[Bug 20198] New: Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

Summary: Help icon crashes Internet Explorer 7
           Product: Wine
           Version: 1.1.30
          Platform: PC
               URL: http://www.wine-reviews.net/wine-reviews/applications/
                    ie-7-on-linux-with-wine.html
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

Created an attachment (id=23816)
 --> (http://bugs.winehq.org/attachment.cgi?id=23816)
Gzipped wine default console output

If you hover over the help icon (ALT+l) of IE7 for more than a second the
browser crashes.

Replicated with 1.1.30~winehq0~ubuntu~9.04-0ubuntu1 and
1.1.29~winehq0~ubuntu~9.04-0ubuntu1 .
With 1.0.1-2 the IE7 does not start at all...

I used the HOWTO on
http://www.wine-reviews.net/wine-reviews/applications/ie-7-on-linux-with-win...
to install the IE7.

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

--- Comment #1 from Vitaliy Margolen   2009-09-29 01:07:52 ---
Install Wine debug symbols and attach backtrace again. If you can't find debug
symbols, compile Wine from source.

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

--- Comment #2 from Per Hansen   2009-09-29 06:23:22 ---
Created an attachment (id=23825)
 --> (http://bugs.winehq.org/attachment.cgi?id=23825)
Gzipped wine relay console output tail

Gzipped wine relay console output tail
(removed the first 500000 lines because the filesize was 388MB)

LANG=C WINEDEBUG=+relay WINEPREFIX=/home/someuser/.wine_ie7 wine
/home/someuser/.wine_ie7/drive_c/Program\ Files/Internet\ Explorer/iexplore.exe
2> wine_ie7_helpicon_crash_relay.txt

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

--- Comment #3 from Per Hansen   2009-09-29 06:34:52 ---
Created an attachment (id=23826)
 --> (http://bugs.winehq.org/attachment.cgi?id=23826)
Gzipped wine default console output with symbols

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

Vitaliy Margolen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|-unknown                    |comctl32

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

--- Comment #4 from Juan Lang   2009-09-29 11:01:05 ---
> From your log:

Unhandled exception: page fault on read access to 0x00000000 in 32-bit code
(0x7e8952e8).
(snip)
=>0 0x7e8952e8 TOOLBAR_TTGetDispInfo+0x3ba(infoPtr=0x1c45e0, lpnmtdi=0x32da90)
[/mnt/ramdisk/wine-1.1.30~winehq1/dlls/comctl32/toolbar.c:6159] in comctl32
(0x0032d7d8)
(snip)
0x7e8952e8 TOOLBAR_TTGetDispInfo+0x3ba
[/mnt/ramdisk/wine-1.1.30~winehq1/dlls/comctl32/toolbar.c:6159] in comctl32:
movzbl    0x0(%eax),%eax

The odd thing is, looking at the code, line 6159 of toolbar.c is:
        else if (tbgit.pszText[0])
tbgit.pszText is assigned earlier on line 6136:
        tbgit.pszText = szBuffer;
and both szBuffer and tbgit are allocated on the stack, on lines 6129-30:
        CHAR szBuffer[INFOTIPSIZE+1];
        NMTBGETINFOTIPA tbgit;
So what's NULL, I wonder?

Maybe a +toolbar log would help.

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

--- Comment #5 from Nikolay Sivov   2009-09-29 11:20:24 ---
(In reply to comment #4)
> From your log:
>
> =>0 0x7e8952e8 TOOLBAR_TTGetDispInfo+0x3ba(infoPtr=0x1c45e0, lpnmtdi=0x32da90)
> The odd thing is, looking at the code, line 6159 of toolbar.c is:
>         else if (tbgit.pszText[0])

Maybe it's altered during notification:

---
TOOLBAR_SendNotify(&tbgit.hdr, infoPtr, TBN_GETINFOTIPA);
---

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

Per H.  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #23816|0                           |1
        is obsolete|                            |

--- Comment #6 from Per H.   2009-09-29 17:35:30 ---
Created an attachment (id=23843)
 --> (http://bugs.winehq.org/attachment.cgi?id=23843)
Gzipped wine toolbar console output

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

--- Comment #7 from Juan Lang   2009-09-29 18:46:19 ---
(In reply to comment #5)
> Maybe it's altered during notification:
> TOOLBAR_SendNotify(&tbgit.hdr, infoPtr, TBN_GETINFOTIPA);

Nikolay was right.  From the +toolbar log:
trace:toolbar:TOOLBAR_SendNotify to window 0x100b0, code=fffffd32, via ANSI
trace:toolbar:TOOLBAR_TTGetDispInfo TBN_GETINFOTIPA - got string (null)

So, TBN_GETINFOTIPA/W apparently needs to handle pszText getting set to NULL. 
Tests needed, of course.

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|[e-mail]        |[e-mail]

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download, patch

--- Comment #8 from Nikolay Sivov   2010-03-01 16:00:09 ---
Patch sent:

http://www.winehq.org/pipermail/wine-patches/2010-March/085380.html

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED

--- Comment #9 from Nikolay Sivov   2010-03-02 10:58:21 ---
Should be fixed with 006362567b8651d70f8c54075f532c1c05a5065b.

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #10 from Alexandre Julliard   2010-03-05 12:43:11 ---
Closing bugs fixed in 1.1.40.

[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |006362567b8651d70f8c54075f5
                   |                            |32c1c05a5065b

[Bug 20198] Help icon crashes Internet Explorer 7

https://bugs.winehq.org/show_bug.cgi?id=20198

Nikolay Sivov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|[e-mail]        |[e-mail]