[Bug 35171] New: Adobe Shockwave Player 12.x installer crashes on startup (URL moniker notify window class not unregistered during unload of urlmon)

http://bugs.winehq.org/show_bug.cgi?id=35171

Bug ID: 35171
           Summary: Adobe Shockwave Player 12.x installer crashes on
                    startup (URL moniker notify window class not
                    unregistered during unload of urlmon)
           Product: Wine
           Version: 1.7.8
          Hardware: x86
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: urlmon
          Assignee: [e-mail]
          Reporter: [e-mail]
    Classification: Unclassified

Hello folks,

as the summary says.

Relevant part of trace log:

--- snip ---
$ WINEDEBUG=+tid,+seh,+relay,+win,+msg wine ./Shockwave_Installer_Full.exe
> > log.txt 2>&1

...
0024:Call urlmon.URLOpenStreamW(00000000,00206e00
L"http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/SCC/...)
ret=017e697a 
...
0024:Call user32.RegisterClassExW(7d8bf420) ret=7d82b211
0024:trace:win:alloc_winproc allocated 0xffff002b for W 0x7d82b0e1 (44/4096
used)
0024:Ret  user32.RegisterClassExW() retval=0000c053 ret=7d82b211
0024:Call user32.CreateWindowExW(00000000,7d88a000 L"URL Moniker Notification
Window",7d88a000 L"URL Moniker Notification
Window",00000000,00000000,00000000,00000000,00000000,fffffffd,00000000,7d810000,00000000)
ret=7d82b2ad
0024:trace:win:WIN_CreateWindowEx L"URL Moniker Notification Window" L"URL
Moniker Notification Window" ex=00000000 style=00000000 0,0 0x0
parent=0xfffffffd menu=(nil) inst=0x7d810000 params=(nil)
0024:trace:win:dump_window_styles style:
0024:trace:win:dump_window_styles exstyle:
0024:trace:win:GetWindowRect hwnd 0x60098 (0,0)-(0,0) 
...
0024:Ret  urlmon.URLOpenStreamW() retval=000401e8 ret=017e697a 
...
0024:Ret  PE DLL (proc=0x7d886d0c,module=0x7d810000
L"urlmon.dll",reason=PROCESS_DETACH,res=(nil)) retval=1
0024:Ret  KERNEL32.FreeLibrary() retval=00000001 ret=00f4af02
...
0024:Call user32.PeekMessageW(00f3d758,00000000,00000000,00000000,00000003)
ret=7e5d0994
0024:trace:msg:peek_message got type 6 msg 465 (WM_USER+101) hwnd 0x60098 wp 0
lp 207918
0024:Ret  user32.PeekMessageW() retval=00000001 ret=7e5d0994
0024:Call user32.TranslateMessage(00f3d758) ret=7e5d0d5b
0024:Ret  user32.TranslateMessage() retval=00000000 ret=7e5d0d5b
0024:Call user32.DispatchMessageW(00f3d758) ret=7e5d0d6c
0024:Call window proc 0x7d82b0e1
(hwnd=0x60098,msg=WM_USER+101,wp=00000000,lp=00207918)
0024:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7d82b0e1
ip=7d82b0e1 tid=0024
0024:trace:seh:raise_exception  info[0]=00000000
0024:trace:seh:raise_exception  info[1]=7d82b0e1
0024:trace:seh:raise_exception  eax=7d82b0e1 ebx=7ed98000 ecx=00000000
edx=00f3ef88 esi=00207918 edi=00f3d6a8
0024:trace:seh:raise_exception  ebp=00f3d538 esp=00f3d50c cs=0023 ds=002b
es=002b fs=0063 gs=006b flags=00010202 
--- snip ----

The class proc is still registered when urlmon is unloaded, leading to later
crash.

Registration of window class:

--- snip ---
Wine-dbg>bt
Backtrace:
=>0 0x7ec829ba RegisterClassExW(wc=0x7d816420)
[/home/focht/projects/wine/wine-git/dlls/user32/class.c:615] in user32
(0x00f3dc68)
  1 0x7d781144 Binding_Create+0xa7(mon=(nil), binding_ctx=(nil), uri=0x1d5718,
pbc=0x1d59f8, to_obj=0, riid=0x7d7ea79c, binding=0xf3dd58)
[/home/focht/projects/wine/wine-git/dlls/urlmon/binding.c:1410] in urlmon
(0x00f3dd08)
  2 0x7d781749 start_binding+0x50(mon=(nil), binding_ctx=(nil), uri=0x1d5718,
pbc=0x1d59f8, to_obj=0, riid=0x7d7ea79c, ret=0xf3dde8)
[/home/focht/projects/wine/wine-git/dlls/urlmon/binding.c:1510] in urlmon
(0x00f3ddb8)
  3 0x7d781b26 bind_to_storage+0x52(uri=0x1d5718, pbc=0x1d59f8,
riid=0x7d7ea79c, ppv=0xf3def4)
[/home/focht/projects/wine/wine-git/dlls/urlmon/binding.c:1567] in urlmon
(0x00f3de08)
  4 0x7d7a197e URLMoniker_BindToStorage+0x14a(iface=0x1dc9b8, pbc=0x1d59f8,
pmkToLeft=(nil), riid=0x7d7ea79c, ppvObject=0xf3def4)
[/home/focht/projects/wine/wine-git/dlls/urlmon/umon.c:280] in urlmon
(0x00f3de68)
  5 0x7d7a3e8e
URLStartDownload+0x138(szURL="http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/SCC/...",
ppStream=0xf3def4, pBSC=0xf3def8)
[/home/focht/projects/wine/wine-build32/dlls/urlmon/../../include/objidl.h:3488]
in urlmon (0x00f3dec8)
  6 0x7d7a434a URLOpenStreamW+0xc0(pCaller=<couldn't compute location>,
szURL=<couldn't compute location>, dwReserved=<couldn't compute location>,
lpfnCB=<couldn't compute location>)
[/home/focht/projects/wine/wine-git/dlls/urlmon/umstream.c:337] in urlmon
(0x00f3df28)
  7 0x017e697a in symccis (+0x6979) (0x7b836097)
  8 0xfff0e483 (0x04244c8d)
--- snip ---

There is no code path where the window class is unregistered when tearing down?

Regards