[Bug 47388] New:=?UTF-8?Q?=20=E2=80=9CPage=20fault=20on=20rea?= d access to 0x00000000 in 32-bit code” in multiple games

https://bugs.winehq.org/show_bug.cgi?id=47388

Bug ID: 47388
           Summary: “Page fault on read access to 0x00000000 in 32-bit
                    code” in multiple games
           Product: Wine
           Version: 4.0
          Hardware: x86
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 64723
  --> https://bugs.winehq.org/attachment.cgi?id=64723
Wing Commander: Prophecy crash backtrace

Hello everyone.

I’ve attempted to install some Windows-only games on my ThinkPad X31 (32-bit)
running Debian 10 (while technically it is not released yet, I’ve switched to
use the “testing” repositories, which are used to prepare the tenth version’s
release) using Wine 4.0. So far I tried the first Galactic Civilizations (with
the expansion, Altarian Prophecy), Civilization III (with both expansions, Play
the World and Conquests), Sid Meier’s Alpha Centauri (with the expansion, Alien
Crossfire) and Wing Commander: Prophecy. All games (except Alpha Centauri,
which has been bought digitally on GOG.com which only provides a Windows
version) have been installed from compact discs, and might not be the latest
versions.

All of them succumbed to a “Page fault on read access to 0x00000000 in 32-bit
code” or similar error upon launching. GalCiv’s map editor (introduced with
Altarian Prophecy) also did crash, and Alpha Centauri’s GOG installer did
trigger the error as well (but it didn’t led to fatal consequences). Wherever I
took a look at the backtrace, I saw a failure of the assembler instruction
“movl 0x0(%eax),%ecx” (the registers and the 0x0 part can vary). By this point
I’ve only saved backtraces for two of the crashes, specifically of Wing
Commander: Prophecy and Alpha Centauri (with Alien Crossfire).

I’ve seen a bunch of other bug reports involving “movl 0x0(%eax),%ecx” or
similar cases, but they appear to refer to old versions of Wine and not be
updated in a long time. Only https://bugs.winehq.org/show_bug.cgi?id=40334 with
a similar “page fault on read access to 0x00000000” seems to be recent, but it
is a crash of 64-bit code and doesn’t disclose the exact failing instruction.

[Bug 47388]=?UTF-8?Q?=20=E2=80=9CPage=20fault=20on=20rea?= d access to 0x00000000 in 32-bit code” in multiple games

https://bugs.winehq.org/show_bug.cgi?id=47388

--- Comment #1 from [e-mail] ---
Created attachment 64724
  --> https://bugs.winehq.org/attachment.cgi?id=64724
Sid Meier’s Alien Crossfire crash backtrace

Apparently you can’t submit multiple attachments at once...

[Bug 47388]=?UTF-8?Q?=20=E2=80=9CPage=20fault=20on=20rea?= d access to 0x00000000 in 32-bit code” in multiple games

https://bugs.winehq.org/show_bug.cgi?id=47388

Paul Gofman  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Paul Gofman  ---
Please don't make assumptions on the similarity of the problems between
different programs based on the same 0x0 read access fault or similarity of
opcode (“movl 0x0(%eax),%ecx”) at which the fault happens. Both "read access to
0 address" and the specific instruction are roughly as specific as general "the
program crashes somewhere in its code" without an additional information.

Overall, if the crash happens inside the program's code (not in calls to Wine
functions), the crash report is mostly useless on its own. You'd rather attach
the terminal output, which will also have the crash report at the end of it if
you press 'Close' in crash window.

Can you please make the bug reports specific to the application which is
crashing and attach wine terminal output using the latest Wine development
version (4.10 at the moment) and clean Wine prefix? See:
https://wiki.winehq.org/Bugs

[Bug 47388]=?UTF-8?Q?=20=E2=80=9CPage=20fault=20on=20rea?= d access to 0x00000000 in 32-bit code” in multiple games

https://bugs.winehq.org/show_bug.cgi?id=47388

[e-mail] changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #3 from [e-mail] ---
Okay, so I am tearing down this issue report. I’ve installed the Wine
development version, and I’m going to investigate each of the cases
individually.

[Bug 47388]=?UTF-8?Q?=20=E2=80=9CPage=20fault=20on=20rea?= d access to 0x00000000 in 32-bit code” in multiple games

https://bugs.winehq.org/show_bug.cgi?id=47388

Zebediah Figura  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #4 from Zebediah Figura  ---
(In reply to BabylonAS from comment #3)
> Okay, so I am tearing down this issue report. I’ve installed the Wine
> development version, and I’m going to investigate each of the cases
> individually.

It's not particularly necessary to do that; we can reuse it for one application
and file separate bugs for the others.

For what it's worth, these backtraces do look extremely similar. Both in terms
of the stack looking almost identical, and the faulting address being somewhere
that doesn't show up on the module list, which sort of implies it's a
dynamically allocated thunk. I'd be interested to see a log with
+seh,+virtual,+module.

[Bug 47388]=?UTF-8?Q?=20=E2=80=9CPage=20fault=20on=20rea?= d access to 0x00000000 in 32-bit code” in multiple games

https://bugs.winehq.org/show_bug.cgi?id=47388

--- Comment #5 from [e-mail] ---
Done for the Alpha Centauri case, see
https://bugs.winehq.org/show_bug.cgi?id=47389.

If we are going to repurpose _this_ bug report, then I think it will be about
Wing Commander: Prophecy (for which there is the first attachment), but I’ll
only investigate this game some time later, probably after #47389 gets clear.

[Bug 47388]=?UTF-8?Q?=20=E2=80=9CPage=20fault=20on=20rea?= d access to 0x00000000 in 32-bit code” in multiple games

https://bugs.winehq.org/show_bug.cgi?id=47388

--- Comment #6 from Paul Gofman  ---
(In reply to Zebediah Figura from comment #4)
> For what it's worth, these backtraces do look extremely similar.

My comment mostly concerned searching / referring existing bugs by 0x0 memory
access or instruction that does it.

The crashes concerned here between the different applications run under the
same setup indeed seem to have exactly the same reason, and comparison of crash
reports suggests that too.

In this case, just a glance at the Wine default output gives the correct
direction to the problem. See bug #47389 which I believe has all the related
details now.

[Bug 47388]=?UTF-8?Q?=20=E2=80=9CPage=20fault=20on=20rea?= d access to 0x00000000 in 32-bit code” in multiple games

https://bugs.winehq.org/show_bug.cgi?id=47388

--- Comment #7 from Zebediah Figura  ---
(In reply to Paul Gofman from comment #6)
> (In reply to Zebediah Figura from comment #4)
> > For what it's worth, these backtraces do look extremely similar.
>
> My comment mostly concerned searching / referring existing bugs by 0x0
> memory access or instruction that does it.

Yeah, to be sure, that's a bad reason to conclude the same cause. I guess I was
commenting that in this specific case it might not be necessary to split the
report after all.

[Bug 47388] “Page fault on read access to 0x00000000 in 32-bit code” in multiple games

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47388

Ken Sharp  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #8 from Ken Sharp  ---
Closing bugs marked as invalid.