[Bug 54183] New: wineserver crash when running d3d9:visual

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=54183

Bug ID: 54183
           Summary: wineserver crash when running d3d9:visual
           Product: Wine
           Version: 8.0-rc1
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Keywords: testcase
          Severity: normal
          Priority: P2
         Component: wineserver
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail]
      Distribution: ---

d3d9:visual on this machine breaks somewhere in the middle, apparently while
trying to do mode switches, and leaves the display switched off. Not sure what
triggers it exactly; I've certainly had working runs on other machines. What's
important is that then when d3d9_test.exe exits, it triggers a wined3d crash.

Simple tl;dr version is that set_cursor_pos gets triggered not from a client
request, and tries to access current->process, which crashes.

The backtrace is:

Core was generated by `/home/elizabeth/git/wine64/loader/../server/wineserver
-d'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00005598e8b43ac0 in set_cursor_pos (desktop=desktop@entry=0x5598ea1ce5d0,
x=32767, y=32767) at ../wine/server/queue.c:427
427         if ((device = current->process->rawinput_mouse) && (device->flags &
RIDEV_NOLEGACY))
(gdb) bt
#0  0x00005598e8b43ac0 in set_cursor_pos (desktop=desktop@entry=0x5598ea1ce5d0,
x=32767, y=32767) at ../wine/server/queue.c:427
#1  0x00005598e8b43c7b in set_clip_rectangle
(desktop=desktop@entry=0x5598ea1ce5d0, rect=rect@entry=0x0,
send_clip_msg=send_clip_msg@entry=1) at ../wine/server/queue.c:476
#2  0x00005598e8b43da1 in set_foreground_input (input=0x0,
desktop=0x5598ea1ce5d0) at ../wine/server/queue.c:483
#3  set_foreground_input (input=0x0, desktop=0x5598ea1ce5d0) at
../wine/server/queue.c:480
#4  thread_input_destroy (obj=0x5598ea1ba430) at ../wine/server/queue.c:1106
#5  0x00005598e8b3b144 in release_object (ptr=0x5598ea1ba430) at
../wine/server/object.c:451
#6  release_object (ptr=0x5598ea1ba430) at ../wine/server/object.c:440
#7  0x00005598e8b43800 in msg_queue_destroy (obj=0x5598ea1ae4d0) at
../wine/server/queue.c:1077
#8  0x00005598e8b3b144 in release_object (ptr=0x5598ea1ae4d0) at
../wine/server/object.c:451
#9  release_object (ptr=ptr@entry=0x5598ea1ae4d0) at
../wine/server/object.c:440
#10 0x00005598e8b3224e in release_object_from_handle (obj=0x5598ea1ae4d0) at
../wine/server/handle.c:115
#11 handle_table_destroy (obj=0x5598ea1d3810) at ../wine/server/handle.c:185
#12 0x00005598e8b3b144 in release_object (ptr=0x5598ea1d3810) at
../wine/server/object.c:451
#13 release_object (ptr=0x5598ea1d3810) at ../wine/server/object.c:440
#14 0x00005598e8b3260f in close_process_handles
(process=process@entry=0x5598ea1ce7a0) at ../wine/server/handle.c:197
#15 0x00005598e8b3d990 in process_killed (process=0x5598ea1ce7a0) at
../wine/server/process.c:970
#16 remove_process_thread (process=0x5598ea1ce7a0,
thread=thread@entry=0x5598ea1d4020) at ../wine/server/process.c:1020
#17 0x00005598e8b5b37f in kill_thread (thread=0x5598ea1d4020,
violent_death=<optimized out>, violent_death@entry=0) at
../wine/server/thread.c:1294
#18 0x00005598e8b3dcb0 in kill_process (violent_death=0,
process=0x5598ea1ce7a0) at ../wine/server/process.c:1077
#19 kill_process (process=0x5598ea1ce7a0, violent_death=<optimized out>) at
../wine/server/process.c:1058
#20 0x00005598e8b2d587 in fd_poll_event (event=<optimized out>, fd=<optimized
out>) at ../wine/server/fd.c:542
#21 main_loop_epoll () at ../wine/server/fd.c:636
#22 0x00005598e8b2d7ee in main_loop () at ../wine/server/fd.c:992
#23 0x00005598e8b1ea7d in main (argc=2, argv=0x7ffd26625e48) at
../wine/server/main.c:237

Rémi, do you have any immediate insight on what we should be doing here?