[Bug 35689] New: iMesh 7.x crashes on exit

https://bugs.winehq.org/show_bug.cgi?id=35689

Bug ID: 35689
           Summary: iMesh 7.x crashes on exit
           Product: Wine
           Version: 1.7.13
          Hardware: x86
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: [e-mail]
          Reporter: [e-mail]

Hello folks,

as the summary says.

Trace log doesn't reveal much:

--- snip ---
$ pwd
/home/focht/.wine/drive_c/Program Files/iMesh Applications/iMesh

$ WINEDEBUG=+tid,+seh,+relay,+wmp wine ./iMesh.exe >>log.txt 2>&1
...
0025:Call KERNEL32.GetProcAddress(7eb20000,00b041b4 "WinHelpW") ret=008a28ab
0025:Ret  KERNEL32.GetProcAddress() retval=7eb2bd50 ret=008a28ab
0025:Call user32.WinHelpW(0001009a,00000000,00000002,00000000) ret=0094b72c
0025:Ret  user32.WinHelpW() retval=00000001 ret=0094b72c
0025:Call user32.CallWindowProcW(ffff002f,0001009a,00000002,00000000,00000000)
ret=009405c5
0025:Call window proc 0x126035c
(hwnd=0x1009a,msg=WM_DESTROY,wp=00000000,lp=00000000)
0025:Call user32.CallWindowProcA(ffff002e,0001009a,00000002,00000000,00000000)
ret=00353f4a
0025:Call window proc 0x90f0bd
(hwnd=0x1009a,msg=WM_DESTROY,wp=00000000,lp=00000000)
0025:Call KERNEL32.GetProcAddress(7eb20000,00b03c34 "DefWindowProcW")
ret=008a28ab
0025:Ret  KERNEL32.GetProcAddress() retval=7eb28b70 ret=008a28ab
0025:Call user32.DefWindowProcW(0001009a,00000002,00000000,00000000)
ret=7ebd3d72
0025:Ret  user32.DefWindowProcW() retval=00000000 ret=7ebd3d72
0025:Ret  window proc 0x90f0bd
(hwnd=0x1009a,msg=WM_DESTROY,wp=00000000,lp=00000000) retval=00000000
0025:Ret  user32.CallWindowProcA() retval=00000000 ret=00353f4a
0025:Ret  window proc 0x126035c
(hwnd=0x1009a,msg=WM_DESTROY,wp=00000000,lp=00000000) retval=00000000
0025:Ret  user32.CallWindowProcW() retval=00000000 ret=009405c5
0025:trace:seh:raise_exception code=c0000005 flags=0 addr=0x608915 ip=00608915
tid=0025
0025:trace:seh:raise_exception  info[0]=00000000
0025:trace:seh:raise_exception  info[1]=00000000
0025:trace:seh:raise_exception  eax=00000000 ebx=00ed0040 ecx=03131afc
edx=030e09c4 esi=03131afc edi=00de0a14
0025:trace:seh:raise_exception  ebp=0033f43c esp=0033f410 cs=0023 ds=002b
es=002b fs=0063 gs=006b flags=00210206
0025:trace:seh:call_stack_handlers calling handler at 0x972775 code=c0000005
flags=0
0025:trace:seh:call_stack_handlers handler at 0x972775 returned 1
0025:trace:seh:call_stack_handlers calling handler at 0x98f5d7 code=c0000005
flags=0
0025:trace:seh:call_stack_handlers handler at 0x98f5d7 returned 1
0025:trace:seh:call_stack_handlers calling handler at 0x999b5c code=c0000005
flags=0
0025:trace:seh:call_stack_handlers handler at 0x999b5c returned 1
0025:trace:seh:call_stack_handlers calling handler at 0x999ae3 code=c0000005
flags=0 
...
Unhandled exception: page fault on read access to 0x00000000 in 32-bit code
(0x00608915).
...
Backtrace:
=>0 0x00608915 in imesh (+0x208915) (0x0033f43c)
  1 0x006e0d36 in imesh (+0x2e0d35) (0x0033f498)
  2 0x009438ed in imesh (+0x5438ec) (0x0033f520)
  3 0x00940829 in imesh (+0x540828) (0x0033f540)
  4 0x006e1495 in imesh (+0x2e1494) (0x0033f568)
  5 0x009425a8 in imesh (+0x5425a7) (0x0033f5c8)
  6 0x00942638 in imesh (+0x542637) (0x0033f5e8)
  7 0x7ebd3d72 WINPROC_wrapper+0x19() in user32 (0x0033f618)
...
Modules:
Module    Address            Debug info    Name (173 modules)
PE      350000-  3c7000    Deferred        actskn45
PE      400000-  bdf000    Export          imesh
PE     18b0000- 18d7000    Deferred        nssdbm3
PE     3230000- 3273000    Deferred        portablemediadevicewrapper
PE     3390000- 33c6000    Deferred        nspr4
PE     33d0000- 33f7000    Deferred        smime3
PE    10000000-1005c000    Deferred        resourcesloc 
...
Threads:
process  tid      prio (all id:s are in hex) 
...
00000024 (D) C:\Program Files\iMesh Applications\iMesh\iMesh.exe
    0000004e    0
    0000004d    0
    0000004c    0
    0000004b    0
    00000049    0
    00000048    0
    00000029    0
    0000002a    0
    0000000d    0
    0000000b    0
    00000046    0
    00000045    0
    00000044    0
    00000043  -15
    00000042    0
    00000041    0
    00000040   -1
    0000003f    0
    0000003e    0
    0000003d   -1
    0000003c    0
    0000003b    0
    0000003a    0
    00000039    0
    00000038    0
    00000037    0
    00000036    0
    00000028   -1
    00000027    0
    00000026    0
    00000025    1 <== 
--- snip ---

'winetricks wmp10' works around.
> From what I've gathered through debugging it seems the NULL pointer access is

related to IWMPControls::stop().

The pointer accessed could be IWMPControls* returned by
IWMPCore::get_controls().
Unfortunately I didn't find any FIXME reference to IWMPCore::get_controls() in
trace log (stub right now).

It's probably triggered by some code not in place yet because WMP is
work-in-progress and various parts are incomplete.

$ sha1sum iMeshV7.exe 
0e4aa7ae0da88b7f69a7daa1bca36f3f2f6c497b  iMeshV7.exe

$ du -sh iMeshV7.exe 
8.4M    iMeshV7.exe

$ wine --version
wine-1.7.13-100-gfcae016

Regards