[Bug 47748] New: Phobos 1953 crashes at launch

https://bugs.winehq.org/show_bug.cgi?id=47748

Bug ID: 47748
           Summary: Phobos 1953 crashes at launch
           Product: Wine
           Version: 4.15
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: minor
          Priority: P2
         Component: msvcrt
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 65230
  --> https://bugs.winehq.org/attachment.cgi?id=65230
backtrace

fixme:msvcp:_Locinfo__Locinfo_ctor_cat_cstr (0032DB9C 1 C) semi-stub
err:msvcrt:MSVCRT__invalid_parameter (null):0 (null): (null) 0

Installing native VC++ 2005 helps.

It may also be necessary to create an empty full.fx file in
'GameFolder\Data\effect'

wine-4.15-104-g765815729f

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

Andrey Gusev  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Phobos 1953 crashes at      |Multiple games crash at
                   |launch                      |launch with builtin msvcp80
                   |                            |(Phobos 1953, Steel Fury
                   |                            |Kharkov 1942)

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #1 from Andrey Gusev  ---
Created attachment 70516
  --> https://bugs.winehq.org/attachment.cgi?id=70516
+msvcrt,+msvcp

wine-6.15-156-g17ba916c564

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

Bartosz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Bartosz  ---
The Steel Fury: Kharkov 1942 - final - Demo could be downloaded from:
https://www.gry-online.pl/S030.asp?ID=17631

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #3 from Bartosz  ---
The game Steel Fury Kharkov 1942 is working perfectly fine without any
workaround.

It is worth to notice that the missing _Locinfo__Locinfo_ctor_cat_cstr function
was already implemented:

https://gitlab.winehq.org/wine/wine/-/blob/master/dlls/msvcp90/locale.c#L515

The bug should be closed as fixed.

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #4 from Andrey Gusev  ---
Created attachment 75362
  --> https://bugs.winehq.org/attachment.cgi?id=75362
backtrace (8.19-74-g0170cd3a4c6)

It's still valid.

Backtrace from a full version of Steel Fury Kharkov 1942.

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #5 from Bartosz  ---
Created attachment 75379
  --> https://bugs.winehq.org/attachment.cgi?id=75379
Unselected options

Under Wine 8.19 I unselected all options (see screenshot), and installed game.
After run with:
  $ wine starter.exe

I see a lot of warnings like:

10199.532:0114:fixme:msvcp:locale__Locimp__Makeushloc (0053F3E8 3 016A2AD0
00000000) semi-stub
  10199.532:0114:fixme:msvcp:locale_operator_assign (0053FCB8 0053F4EC) stub
  10199.806:0114:fixme:system:NtUserSystemParametersInfo Unimplemented action:
59

(SPI_SETSTICKYKEYS)10228.265:011c:fixme:msvcrt:__clean_type_info_names_internal
(01C5CD88) stub

but the game is working correctly.
In which moment the game is crashing?

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #6 from Bartosz  ---
It is strange that the game is crashing on TRACE display.
Can you remove line dlls/msvcp90/string.c:658

TRACE("%p %p %Iu %Iu\n", this, assign, pos, len);

and check what will happen?

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #7 from Andrey Gusev  ---
Created attachment 75384
  --> https://bugs.winehq.org/attachment.cgi?id=75384
+msvcp

Demo doesn't reproduce this crash.

Removing the trace output gives a crash with condition below.
> > if(assign->size < pos)

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #8 from Bartosz  ---
The `assign` pointer have suspicious value here (`FFFFFFE4`).

Could you please confirm that changing TRACE from:
  TRACE("%p %p %Iu %Iu\n", this, assign, pos, len); 
to 
  TRACE("%p %Iu %Iu\n", this, pos, len);

will not crash it anymore on TRACE (but in next command)?

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #9 from Andrey Gusev  ---
Now it crashes on TRACE("%p %Iu %Iu\n", this, pos, len);

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #10 from Bartosz  ---
Can you check which variables is causing crash in TRACE?

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

Zeb Figura  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #11 from Zeb Figura  ---
Line numbers in backtraces cannot be taken at face value. In general it should
be rather suspicious if a trace like that is crashing, and in fact it's not.
It's actually the next line that's crashing, when we try to dereference
"assign".

You can tell this for sure by looking at the disassembly. Actually objdump
correctly reports the line for me, so our dwarf parsing is probably broken.

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #12 from Bartosz  ---
Thanks Zeb for a tip.

Maybe with reach of 2/4GB of allocated memory, which is the limit of 32bit
architecture?

I suspect this message is explain that (from
https://bugs.winehq.org/attachment.cgi?id=75362):

Unhandled exception: page fault on read access to 0xfffffff8 in wow64 32-bit
code (0x700305ee).

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #13 from Zeb Figura  ---
(In reply to Bartosz from comment #12)
> Maybe with reach of 2/4GB of allocated memory, which is the limit of 32bit
> architecture?

I'm sorry, I don't understand what this sentence means.

I don't think that "assign" is a valid pointer, though.

[Bug 47748] Multiple games crash at launch with builtin msvcp80 (Phobos 1953, Steel Fury Kharkov 1942)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47748

--- Comment #14 from Nikolay Sivov  ---
It appears in MSVCP_basic_string_char_copy_ctor() first, maybe we have a wrong
prototype somewhere.