Re: [PATCH v2 0/7] MR10688: msxml3: Improvements to setAttribute().

[Nikolay Sivov (＠nsivov)]

On Mon Apr 20 11:42:09 2026 +0000, Bernhard Übelacker wrote:
> Hello Nikolay, I just wanted to forward a note that some of the recent
> msxml3 changes may started causing following ASan findings.
> Unfortunately in the past I was carrying the patch from !9279, but
> dropped it as it stopped to apply to current git. Therefore I currently
> cannot say if that is a new issue or if it is caused by recent patches.
> Since [this gitlab
> run](https://gitlab.winehq.org/bernhardu/wine/-/jobs/253410#L3065) ASan
> gets triggered.
> This run was based on top of [1b13526a5f](https://gitlab.winehq.org/wine/wine/-/commits/1b13526a5fcfa55de602b71ed9365c...).
> <details>
> <summary>ASan details</summary>
> ```
> ==msxml3_test.exe==1616==ERROR: AddressSanitizer: heap-use-after-free on
> address 0x101f4050e318 at pc 0x6ffff922e8e9 bp 0x7ffffe1ff820 sp 0x7ffffe1ff868
> READ of size 8 at 0x101f4050e318 thread T0
>     #0 0x6ffff922e8e8 in domnode_drop_refs /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1247:15
>     #1 0x6ffff922e7d8 in domnode_release /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1385:11
>     #2 0x6ffff91eea23 in domdoc_Release /builds/bernhardu/wine/build64/../dlls/msxml3/domdoc.c:449:9
>     #3 0x00014007a586 in IXMLDOMDocument_Release /builds/bernhardu/wine/build64/include/msxml.h:1584:12
>     #4 0x00014003bf0f in test_put_nodeTypedValue /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:9047:5
>     #5 0x00014000114b in func_domdoc /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:16907:5
>     #6 0x0001400eab42 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
>     #7 0x0001400ea54b in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
>     #8 0x0001400ec7da in mainCRTStartup /builds/bernhardu/wine/build64/../dlls/msvcrt/crt_main.c:70:11
>     #9 0x6fffffc37b94 in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x178027b94)
>     #10 0x6fffffdc0be6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x170050be6)
> 0x101f4050e318 is located 104 bytes inside of 176-byte region [0x101f4050e2b0,0x101f4050e360)
> freed by thread T0 here:
>     #0 0x6ffffe82d861 in free /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:78:3
>     #1 0x6ffff922def4 in domnode_destroy_tree /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1378:5
>     #2 0x6ffff922e7f8 in domnode_release /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1387:9
>     #3 0x6ffff91fcefa in domelem_Release /builds/bernhardu/wine/build64/../dlls/msxml3/element.c:115:9
>     #4 0x00014007a7e6 in IXMLDOMElement_Release /builds/bernhardu/wine/build64/include/msxml.h:3969:12
>     #5 0x00014003bf06 in test_put_nodeTypedValue /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:9046:5
>     #6 0x00014000114b in func_domdoc /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:16907:5
>     #7 0x0001400eab42 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
>     #8 0x0001400ea54b in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
>     #9 0x0001400ec7da in mainCRTStartup /builds/bernhardu/wine/build64/../dlls/msvcrt/crt_main.c:70:11
>     #10 0x6fffffc37b94 in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x178027b94)
>     #11 0x6fffffdc0be6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x170050be6)
> previously allocated by thread T0 here:
>     #0 0x6ffffe82da86 in calloc /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:98:3
>     #1 0x6ffff922c969 in domnode_create /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1053:20
>     #2 0x6ffff91edd7c in dom_document_create /builds/bernhardu/wine/build64/../dlls/msxml3/domdoc.c:2536:21
>     #3 0x6ffff9209586 in DOMClassFactory_CreateInstance /builds/bernhardu/wine/build64/../dlls/msxml3/factory.c:246:9
>     #4 0x6ffffcc31b07 in IClassFactory_CreateInstance /builds/bernhardu/wine/build64/include/unknwn.h:248:12
>     #5 0x6ffffcc30f29 in CoCreateInstanceEx /builds/bernhardu/wine/build64/../dlls/combase/combase.c:1947:10
>     #6 0x6ffffcc30526 in CoCreateInstance /builds/bernhardu/wine/build64/../dlls/combase/combase.c:1736:10
>     #7 0x00014007a1d9 in _create_object /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:1207:10
>     #8 0x00014003a1f5 in test_put_nodeTypedValue /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:8860:11
>     #9 0x00014000114b in func_domdoc /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:16907:5
>     #10 0x0001400eab42 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
>     #11 0x0001400ea54b in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
>     #12 0x0001400ec7da in mainCRTStartup /builds/bernhardu/wine/build64/../dlls/msvcrt/crt_main.c:70:11
>     #13 0x6fffffc37b94 in BaseThreadInitThunk (C:\windows\system32\kernel32.dll+0x178027b94)
>     #14 0x6fffffdc0be6 in RtlUserThreadStart (C:\windows\system32\ntdll.dll+0x170050be6)
> SUMMARY: AddressSanitizer: heap-use-after-free
> /builds/bernhardu/wine/build64/../dlls/msxml3/node.c:1247:15 in domnode_drop_refs
> ```
> </details>
> Great, thank you.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10688#note_137090