[Bug 48006] Final Fantasy XIV Launcher stuck on splash screen

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=48006

--- Comment #14 from Thomas Kowaliczek  ---
(In reply to Anastasius Focht from comment #12)
> Hello folks,
>
> confirming. There are multiple jscript and mshtml/Wine-Gecko bugs at play
> here.
>
> Adding stable link via Internet Archive:
>
> https://web.archive.org/web/20190701092018/http://gdl.square-enix.com/ffxiv/
> inst/ffxivsetup.exe
>
> The launcher gets stuck in a live-loop without any overrides.
>
> --- snip ---
> $ pwd
> /home/focht/.wine/drive_c/Program Files (x86)/SquareEnix/FINAL FANTASY XIV -
> A Realm Reborn/boot
>
> $ WINEDEBUG=+mshtml,+jscript wine ./ffxivboot.exe >>log.txt 2>&
> ...
> 0118:trace:mshtml:HTMLWindow2_QueryInterface (02E30ED8)->(IID_IDispatchEx
> 0031EC64)
> 0118:trace:mshtml:HTMLWindow2_AddRef (02E30ED8) ref=19
> 0118:trace:jscript:Array_reduce
> 0118:fixme:jscript:Array_reduce Could not get length
> 0118:trace:mshtml:HTMLWindow2_Release (02E30ED8) ref=18
> 0118:trace:jscript:DispatchEx_Release (10B7E428) ref=4
> 0118:warn:jscript:unwind_exception Exception 800a1396 undefined in:
> 0118:warn:jscript:print_backtrace 0	[unnamed]()
> 0118:warn:jscript:print_backtrace 1	[unnamed](L"t"=obj(10B7E510))
> 0118:warn:jscript:print_backtrace 2	[unnamed](L"t"=str(L"reduce"))
> 0118:warn:jscript:print_backtrace 3	10B7C590->[unnamed](L"t"=obj(10B7CB78),
> L"r"=obj(10B7C590), L"n"=obj(10ADC330))
> 0118:warn:jscript:print_backtrace 4	L"i"(L"t"=428.000000)
> 0118:warn:jscript:print_backtrace 5	10AE2DD8->[unnamed](L"A"=obj(10AE2D10),
> L"g"=obj(10AE2DD8), L"B"=obj(10ADC330))
> 0118:warn:jscript:print_backtrace 6	L"i"(L"t"=640.000000)
> 0118:warn:jscript:print_backtrace 7	L"r"()
> 0118:warn:jscript:print_backtrace 8	[unnamed](L"e"=obj(10A8C400))
> 0118:warn:jscript:print_backtrace 9	[unnamed]([detached frame])
> 0118:warn:jscript:print_backtrace 10	[native code]
> 0118:trace:jscript:throw_error 800a1396
> 0118:trace:jscript:set_error_location source
> L"r.call(null,n||function(){throw
> 1},1)}))}},function(t,n){t.exports=function(t,n,r){if(!(t instanceof
> n))throw TypeError("Incorrect "+(r?r+" ":"")+"invocation");return
> t}},,,function(t,n,r){var
> e=r(225),o=r(183).concat("length","prototype");n.f=Object.
> getOwnPropertyNames||funct"... in
> L"(window.webpackJsonp=window.webpackJsonp||[]).push([[8],[,,,,function(t,n,
> r){var
> e=r(9),o=r(36).f,i=r(41),u=r(38),c=r(179),f=r(223),a=r(121);t.
> exports=function(t,n){var
> r,s,p,l,v,h=t.target,y=t.global,d=t.stat;if(r=y?e:d?e[h]||c(h,{}):(e[h]||{}).
> prototype)for(s in n){if(l=n[s],p=t.noTarge"...
> 0118:trace:jscript:DispatchEx_Release (10B7E928) ref=1
> 0118:trace:jscript:DispatchEx_Release (10B7E428) ref=2
> 0118:trace:jscript:detach_variable_object detaching 10B7E7F8
> 0118:trace:jscript:prop_get L"prototype" ret obj(02EA41A0)
> 0118:trace:jscript:DispatchEx_Release (02EA41A0) ref=2
> 0118:trace:jscript:init_dispex 10B2AB50 (02EA41A0)
> 0118:trace:jscript:jsdisp_define_property L"number" = -2146823274.000000
> 0118:trace:jscript:jsdisp_define_property L"message" = str(L"JScript object
> expected")
> 0118:trace:jscript:jsdisp_define_property L"description" = str(L"JScript
> object expected")
> 0118:trace:jscript:init_dispex 10B7EAF8 (00000000)
> 0118:trace:jscript:ensure_prop_name creating prop L"t" flags 1c00 
> ...
> 0118:trace:jscript:jsdisp_define_property L"1" = accessor { get: 10B19D78
> set: 00000000 }
> 0118:trace:jscript:DispatchEx_Release (10AE3368) ref=3
> 0118:trace:jscript:interp_pop 5
> 0118:trace:jscript:DispatchEx_Release (10B850E0) ref=1
> 0118:trace:jscript:DispatchEx_Release (10B85018) ref=3
> 0118:trace:jscript:DispatchEx_Release (10AE3368) ref=1
> 0118:trace:jscript:interp_push_acc 
> 0118:trace:jscript:interp_setret 
> 0118:trace:jscript:interp_ret 
> 0118:trace:jscript:DispatchEx_Release (10B851C8) ref=1
> 0118:trace:jscript:jsdisp_free (10B851C8)
> 0118:trace:jscript:interp_pop 5
> 0118:trace:jscript:DispatchEx_Release (10B850E0) ref=0
> 0118:trace:jscript:jsdisp_free (10B850E0)
> 0118:trace:jscript:DispatchEx_Release (10B19D78) ref=7
> 0118:trace:jscript:DispatchEx_Release (10B85018) ref=2
> 0118:trace:jscript:DispatchEx_Release (10B19A78) ref=2
> 0118:trace:jscript:interp_push_acc 
> 0118:trace:jscript:interp_jmp 2689
> 0118:trace:jscript:interp_pop 1
> 0118:trace:jscript:DispatchEx_Release (10B85018) ref=1
> 0118:trace:jscript:interp_ident L"r"
> 0118:trace:jscript:identifier_eval L"r"
> 0118:trace:jscript:jsdisp_get_id not found L"r"
> 0118:trace:jscript:identifier_eval returning ref 74 for 0
> 0118:trace:jscript:interp_str L"call"
> 0118:trace:jscript:interp_memberid 0
> 0118:trace:jscript:DispatchEx_Release (10B84BC8) ref=3
> 0118:trace:jscript:interp_local 0: L"t"
> 0118:trace:jscript:interp_ident L"s"
> 0118:trace:jscript:identifier_eval L"s"
> 0118:trace:jscript:jsdisp_get_id not found L"s"
> 0118:trace:jscript:identifier_eval returning ref 76 for 2
> 0118:trace:jscript:interp_ident L"p"
> 0118:trace:jscript:identifier_eval L"p"
> 0118:trace:jscript:jsdisp_get_id not found L"p"
> 0118:trace:jscript:identifier_eval returning ref 77 for 3
> 0118:trace:jscript:interp_call_member 3 0
> 0118:trace:jscript:Function_call 
> 0118:trace:jscript:Array_splice 
> 0118:trace:jscript:prop_get L"length" ret -1.000000
>
> <live-loop in jscript code, churning 100% cpu>
> --- snip ---
>
> I've attached a debugger to dump the callstack of the main thread which
> churns all the cpu:
>
> --- snip ---
> jscript.Array_splice+444                 
> jscript.NativeFunction_call+CE           
> jscript.Function_call+BC                 
> jscript.invoke_prop_func+2ED             
> jscript.invoke_prop_func+128             
> jscript.disp_call+264                    
> jscript.exprval_call+6F                  
> jscript.interp_call_member+F9            
> jscript.exec_source+B82                  
> jscript.JScriptParse_ParseScriptText+2C4 
> mshtml.parse_elem_text+AA                
> mshtml.doc_insert_script+59              
> mshtml.run_insert_script+17C             
> mshtml.nsRunnable_Run+15                 
> ...
> --- snip ---
>
> Using the strings in memory I found the executed jscript code on disk. A
> huge one-liner. I "beautified" it using https://beautifier.io/
>
> The relevant part, where it live-looped in 'jscript.Array_splice' without
> returning, called from function r().
>
> --- snip ---
> function(e) {
> function t(t) {
>     for (var o, i, l = t[0], c = t[1], s = t[2], d = 0, b = []; d <
>
> l.length; d++) i = l[d], Object.prototype.hasOwnProperty.call(n, i) && n[i]
> && b.push(n[i][0]), n[i] = 0;
>         for (o in c) Object.prototype.hasOwnProperty.call(c, o) && (e[o] =
> c[o]);
>         for (u && u(t); b.length;) b.shift()();
>         return a.push.apply(a, s || []), r()
>     }
> function r() {
>     for (var e, t = 0; t < a.length; t++) {
>         for (var r = a[t], o = !0, l = 1; l < r.length; l++) {
>             var c = r[l];
>             0 !== n[c] && (o = !1)
>         }
>         o && (a.splice(t--, 1), e = i(i.s = r[0]))
>     }
>     return e
> }
> var o = {},
>     n = {
>         4: 0
>     },
>     a = [];
>
> function i(t) {
>     if (o[t]) return o[t].exports;
>     var r = o[t] = {
>         i: t,
>         l: !1,
>         exports: {}
>     };
>     return e[t].call(r.exports, r, r.exports, i), r.l = !0, r.exports
> }
>
> ...
> --- snip ---
>
> I didn't debug further. It shouldn't be hard to figure out why the array
> splice doesn't return.
>
> Using 'winetricks -q jscript' prevents the live-loop, only to run into next
> problems, mshtml insufficiencies.
>
> BTW there are many Final Fantasy (XIV) bug reports in Wine Bugzilla that are
> out of date, invalid, fixed and dupes. Quite a mess. I have no energy /
> interest to go through all of them indivually. It will likely destroy a good
> mood for sure.
>
> $ sha1sum ffxivsetup.exe 
> 10601e45ccbcaec81c8d0fda720cb8afc5a1f01b  ffxivsetup.exe
>
> $ du -sh ffxivsetup.exe 
> 27M	ffxivsetup.exe
>
> $ wine --version
> wine-6.0-250-gacd1b068a34
>
> Regards

I think most of the open bug reports can be closed. On AppDB there are only
linked two bug reports.