[Bug 28666] New: Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

Bug #: 28666
           Summary: Spa Mania: Read from NULL when toggling fullscreen
                    mode
           Product: Wine
           Version: 1.3.30
          Platform: x86
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
    Classification: Unclassified

Created attachment 36838
  --> http://bugs.winehq.org/attachment.cgi?id=36838
Plain terminal output

Attempting to enter or leave fullscreen mode crashes the game.

[Bug 28666] Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

Josh Juran  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download
                URL|                            |http://www.bigfishgames.com
                   |                            |/download-games/3693/spa-ma
                   |                            |nia/index.html

[Bug 28666] Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

Dan Kegel  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
          Component|-unknown                    |directx-d3d

--- Comment #1 from Dan Kegel  2011-10-11 21:14:47 CDT ---
Did this work properly with any older version of Wine?

Here's the backtrace from that log:

Unhandled exception: page fault on read access to 0x00000000 in 32-bit code
(0x7e79ebc6).
Backtrace:
=>0 context_acquire+0x3e6(device=0x15cc80, target=0x1565c0)
[dlls/wined3d/context.c:2439]
  1 surface_load_location+0x475(surface=0x18a088, location=0x40000, rect=(nil))
[dlls/wined3d/surface.c:6000]
  2 surface_blt_fbo+0xa2(device=0x164598, filter=<is not available>,
src_surface=0x18a088, src_location=0x40000, src_rect_in=0x33f4dc,
dst_surface=0x1884c0, dst_location=0x40000, dst_rect_in=0x33f4cc)
[dlls/wined3d/surface.c:1212]
  3 wined3d_surface_blt+0xef1(dst_surface=0x1884c0, dst_rect_in=0x33f5fc,
src_surface=0x18a088, src_rect_in=0x33f60c, flags=0, fx=(nil),
filter=WINED3DTEXF_LINEAR) [dlls/wined3d/surface.c:1736]
  4 ddraw_surface7_Blt+0xd6(iface=0x1586e0, DestRect=0x33f5fc,
SrcSurface=0x1872c8, SrcRect=0x33f60c, Flags=0x1000000, DDBltFx=(nil))
[dlls/ddraw/surface.c:1286]
  5 in spamania (+0x11039d) (0x007889c0)

0x7e79ebc6 context_acquire+0x3e6 [dlls/wined3d/context.c:2439] in wined3d: movl
0x0(%eax),%edx
2439                struct wined3d_swapchain *swapchain =
device->swapchains[0];

[Bug 28666] Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

--- Comment #2 from Josh Juran  2011-10-12 16:08:27 CDT ---
(In reply to comment #1)
> Did this work properly with any older version of Wine?

It's also broken with Wine 1.3.22.  I haven't tried anything older.

[Bug 28666] Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

--- Comment #3 from Josh Juran  2011-10-12 16:17:25 CDT ---
Created attachment 36865
  --> http://bugs.winehq.org/attachment.cgi?id=36865
Null-check device->swapchains before dereference

This patch should not be applied as is.

With this patch, it's possible to click the Fullscreen checkbox without
necessarily crashing the game.  Usually the first click succeeds.  Repeated
clicks tend to crash the game eventually, if not sooner.  Also, sometimes the
cursor disappears, rendering the game unplayable (if using the software
cursor).

[Bug 28666] Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

--- Comment #4 from Josh Juran  2011-10-12 16:19:15 CDT ---
Created attachment 36866
  --> http://bugs.winehq.org/attachment.cgi?id=36866
Exiting fullscreen mode without crash

[Bug 28666] Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

--- Comment #5 from Josh Juran  2011-10-12 16:22:02 CDT ---
Created attachment 36867
  --> http://bugs.winehq.org/attachment.cgi?id=36867
Clicked Fullscreen twice, crashed

The game launched in a window.  Checking Fullscreen worked as expected. 
Unchecking it crashed the game.

[Bug 28666] Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

--- Comment #6 from Josh Juran  2011-10-12 16:24:49 CDT ---
(In reply to comment #3)
> Created attachment 36865 [details]
> Null-check device->swapchains before dereference
>
> This patch should not be applied as is.

Actually, this patch is completely harmless, since it only affects cases which
currently would crash anyway.  What I meant is that it's a first-try hack, not
a complete solution.

[Bug 28666] Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

GyB  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |[e-mail]
         Resolution|                            |FIXED

--- Comment #7 from GyB  2013-01-20 04:04:39 CST ---
I can reproduce the crash with the reported Wine version (1.3.30), but it is no
longer present with Wine 1.4.1 or 1.5.22.

Marking fixed (reopen if not).

Tested on Fedora 17, XFCE 4.10, Nvidia gfx card binary drivers 304.64

[Bug 28666] Spa Mania: Read from NULL when toggling fullscreen mode

http://bugs.winehq.org/show_bug.cgi?id=28666

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #8 from Alexandre Julliard  2013-02-01 04:54:40 CST ---
Closing bugs fixed in 1.5.23.