S WM_ERASEBKGND hdc:00000864 [wParam:00000864 lParam:00000000] <00003> 0002005A R WM_ERASEBKGND fErased:True [lResult:00000001] -- Dan Kegel http://www.kegel.com http://counter.li.org/cgi-bin/runscript/display-person.cgi?user=78045

Feb. 1, 2003

Re: half-life

by Scott Jackson

Alright, now that I know what's up, we might be able to get down to business. I ran it with -debugmsg +err,+relay so that I would be able to pick out what happened at each of these: err:local:LOCAL_GetBlock not enough space in GDI heap 01ff for 112 bytes since I'm only 16 :-) I don't know much 'bout programming, so I might need some help with making this out. 080787e0:Call kernel32.LOCAL_Alloc(000001ff,00000002,00000068) ret=409cfbf8 may be the offender in this case (this is the line right before err:local) It seems that other "kernel32.LOCAL_Alloc" instances were able to get off the hook, so I think it may actualy *be* limited GDI resources. the question is, why are there so few GDI resources? I'm also wondering about the presence of the damn ntdll lines, they might be fscking with my heap, and that's not good, is it? PS: What is GDI? :-P Thanks ----------- OUTPUT (highly cropped :-) ) -------- 080787e0:Call kernel32.CreateFileA(40758c28 "C:\\Program Files\\Half-Life\\valve\\gfx\\shell\\cb_disabled.bmp",80000000,00000003,40758b80,00000003,00000080,00000000) ret=0048e4ee 080787e0:Ret kernel32.CreateFileA() retval=ffffffff ret=0048e4ee 080787e0:Call kernel32.GetLastError() ret=0048e4fa 080787e0:Ret kernel32.GetLastError() retval=00000002 ret=0048e4fa 080787e0:Call kernel32.GetLastError() ret=00487e0b 080787e0:Ret kernel32.GetLastError() retval=00000002 ret=00487e0b 080787e0:Call kernel32.TlsGetValue(00000007) ret=00487e19 080787e0:Ret kernel32.TlsGetValue() retval=42880f80 ret=00487e19 080787e0:Call kernel32.SetLastError(00000002) ret=00487e65 080787e0:Ret kernel32.SetLastError() retval=00000002 ret=00487e65 080787e0:Call kernel32.GetLastError() ret=00487e0b 080787e0:Ret kernel32.GetLastError() retval=00000002 ret=00487e0b 080787e0:Call kernel32.TlsGetValue(00000007) ret=00487e19 080787e0:Ret kernel32.TlsGetValue() retval=42880f80 ret=00487e19 080787e0:Call kernel32.SetLastError(00000002) ret=00487e65 080787e0:Ret kernel32.SetLastError() retval=00000002 ret=00487e65 080787e0:Call ntdll.RtlLeaveCriticalSection(4277444c) ret=004871ad 080787e0:Ret ntdll.RtlLeaveCriticalSection() retval=00000000 ret=004871ad 080787e0:Call ntdll.RtlLeaveCriticalSection(42880010) ret=004874a5 080787e0:Ret ntdll.RtlLeaveCriticalSection() retval=00000000 ret=004874a5 080787e0:Call kernel32.GetLastError() ret=00487e0b 080787e0:Ret kernel32.GetLastError() retval=00000002 ret=00487e0b 080787e0:Call kernel32.TlsGetValue(00000007) ret=00487e19 080787e0:Ret kernel32.TlsGetValue() retval=42880f80 ret=00487e19 080787e0:Call kernel32.SetLastError(00000002) ret=00487e65 080787e0:Ret kernel32.SetLastError() retval=00000002 ret=00487e65 080787e0:Call user32.LoadStringA(17000000,0000003b,40758648,00000400) ret=004664b5 080787e0:Call ntdll.RtlAllocateHeap(40250000,00000000,00000800) ret=409208c9 080787e0:Ret ntdll.RtlAllocateHeap() retval=454d2de8 ret=409208c9 080787e0:Call kernel32.FindResourceW(17000000,00000004,00000006) ret=40920749 080787e0:Ret kernel32.FindResourceW() retval=17001518 ret=40920749 080787e0:Call kernel32.LoadResource(17000000,17001518) ret=4092075e 080787e0:Ret kernel32.LoadResource() retval=170027d8 ret=4092075e 080787e0:Call kernel32.LockResource(170027d8) ret=4092076e 080787e0:Ret kernel32.LockResource() retval=170027d8 ret=4092076e 080787e0:Call kernel32.WideCharToMultiByte(00000000,00000000,454d2de8 L"Could not open bitmap file '%s'.",00000020,40758648,000003ff,00000000,00000000) ret=40920913 080787e0:Ret kernel32.WideCharToMultiByte() retval=00000020 ret=40920913 080787e0:Call ntdll.RtlFreeHeap(40250000,00000000,454d2de8) ret=4092096d 080787e0:Ret ntdll.RtlFreeHeap() retval=00000001 ret=4092096d 080787e0:Ret user32.LoadStringA() retval=00000020 ret=004664b5 080787e0:Call gdi32.CreateFontA(fffffff5,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000004,00000000,00000002,00000002,004cd7d4 "Arial") ret=0043edb9 080787e0:Call kernel32.lstrcpynA(4075821c,004cd7d4 "Arial",00000020) ret=409cab09 080787e0:Ret kernel32.lstrcpynA() retval=4075821c ret=409cab09 080787e0:Call kernel32.MultiByteToWideChar(00000000,00000000,4075821c "Arial",ffffffff,4075818c,00000020) ret=409ca593 080787e0:Ret kernel32.MultiByteToWideChar() retval=00000006 ret=409ca593 080787e0:Call kernel32._EnterSysLevel(409f5c44) ret=409cfbb2 080787e0:Ret kernel32._EnterSysLevel() retval=0000000c ret=409cfbb2 080787e0:Call kernel32.LOCAL_Alloc(000001ff,00000002,00000068) ret=409cfbf8 err:local:LOCAL_GetBlock not enough space in GDI heap 01ff for 112 bytes 080787e0:Ret kernel32.LOCAL_Alloc() retval=00000000 ret=409cfbf8 080787e0:Call kernel32._LeaveSysLevel(409f5c44) ret=409cfd60 080787e0:Ret kernel32._LeaveSysLevel() retval=00000000 ret=409cfd60 -------------- (FIN) ---------------- On 01 Feb 2003 17:54:10 +0000 Mike Hearn <mike(a)theoretic.com> wrote: > Those lines aren't errors, they're logging each API call. > > If you know a bit about programming, you can probably examine the end of > the trace and see what happened just before it went wrong. That's when > you start debugging :) > ------ "De-fault! The two sweetest words in the English language." -- Homer Simpson Get Gaim for unix or win32 systems! gaim.sourceforge.net Scott "Action" Jackson - scott_j(a)ajackson.org

Feb. 1, 2003