[Bug 12767] New: Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

Summary: Crash on close of hh when showing any real help file
           Product: Wine
           Version: CVS/GIT
          Platform: Other
        OS/Version: other
            Status: NEW
          Keywords: download
          Severity: normal
          Priority: P2
         Component: shdocvw
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

View a .chm file with hh.exe, then close it by clicking the go-away box.
Boom!  WINEDEBUG=warn+heap makes it happen slightly sooner, I'll attach the
log.
I can reproduce this with the .chm files from autohotkey and 7-zip,
probably any will do.  Log highlights:

trace:shdocvw:WebBrowser_Release (0x1351e8) ref=0
wine: Unhandled page fault on read access to 0xaaaaaab2 at address 0x7db782f7
(thread 0009), starting debugger...
Register dump:
 CS:0073 SS:007b DS:007b ES:007b FS:0033 GS:003b
 EIP:7db782f7 ESP:0032f740 EBP:0032f758 EFLAGS:00010202(   - 00      - -RI1)
 EAX:aaaaaaaa EBX:7db8f51c ECX:00000003 EDX:00134d98
 ESI:00135284 EDI:001351e8
Backtrace:
=>1 0x7db782f7 DocHost_Release+0x34(This=0x135284) [dlls/shdocvw/dochost.c:544] 
  2 0x7db8670e WebBrowser_Release+0x56(iface=?) [dlls/shdocvw/webbrowser.c:155] 
  3 0x7db7f3d5 OleObject_Release+0x15(iface=?) [dlls/shdocvw/oleobject.c:270] 
  4 0x7e5ac339 ReleaseWebBrowser+0xa9(info=?)
[dlls/hhctrl.ocx/webbrowser.c:660] 
...
0x7db782f7 DocHost_Release+0x34 [dlls/shdocvw/dochost.c:544] in shdocvw: call  
  *0x8(%eax)
544             IOleInPlaceFrame_Release(This->frame);

[Bug 12767] Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

--- Comment #1 from Dan Kegel   2008-04-23 20:20:02 ---
Created an attachment (id=12422)
 --> (http://bugs.winehq.org/attachment.cgi?id=12422)
warn+heap,+shdocvw hh 7-zip.chm crashing on exit

[Bug 12767] Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

Tefnet developers  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Tefnet developers   2008-04-24 02:30:28 ---
(In reply to comment #0)
> View a .chm file with hh.exe, then close it by clicking the go-away box.
> Boom!  WINEDEBUG=warn+heap makes it happen slightly sooner, I'll attach the
> log.
> I can reproduce this with the .chm files from autohotkey and 7-zip,
> probably any will do.  Log highlights:

I think that the problem is in ReleaseWebBrowser. I described it in:
http://bugs.winehq.org/show_bug.cgi?id=6801#c44

If you change release order it won't crash.. but I'm not sure if it is properly
released then.

I didn't send patch because no one confirm that... so I thought it happens only
in my environment.

[Bug 12767] Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

--- Comment #3 from Dan Kegel   2008-04-24 05:03:30 ---
Please attach a patch here and I'll try it.
(I can't tell from your description how to rearrange the code.)

[Bug 12767] Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

--- Comment #4 from Tefnet developers   2008-04-24 05:09:20 ---
Created an attachment (id=12427)
 --> (http://bugs.winehq.org/attachment.cgi?id=12427)
Fix for memory release problem in ReleaseWebBrowser

[Bug 12767] Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

--- Comment #5 from Dan Kegel   2008-04-24 05:32:29 ---
Hmm, with that patch I don't get the crash, seems like an improvement!
Go ahead and send, and in the patch, mention this bug report...

[Bug 12767] Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

--- Comment #6 from Tefnet developers   2008-04-24 05:51:51 ---
(In reply to comment #5)
> Hmm, with that patch I don't get the crash, seems like an improvement!
> Go ahead and send, and in the patch, mention this bug report...

OK, I've send a patch.

It is an improvement but I'm not sure if memory is released properly when you
change order and I don't know how to check it.

It looks like OleObjects have some handlers to client_site and if we release
client_site too early it probably tries to release it again during OleObject
release.

[Bug 12767] Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #7 from Austin English   2008-11-29 02:51:58 ---
Works fine in git.

[Bug 12767] Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #8 from Alexandre Julliard   2008-12-05 11:14:35 ---
Closing bugs fixed in 1.1.10.

[Bug 12767] Crash on close of hh when showing any real help file

http://bugs.winehq.org/show_bug.cgi?id=12767

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|CVS/GIT                     |unspecified