http://bugs.winehq.org/show_bug.cgi?id=18542
Summary: Slingplayer 2.0 unhandled exception on close Product: Wine Version: 1.1.21 Platform: PC URL: http://download.slingmedia.com/player/pc/SP2/SlingPlay er-2.0.3508-Setup-EMEA.exe OS/Version: Linux Status: UNCONFIRMED Severity: minor Priority: P2 Component: -unknown AssignedTo: wine-bugs@winehq.org ReportedBy: kennybobs@o2.co.uk
Created an attachment (id=21209) --> (http://bugs.winehq.org/attachment.cgi?id=21209) wine-1.1.21-316-g8f33420 console output
After closing Slingplayer 2.0, an unhandled exception occurs and the .exe remains in memory (along with another).
To get this far, dotnet20 and native gdiplus required.
http://bugs.winehq.org/show_bug.cgi?id=18542
Ken Sharp kennybobs@o2.co.uk changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #1 from Ken Sharp kennybobs@o2.co.uk 2009-05-20 19:57:10 --- Tested some more and found that this exception only occurs about 50% of the time. Still not sure why though.
http://bugs.winehq.org/show_bug.cgi?id=18542
Ken Sharp kennybobs@o2.co.uk changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|Slingplayer 2.0 unhandled |Slingplayer 2.0 unhandled |exception on close |exception Severity|minor |normal
--- Comment #2 from Ken Sharp kennybobs@o2.co.uk 2009-05-21 09:35:16 --- The same exception occurs when attempting to open the program guide or when putting the Slingplayer into fullscreen mode (additional steps are required to get that far).
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #3 from Ken Sharp kennybobs@o2.co.uk 2009-05-21 14:55:12 --- Now, the exception is occurring every time the app loads.
Trace seems to point to either lists(?) or heap allocation?
/* remove an element from its list */ 0 0x7bc432d8 list_remove+0xe(elem=0x163e01a2) [/home/test/wine-git/dlls/ntdll/../../include/wine/list.h:98] in ntdll (0x0032f600)
/* Build the in-use arena */ 1 0x7bc45cfb RtlAllocateHeap+0x26f(heap=0x1a20000, flags=2, size=80) [/home/test/wine-git/dlls/ntdll/heap.c:1397] in ntdll (0x0032f660)
I guess the random nature of the fault points to memory allocation problems.
A +heap trace takes too long to get anywhere.
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #4 from Austin English austinenglish@gmail.com 2009-05-21 17:19:36 --- (In reply to comment #3)
A +heap trace takes too long to get anywhere.
You can try a warn+heap, which has significantly less output, but may not have what you want.
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #5 from Ken Sharp kennybobs@o2.co.uk 2009-05-21 19:28:37 --- Thanks Austin, unfortunately you were right, the only thing warn+heap outputs is the one line repeated from start to finish:
warn:heap:HEAP_Decommit Could not decommit 003c0000 bytes at 0xbfc40000 for heap 0xbfc00000
http://bugs.winehq.org/show_bug.cgi?id=18542
Ken Sharp kennybobs@o2.co.uk changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |NEW Ever Confirmed|0 |1
--- Comment #6 from Ken Sharp kennybobs@o2.co.uk 2009-06-14 16:26:36 --- Still present in latest git.
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #7 from Ken Sharp kennybobs@o2.co.uk 2009-06-14 18:19:49 --- In latest git, eBay Turbo Lister suffers the same bug.
http://bugs.winehq.org/show_bug.cgi?id=18542
Ken Sharp kennybobs@o2.co.uk changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |18178
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #8 from Ken Sharp kennybobs@o2.co.uk 2009-06-14 18:55:54 --- Created an attachment (id=21799) --> (http://bugs.winehq.org/attachment.cgi?id=21799) wine-1.1.23-159-g45629dc +relay +seh +tid (last 10,000 lines)
Does this look about the right area?
0009:Call user32.GetMenuItemCount(000000f0) ret=004162ca 0009:Ret user32.GetMenuItemCount() retval=00000001 ret=004162ca 0009:Call user32.InsertMenuItemW(000000f0,00000001,00000001,0032eb60) ret=004418f0 0009:Ret user32.InsertMenuItemW() retval=00000001 ret=004418f0 0009:Call ntdll.RtlFreeHeap(01b30000,00000000,0edae138) ret=0051b8c3 0009:Ret ntdll.RtlFreeHeap() retval=00000001 ret=0051b8c3 0009:Call KERNEL32.InterlockedIncrement(01701a1c) ret=0076b36a 0009:Ret KERNEL32.InterlockedIncrement() retval=00000002 ret=0076b36a 0009:Call KERNEL32.InterlockedIncrement(01701a1c) ret=0079b110 ... 0009:Ret KERNEL32.InterlockedDecrement() retval=00000002 ret=0079b090 0009:Call ntdll.RtlAllocateHeap(01b30000,00000000,00000050) ret=0051ca93 0009:Ret ntdll.RtlAllocateHeap() retval=0edae138 ret=0051ca93 0009:Call ntdll.RtlAllocateHeap(01b30000,00000000,00000050) ret=0051ca93 0009:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7bc43398 ip=7bc43398 tid=0009 0009:trace:seh:raise_exception info[0]=00000001 0009:trace:seh:raise_exception info[1]=f200ff04 0009:trace:seh:raise_exception eax=01b300f8 ebx=7bc9d558 ecx=001a0f3a edx=f200ff00 esi=0032e800 edi=0032e77c 0009:trace:seh:raise_exception ebp=0032e708 esp=0032e708 cs=0073 ds=007b es=007b fs=0033 gs=003b flags=00210202 ... 0009:Call KERNEL32.GetLastError() ret=00524bf2 0009:Ret KERNEL32.GetLastError() retval=00000000 ret=00524bf2
The bits I've snipped out are in the attached log.
To recreate with Slingplayer 2.0: 1. Connect to Slingplayer and start streaming 2. Select a menu
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #9 from Rein Klazes wijn@online.nl 2009-06-15 02:18:31 --- (In reply to comment #8)
Created an attachment (id=21799)
--> (http://bugs.winehq.org/attachment.cgi?id=21799) [details]
wine-1.1.23-159-g45629dc +relay +seh +tid (last 10,000 lines)
Does this look about the right area?
Yes. Can you try the same with +menu added?
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #10 from Ken Sharp kennybobs@o2.co.uk 2009-06-17 16:39:09 --- Created an attachment (id=21859) --> (http://bugs.winehq.org/attachment.cgi?id=21859) wine-1.1.23-305-g4b0a6a1 +menu
HTH
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #11 from Rein Klazes wijn@online.nl 2009-06-18 03:54:32 --- Created an attachment (id=21868) --> (http://bugs.winehq.org/attachment.cgi?id=21868) lzma'd tail of +menu,+shdocvw,+heap,+seh,+tid,+relay trace
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #12 from Rein Klazes wijn@online.nl 2009-06-18 03:56:04 ---
Hmm, I was hoping for a WINEDEBUG=+tid,+seh,+relay,+menu trace.
Nevertheless, the menu calls are completely different from the previous, sufficient proof that it is not the menu code that causes the problem.
Now , I managed to get it running. It does not crash, probably becauseI don't stream. Yet with +heap (and a little patience) we do get a crash closing the app.
Last million of +menu,+shdocvw,+heap,+seh,+tid,+relay , lzma'd is attached.
Hilite:
0009:Ret window proc 0x4f1c24 (hwnd=0x10058,msg=WM_NCDESTROY,wp=00000000,lp=00000000) retval=00000000 0009:trace:heap:RtlFreeHeap (0x110000,00000002,0x20f8a8): returning TRUE 0009:Ret user32.DestroyWindow() retval=00000001 ret=004f153a 0009:trace:shdocvw:WebBrowser_Release (0x20f950) ref=0 0009:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7d4668c2 ip=7d4668c2 tid=0009 0009:trace:seh:raise_exception info[0]=00000000 0009:trace:seh:raise_exception info[1]=aaaaaab2 0009:trace:seh:raise_exception eax=aaaaaaaa ebx=7d4841d4 ecx=00000000 edx=06c457cc esi=0020f9f0 edi=0020f950 0009:trace:seh:raise_exception ebp=0032eff4 esp=0032efdc cs=0073 ds=007b es=007b fs=0033 gs=003b flags=00010206
...
Unhandled exception: page fault on read access to 0xaaaaaab2 in 32-bit code (0x7d4668c2). Register dump: CS:0073 SS:007b DS:007b ES:007b FS:0033 GS:003b EIP:7d4668c2 ESP:0032efdc EBP:0032eff4 EFLAGS:00010206( R- -- I - -P- ) EAX:aaaaaaaa EBX:7d4841d4 ECX:00000000 EDX:06c457cc ESI:0020f9f0 EDI:0020f950 Stack dump: 0x0032efdc: 06c457cc 00000001 00000001 0032f008 0x0032efec: 7d4841d4 00000000 0032f024 7d479a9c 0x0032effc: 0020f9f0 7d48feb4 7d47fb59 7d47c34a 0x0032f00c: 0020f950 00000000 00000001 0048f5c0 0x0032f01c: 06c45570 01ab3848 0032f050 00502a20 0x0032f02c: 0020f950 389ac8c0 01ab3848 00000000 Backtrace: =>0 0x7d4668c2 DocHost_Release+0x22(This=0x20f9f0) [/home/rein/winedev/wine/dlls/shdocvw/dochost.c:534] in shdocvw (0x0032eff4) 1 0x7d479a9c WebBrowser_Release+0x5c(iface=<register EDI not in topmost frame>) [/home/rein/winedev/wine/dlls/shdocvw/webbrowser.c:161] in shdocvw (0x0032f024) 2 0x00502a20 in slingplayer (+0x102a20) (0x0032f050) 3 0x0046a416 in slingplayer (+0x6a416) (0x0032f05c) 4 0x00477a88 in slingplayer (+0x77a88) (0x0032f068) 5 0x00477c0f in slingplayer (+0x77c0f) (0x0032f074) 6 0x0048f407 in slingplayer (+0x8f407) (0x0032f090) 7 0x0048f5cf in slingplayer (+0x8f5cf) (0x0032f09c) 8 0x004f3718 in slingplayer (+0xf3718) (0x0032f130) 9 0x004ef05a in slingplayer (+0xef05a) (0x0032f150) 10 0x004f1bcb in slingplayer (+0xf1bcb) (0x0032f1b8) 11 0x004f1c5a in slingplayer (+0xf1c5a) (0x0032f1d8) 12 0x7ee2a94a WINPROC_wrapper+0x1a() in user32 (0x0032f208) 13 0x7ee2c13a call_window_proc+0x6a(hwnd=<register EDI not in topmost frame>, msg=<register ESI not in topmost frame>, wp=0, lp=0, result=0x32f2dc, arg=0x4f1c24) [/home/rein/winedev/wine/dlls/user32/winproc.c:458] in user32 (0x0032f248) 14 0x7ee30367 WINPROC_call_window+0xf7(hwnd=<register EDI not in topmost frame>, msg=2, wParam=0, lParam=0, result=0x32f2dc, unicode=1, mapping=65612) [/home/rein/winedev/wine/dlls/user32/winproc.c:2218] in user32 (0x0032f288) 15 0x7edefcd1 call_window_proc+0x91(hwnd=<register ESI not in topmost frame>, msg=<register EDI not in topmost frame>, wparam=0, lparam=0, unicode=1, same_thread=1, mapping=65612) [/home/rein/winedev/wine/dlls/user32/message.c:1634] in user32 (0x0032f2e8) 16 0x7edf4675 send_message+0x1d5(info=<register EDI not in topmost frame>, res_ptr=0x32f384, unicode=1) [/home/rein/winedev/wine/dlls/user32/message.c:2483] in user32 (0x0032f348) 17 0x7edf4b8c SendMessageW+0x4c(hwnd=0x1004c, msg=2, wparam=0, lparam=0) [/home/rein/winedev/wine/dlls/user32/message.c:2604] in user32 (0x0032f388) ...
The 'aaaaaaaa' data visible in the trace and the debugger output is the result from tracing with +heap. It shows that free'd memory is being used. It shows also that it happens in shdocvw.
Hopefully someone with knowledge of this stuff can have a look.
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #13 from Ken Sharp kennybobs@o2.co.uk 2009-06-18 13:19:06 --- My trace shows the same page fault as all the other traces.
Backtrace: =>0 0x7d4668c2 DocHost_Release+0x22(This=0x20f9f0) [/home/rein/winedev/wine/dlls/shdocvw/dochost.c:534] in shdocvw (0x0032eff4) 1 0x7d479a9c WebBrowser_Release+0x5c(iface=<register EDI not in topmost frame>) [/home/rein/winedev/wine/dlls/shdocvw/webbrowser.c:161] in shdocvw (0x0032f024)
That is something different altogether. I have never seen this.
The menus work fine if you're not streaming, it's when you're streaming that the page fault occurs.
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #14 from Rein Klazes wijn@online.nl 2009-06-19 02:03:32 --- (In reply to comment #13)
My trace shows the same page fault as all the other traces.
Is that with +heap tracing enabled?
Backtrace:
...
That is something different altogether. I have never seen this.
+heap tracing does that kind of thing. If you reported correctly "A +heap trace takes too long to get anywhere", that is probably why you did not see it.
The menus work fine if you're not streaming, it's when you're streaming that the page fault occurs.
I see 'your' crash here as well (not using +heap tracing) w.o. streaming. With slingplayer to the left, it reliably crashes in RtlFreeHeap or RtlAllocateHeap when choosing exit through the main menu. So far I haven't seen any evidence that the menu code itself is the cause.
http://bugs.winehq.org/show_bug.cgi?id=18542
--- Comment #15 from Ken Sharp kennybobs@o2.co.uk 2009-06-19 06:38:24 --- You're right, I doubt the menu code is the cause either, that's just a way to trigger it. It can be triggered in a number of ways, but it is clearly a memory allocation problem, as you have said.
http://bugs.winehq.org/show_bug.cgi?id=18542
Ken Sharp kennybobs@o2.co.uk changed:
What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |minor
--- Comment #16 from Ken Sharp kennybobs@o2.co.uk 2009-07-08 12:20:31 --- Workaround found in an unexpected place: winetricks ie6 Will update further when I know more details.
http://bugs.winehq.org/show_bug.cgi?id=18542
Ken Sharp kennybobs@o2.co.uk changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED
--- Comment #17 from Ken Sharp kennybobs@o2.co.uk 2010-06-07 20:52:03 --- No longer occurs in SlingPlayer in latest git. Turbo Lister has a regression bug which I'll bisect later, but it stands to reason this bug should be fixed for that also.
http://bugs.winehq.org/show_bug.cgi?id=18542
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #18 from Alexandre Julliard julliard@winehq.org 2010-06-11 12:51:26 --- Closing bugs fixed in 1.2-rc3.
-
wine-bugs＠winehq.org