[Bug 17045] Microsoft OneNote 2007 crashes on "Copy Hyperlink" (ole/clipboard functionality)

http://bugs.winehq.org/show_bug.cgi?id=17045

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
          Component|-unknown                    |ole32
            Summary|Microsoft OneNote 2007      |Microsoft OneNote 2007
                   |crashes on "Copy            |crashes on "Copy Hyperlink"
                   |Hyperlink"; needs           |(ole/clipboard
                   |msctf.dll?                  |functionality)

--- Comment #2 from Anastasius Focht   2010-08-20 10:37:14 ---
Hello,

this looks more related to ole/clipboard stuff.
I'm also seeing a crash in OneNote 2007 (right click on hyperlink -> copy +
click).
Trying to copy a hyperlink crashes but this might not be the same what Dan
tried?

Anyway, relevant backtrace snippet:

--- snip ---
...
Register dump:
 CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b
 EIP:68409fb7 ESP:0033bb7c EBP:0033bbb4 EFLAGS:00210202(  R- --  I   - - - )
 EAX:80004003 EBX:684acd5c ECX:00000001 EDX:00000040
 ESI:684a2914 EDI:00000040
Stack dump:
0x0033bb7c:  00000028 714af51c 68b67e9b 7bc4571e
0x0033bb8c:  7c04b6a0 04e00004 0033bbd4 00000020
0x0033bb9c:  7c04b6a0 0033bbac 0033bc08 684acd5c
0x0033bbac:  0013e6c8 00000040 0033bc84 6840a166
0x0033bbbc:  00000000 00000000 00000001 0033bc68
0x0033bbcc:  00110060 68ae96c4 0033bc24 68a71b4c
Backtrace:
=>0 0x68409fb7 get_marshaler+0x27(riid=0x684a2914, pUnk=0x40, dwDestContext=0,
pvDestContext=0x0(nil), mshlFlags=0x0001, pMarshal=0x33bc68)
[/opt/wine/wine-build/dlls/ole32/../../../wine-git/dlls/ole32/marshal.c:1515]
in ole32 (0x0033bc84)
  1 0x6840a166 CoMarshalInterface+0x145(pStream=0x13e6c8, riid=0x684a2914,
pUnk=0x40, dwDestContext=0, pvDestContext=0x0(nil), mshlFlags=0x0001)
[/opt/wine/wine-build/dlls/ole32/../../../wine-git/dlls/ole32/marshal.c:1710]
in ole32 (0x0033bd44)
  2 0x683e37a9 set_src_dataobject+0x168(clipbrd=0x13e690, data=0x2c3cdc8)
[/opt/wine/wine-build/dlls/ole32/../../../wine-git/dlls/ole32/clipboard.c:1808]
in ole32 (0x0033bdd4)
  3 0x683e4103 OleSetClipboard+0x242(data=0x2c3cdc8)
[/opt/wine/wine-build/dlls/ole32/../../../wine-git/dlls/ole32/clipboard.c:1967]
in ole32 (0x0033be10)
  4 0x3419eef0 in onmain (+0x2deeef) (0x0033d58c)
...
0x68409fb7 get_marshaler+0x27
[/opt/wine/wine-build/dlls/ole32/../../../wine-git/dlls/ole32/marshal.c:1515]
in ole32: movl    0x0(%edx),%eax
1515        hr = IUnknown_QueryInterface(pUnk, &IID_IMarshal,
(LPVOID*)pMarshal);
--- snip ---

Trace log:

--- snip ---
0037:Call ole32.OleSetClipboard(0224bc30) ret=3419eef0
0037:trace:ole:OleSetClipboard (0x224bc30) 
...
0037:Call user32.OpenClipboard(0001020a) ret=6843bf34
0037:trace:clipboard:OpenClipboard (0x1020a)...
0037:trace:clipboard:OpenClipboard  returning 1
0037:Ret  user32.OpenClipboard() retval=00000001 ret=6843bf34
0037:Call user32.EmptyClipboard() ret=6843bfbd
0037:trace:clipboard:EmptyClipboard ()
0037:trace:clipboard:CLIPBOARD_SetClipboardOwner  hWnd(0x1020a)
0037:trace:clipboard:X11DRV_AcquireClipboard  0x1020a
0037:trace:clipboard:selection_acquire Grabbed X selection, owner=(04a00004)
0037:trace:clipboard:X11DRV_EmptyClipboard  called with 10 entries in cache.
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData 000d
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData 0001
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData c0ac
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData c0ad
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData c0ae
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData c0af
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData c0b0
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData c0b1
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData c0b2
0037:trace:clipboard:X11DRV_CLIPBOARD_FreeData 0007
0037:trace:clipboard:X11DRV_EmptyClipboard  0 entries remaining in cache.
0037:Ret  user32.EmptyClipboard() retval=00000001 ret=6843bfbd
0037:trace:ole:CoMarshalInterface (0x153cb0,
{0000010e-0000-0000-c000-000000000046}, 0x68504d5c, 0, (nil),
MSHLFLAGS_TABLESTRONG)
0037:trace:seh:raise_exception code=c0000005 flags=0 addr=(nil) ip=00000000
tid=0037
0037:trace:seh:raise_exception  info[0]=00000000
0037:trace:seh:raise_exception  info[1]=00000000
0037:trace:seh:raise_exception  eax=000f6c20 ebx=68504d5c ecx=00000001
edx=684fa6a4 esi=684fa914 edi=68504d5c
0037:trace:seh:raise_exception  ebp=0032b8a8 esp=0032b86c cs=0023 ds=002b
es=002b fs=0063 gs=006b flags=00210206
0037:trace:seh:call_vectored_handlers calling handler at 0x30019e63
code=c0000005 flags=0 
--- snip ---

Relevant source:

--- snip dlls/ole32/clipboard.c ---
static HRESULT set_src_dataobject(ole_clipbrd *clipbrd, IDataObject *data)
{
    HRESULT hr;
    HWND wnd;

if(FAILED(hr = get_clipbrd_window(clipbrd, &wnd))) return hr;

if(clipbrd->src_data)
    {
        release_marshal_data(clipbrd->marshal_data);

IDataObject_Release(clipbrd->src_data);
        clipbrd->src_data = NULL;
        HeapFree(GetProcessHeap(), 0, clipbrd->cached_enum);
        clipbrd->cached_enum = NULL;
    }

if(data)
    {
        IUnknown *unk;

IDataObject_AddRef(data);
        clipbrd->src_data = data;

IDataObject_QueryInterface(data, &IID_IUnknown, (void**)&unk);
        hr = CoMarshalInterface(clipbrd->marshal_data, &IID_IDataObject, unk,
                                MSHCTX_LOCAL, NULL, MSHLFLAGS_TABLESTRONG);
        IUnknown_Release(unk); /* Don't hold a ref on IUnknown, we have one on
IDataObject. */
        if(FAILED(hr)) return hr;
        hr = set_clipboard_formats(clipbrd, data);
    }
    return hr;
}
--- snip dlls/ole32/clipboard.c ---

Strangely it fails when trying to query for IDataObject's IUnknown (addref
before worked and the vtable _is_ valid), it returns with 0x80040002 (interface
not supported).
Something is not supposed to be called that way here...

--- snip ---
$ wine --version
wine-1.3.0-449-g703ab02
--- snip ---

Clean WINEPREFIX, only "riched20" native-only override.

Regards