[Bug 11231] New: Regression since 0.9.49: glibc double free crashes all directx programs

http://bugs.winehq.org/show_bug.cgi?id=11231

Summary: Regression since 0.9.49: glibc double free crashes all
                    directx programs
           Product: Wine
           Version: 0.9.53.
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: blocker
          Priority: P2
         Component: directx-ddraw
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Hi,

Between 0.9.48 and 0.9.49, something broke DirectX(?)/DDraw rendering.

As a result, *all* tested games that use scalable or vector graphics now crash,
or even their installer crashes, e.g. VideoSetup.exe (Max&Mario,
Syberia2, BeetleCrazy etc.) with an error from glibc.  Old games using
bitmap graphics are not affected. GUI programs (regedit, notepad,
depends.exe) are not affected either.

This regression not only affects games, even wine's own testsuite
shows the exact same symptoms:

cd dlls/d3d8/tests; make test
../../../tools/runtest -q -P wine -M d3d8.dll -T ../../.. -p d3d8_test.exe.so
device.c && touch device.ok
*** glibc detected *** double free or corruption (!prev): 0x0013d100 ***
wine: Assertion failed at address 0xffffe410 (thread 0041), starting
debugger...
../../../tools/runtest -q -P wine -M d3d8.dll -T ../../.. -p d3d8_test.exe.so
surface.c && touch surface.ok
*** glibc detected *** free(): invalid next size (normal): 0x0013d108 ***
wine: Assertion failed at address 0xffffe410 (thread 0009), starting
debugger...
err:seh:raise_exception Unhandled exception code c000013a flags 0 addr
0xffffe410

Fail: 0.9.49, .50, .51, .52, .53
Work: 0.9.47, 0.9.48 (and older), urlmon/tests/

Both d3d8/tests and d3d9/tests fail.

I'm using Ubuntu 6.06 LTS (aka. Dapper) with packages:
freeglut 2.4.0-4
libgl1-mesa 6.4.1-0ubuntu8      (has /usr/lib/libGL.so.1.2)
libglu1-mesa 6.4.1-0ubuntu8     (has /usr/lib/libGLU.so.1.3.060401)
libglibb2.0-0 (2.10.3-0ubuntu1) (has /usr/lib/libglib-2.0.so.0.1000.3)
kernel 2.6.15-29-686 (sometimes also 2.6.15-28-686)
gcc (GCC) 4.0.3 (Ubuntu 4.0.3-1ubuntu5)
getconf GNU_LIBPTHREAD_VERSION  -> NPTL 2.3.6

This does not seem to be the infamous "winecfg crashes in winecfg audio tab"
bug http://bugs.winehq.org/show_bug.cgi?id=5826

Researching this bug, I found a message about
"an old C++ error" export MALLOC_CHECK_=0
That did not help.

Starting with a vanilla .wine/ doesn't help either:
../../../tools/runtest -q -P wine -M d3d8.dll -T ../../.. -p d3d8_test.exe.so
d3d8_main.c && touch d3d8_main.ok
wine: creating configuration directory '/home/hoehle/.wine'...
ALSA lib seq_hw.c:456:(snd_seq_hw_open) open /dev/snd/seq failed: No such file
or directory
Could not load Mozilla. HTML rendering will be disabled.
wine: '/home/hoehle/.wine' created successfully.
... [same as before]

I can exclude that the bug is caused by a change in my laptop
configuration. I have several source trees of wine, newly configured &
make'd, any only 0.9.49 and up fail the tests.

BTW, why does wine say "starting debugger..." yet no one appears? The
line about "err:seh:raise_exception" appears only approx. half a
minute after the "starting debugger..." line -- sometimes never and wine just
hangs.

Regards,
 Jörg Höhle