[Bug 20634] New: Crash in GetBitmapBits / CURSORICON_CreateIconFromBMI in both wine conformance tests and chromium tests

http://bugs.winehq.org/show_bug.cgi?id=20634

Summary: Crash in GetBitmapBits / CURSORICON_CreateIconFromBMI
                    in both wine conformance tests and chromium tests
           Product: Wine
           Version: 1.1.32
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Keywords: download, source
          Severity: normal
          Priority: P2
         Component: user32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

It seems something is amiss with GetBitmapBits or CURSORICON_CreateIconFromBMI.

http://kegel.com/wine/valgrind/logs/2009-11-05-09.09/vg-user32_resource.txt
shows
Unhandled exception: page fault on read access to 0x7f421180 in 32-bit code
(0x0a4be160).

Backtrace:
=>0 _vgrZU_libcZdsoZa_memcpy+0x150(dst=0x7f264ef4, src=0x7f420f80, len=128)
[valgrind/memcheck/mc_replace_strmem.c:482] in vgpreload_memcheck-x86-linux.so 
  1 GetBitmapBits+0x112(hbitmap=0x3f4, count=4096, bits=0x7f264ef4)
[dlls/gdi32/bitmap.c:358] 
  2 CURSORICON_CreateIconFromBMI+0x78f(bmi=0x7f3a529c, hotspot={x=16962,
y=16962}, bIcon=1, dwVersion=196608, width=32, height=32, cFlag=0)
[dlls/user32/cursoricon.c:881] 
  3 CreateIconFromResourceEx+0x136(bits="(", cbSize=1128, bIcon=1,
dwVersion=196608, width=32, height=32, cFlag=0) [dlls/user32/cursoricon.c:1106] 
  4 ICO_ExtractIconExW+0x15b6(lpszExeFileName=0x7f0371c0, RetPtr=0x7f21f90c,
nIconIndex=0, nIcons=3, cxDesired=2097168, cyDesired=2097168,
pIconId=0x7f21f50c, flags=0) [dlls/user32/exticon.c:678] 
  5 PrivateExtractIconsW+0x149(lpwstrFile=0x7f0371c0, nIndex=0, sizeX=2097168,
sizeY=2097168, phicon=0x7f21f90c, pIconId=0x7f21f50c, nIcons=3, flags=0)
[dlls/user32/exticon.c:722] 
  6 PrivateExtractIconsA+0xe1(lpstrFile="shell32.dll", nIndex=0, sizeX=2097168,
sizeY=2097168, phicon=0x7f21f90c, piconid=0x7f21f50c, nIcons=3, flags=0)
[dlls/user32/exticon.c:743] 
  7 test_PrivateExtractIcons+0x297() [dlls/user32/tests/resource.c:357] in
user32_test

This was also present in my earliest recent run,
http://kegel.com/wine/valgrind/logs/2009-10-20-09.31/vg-user32_resource.txt

And tonight's chromium run has a similar stack trace:
[ RUN      ] IconUtilTest.TestCreateSkBitmapFromHICON
Unhandled exception: page fault on read access to 0x7f9c0600 in 32-bit code
(0x0a4c2160).
Backtrace:
=>0 _vgrZU_libcZdsoZa_memcpy+0x150(dst=0x7f26512c, src=0x7f9bfe00, len=512)
[valgrind/memcheck/mc_replace_strmem.c:482] in vgpreload_memcheck-x86-linux.so
  1 GetBitmapBits+0x112(hbitmap=0x788, count=65536, bits=0x7f26512c)
[dlls/gdi32/bitmap.c:358] in gdi32 (0x7f21f760)
  2 CURSORICON_CreateIconFromBMI+0x78f(bmi=0x7f440016, hotspot={x=16962,
y=16962}, bIcon=1, dwVersion=196608, width=128, height=128, cFlag=48)
[dlls/user32/cursoricon.c:881]
  3 CURSORICON_LoadFromFile+0x215(filename=0x7f4c0038, width=128, height=128,
colors=256, fCursor=0, loadflags=48) [dlls/user32/cursoricon.c:1176]
  4 CURSORICON_Load+0xdc(hInstance=(nil), name=0x7f4c0038, width=128,
height=128, colors=256, fCursor=0, loadflags=48)
[dlls/user32/cursoricon.c:1207]
  5 LoadImageW+0x21c(hinst=(nil), name=0x7f4c0038, type=1, desiredx=128,
desiredy=128, loadflags=48) [dlls/user32/cursoricon.c:2757]
  6 `anonymous
namespace'::IconUtilTest::LoadIconFromFile+0x37(filename=0x7f21fb08, width=128,
height=128) [chromium\src\app\gfx\icon_util_unittest.cc:45] in app_unittests
  7 IconUtilTest_TestCreateSkBitmapFromHICON_Test::TestBody+0x557()
[chromium\src\app\gfx\icon_util_unittest.cc:183] in app_unittests

Both testsuites can't be wrong :-)

[Bug 20634] Crash in GetBitmapBits / CURSORICON_CreateIconFromBMI in both wine conformance tests and chromium tests

http://bugs.winehq.org/show_bug.cgi?id=20634

--- Comment #1 from Vitaliy Margolen   2009-11-08 23:24:38 ---
You sure it's not valgrind? It couldn't properly handle Wine exceptions.
Remember that all DIBs and DDBs have their memory read/write protected to
detect any access. This is what trips Valgrind.

[Bug 20634] Crash in GetBitmapBits / CURSORICON_CreateIconFromBMI in both wine conformance tests and chromium tests

http://bugs.winehq.org/show_bug.cgi?id=20634

--- Comment #2 from Dan Kegel   2009-11-08 23:34:07 ---
Could be valgrind indeed, forgot about that.  Guess I'll try
writing a minimal test...

[Bug 20634] Crash in GetBitmapBits / CURSORICON_CreateIconFromBMI in both wine conformance tests and chromium tests

http://bugs.winehq.org/show_bug.cgi?id=20634

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #3 from Alexandre Julliard   2009-11-11 09:57:01 ---
As far as I can tell that's a valgrind bug, it doesn't seem to correctly handle
a page fault happening inside memcpy.

[Bug 20634] Crash in GetBitmapBits / CURSORICON_CreateIconFromBMI in both wine conformance tests and chromium tests

http://bugs.winehq.org/show_bug.cgi?id=20634

Vitaliy Margolen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #4 from Vitaliy Margolen   2009-11-11 20:45:44 ---
Closing invalid.