https://bugs.winehq.org/show_bug.cgi?id=45473
Bug ID: 45473 Summary: Rogue Squadron 3D crashes on startup Product: Wine Version: 3.12 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: directx-dsound Assignee: wine-bugs@winehq.org Reporter: leslie_alistair@hotmail.com Distribution: ---
Created attachment 61818 --> https://bugs.winehq.org/attachment.cgi?id=61818 Dont destroy secondarybuffer in IDirectSoundNotify
Rogue Squadron 3D crashes on startup unless native dsound is used
https://bugs.winehq.org/show_bug.cgi?id=45473
Alistair Leslie-Hughes leslie_alistair@hotmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |patch
--- Comment #1 from Alistair Leslie-Hughes leslie_alistair@hotmail.com --- The attached patch stop the buffer from being destroyed in the IDirectSoundNotify, which doesn't make sense. However this patches keeps a extra numIfaces incremented so what warnings do appear in the log file but secondarybuffer_destroy is called once the primary buffer is deleted.
The basic code
Create IDirectSoundBuffer IDirectSoundBuffer->QI (IDirectSoundNotify )
Set SetNotificationPositions
... Play something.
On final Notification Release IDirectSoundNotify. At which point the secondary buffer is destroyed and which crashes the mixer thread.
https://bugs.winehq.org/show_bug.cgi?id=45473
Michael Stefaniuc mstefani@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mstefani@winehq.org
--- Comment #2 from Michael Stefaniuc mstefani@winehq.org --- Created attachment 61822 --> https://bugs.winehq.org/attachment.cgi?id=61822 Don't destroy primary buffer in IDirectSoundNotify_Release()
If the mixer dies that means the primary buffer was destroyed. It looks like IDirectSoundNotify_Release() was missed in commit f0be44c82dca8760c787576e1bdf76383bac3ee7. Please try this patch to confirm my assumption.
https://bugs.winehq.org/show_bug.cgi?id=45473
--- Comment #3 from Alistair Leslie-Hughes leslie_alistair@hotmail.com --- (In reply to Michael Stefaniuc from comment #2)
Created attachment 61822 [details] Don't destroy primary buffer in IDirectSoundNotify_Release()
If the mixer dies that means the primary buffer was destroyed. It looks like IDirectSoundNotify_Release() was missed in commit f0be44c82dca8760c787576e1bdf76383bac3ee7. Please try this patch to confirm my assumption.
No, with this patch, it still crashes.
https://bugs.winehq.org/show_bug.cgi?id=45473
--- Comment #4 from Alistair Leslie-Hughes leslie_alistair@hotmail.com --- Created attachment 61825 --> https://bugs.winehq.org/attachment.cgi?id=61825 +dsound log
https://bugs.winehq.org/show_bug.cgi?id=45473
--- Comment #5 from Michael Stefaniuc mstefani@winehq.org --- Interesting, it really is a secondary buffer. And the AddRef and Release calls are balanced. The secondary buffer count though drops to 0. I wonder if we have an assumption that we always have a secondary buffer attached to the mixer.
https://bugs.winehq.org/show_bug.cgi?id=45473
Andrew Eikum aeikum@codeweavers.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aeikum@codeweavers.com
--- Comment #6 from Andrew Eikum aeikum@codeweavers.com --- I don't think the mixer thread is involved. Just glancing through the comments and the log, it looks like the object is being destroyed on thread 0074 while it is being used on thread 0070:
0070:trace:dsound:IDirectSoundBufferImpl_GetCurrentPosition playpos = 237256, writepos = 238136, buflen=705600 (0x16a950, time=40528520) 0074:trace:dsound:IDirectSoundNotifyImpl_Release (0x16a950) ref is now 0 0074:trace:dsound:DirectSoundDevice_RemoveBuffer (0x15c4b8, 0x16a950) 0074:trace:dsound:DirectSoundDevice_RemoveBuffer buffer count is now 0 0074:trace:dsound:secondarybuffer_destroy (0x16a950) released 0074:trace:dsound:IDirectSoundBufferImpl_Release (0x16a950) ref is now 0 wine: Unhandled page fault on read access to 0x00000024 at address 0x59729f (thread 0070), starting debugger... Backtrace: =>0 0x0059729f in rogue squadron (+0x19729f) (0x021efea0) 1 0x00597618 in rogue squadron (+0x197617) (0x021efed0) 2 0x00597869 in rogue squadron (+0x197868) (0x021efedc) 3 0x7bc88be8 call_thread_func_wrapper+0xb() in ntdll (0x021efeec) 4 0x7bc8bf99 call_thread_func+0xcb() [/home/alesliehughes/source/wine-alesliehughes/dlls/ntdll/signal_i386.c:2772] in ntdll (0x021effdc) 5 0x7bc88bda call_thread_entry+0x9() in ntdll (0x021effec)
Thread 0070 isn't the mixer thread, it's some game thread (the mixer thread is 006f). It looks like a use-after-free error in the game. Possibly we're missing a reference that we should be holding, or the game is looking for some notification of destruction that we're never sending. I'd write a test duplicating this behavior on native, checking refcount values and notify callback behavior.
https://bugs.winehq.org/show_bug.cgi?id=45473
Michael Stefaniuc mstefani@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Attachment #61822|0 |1 is obsolete| |
--- Comment #7 from Michael Stefaniuc mstefani@winehq.org --- Comment on attachment 61822 --> https://bugs.winehq.org/attachment.cgi?id=61822 Don't destroy primary buffer in IDirectSoundNotify_Release()
Patch is wrong as a primary buffer doesn't supports IDirectSoundNotify interface.
https://bugs.winehq.org/show_bug.cgi?id=45473
Alistair Leslie-Hughes leslie_alistair@hotmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Fixed by SHA1| |9a258c5dd7e45fb37e15a6ba697 | |34544318303f2 Resolution|--- |FIXED
--- Comment #8 from Alistair Leslie-Hughes leslie_alistair@hotmail.com --- Fixed by https://source.winehq.org/git/wine.git/?a=commit;h=9a258c5dd7e45fb37e15a6ba6...
https://bugs.winehq.org/show_bug.cgi?id=45473
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #9 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 4.2.
https://bugs.winehq.org/show_bug.cgi?id=45473
Michael Stefaniuc mstefani@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |4.0.x
https://bugs.winehq.org/show_bug.cgi?id=45473
Michael Stefaniuc mstefani@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|4.0.x |---
--- Comment #10 from Michael Stefaniuc mstefani@winehq.org --- Removing the 4.0.x milestone from bug fixes included in 4.0.1.
-
wine-bugs＠winehq.org