https://bugs.winehq.org/show_bug.cgi?id=47222
Bug ID: 47222 Summary: Wine Staging have bug inserted in version 4.7 - WotLauncher.exe will crash (WorldOfTanks) immediattely Product: Wine-staging Version: 4.7 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs@winehq.org Reporter: xkendy@gmail.com CC: leslie_alistair@hotmail.com, z.figura12@gmail.com Distribution: ---
Created attachment 64491 --> https://bugs.winehq.org/attachment.cgi?id=64491 Log from console with WINEDEBUG=all
My configuration:
NVIDIA Driver Version: 430.14 uname -a Linux 4.15.0-50-generic #54-Ubuntu SMP Mon May 6 18:46:08 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux UBUNTU 18.04 LTS 64bit Wine 32bit version For DirectX acceleration I'm using DXVK (https://haagch.frickel.club/files/dxvk/latest/32/bin/) Vulkan SDK (Windows version): 1.1.92.1
I normally playing WorldOfTanks (WOT) with Wine Staging 4.6. Begining from version 4.7 (4.8 have this same bug) have wine bug. Seems to be caused by some patch applied to version 4.7.
Description of bug: If I run wine WotLauncher.exe then game wont start and produce errors in console (log attached in this bugreport)
For fix I must downgrade to wine version 4.6. For now is downgrade ok, but for future -> using old version, is not right way.
Regards
Martin
https://bugs.winehq.org/show_bug.cgi?id=47222
xkendy@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Distribution|--- |Ubuntu
https://bugs.winehq.org/show_bug.cgi?id=47222
--- Comment #1 from Zebediah Figura z.figura12@gmail.com --- The fact that heap validation fails that early is concerning, but does not reveal anything interesting about the application in question. Can you please attach normal console output?
Does the application run with plain Wine 4.6? If so, does the same failure appear in plain Wine 4.7? Otherwise, is it known which Staging patches are necessary to make the application run?
https://bugs.winehq.org/show_bug.cgi?id=47222
--- Comment #2 from xkendy@gmail.com --- Created attachment 64494 --> https://bugs.winehq.org/attachment.cgi?id=64494 Log from console without WINEDEBUG=-all
Normal (working) run (with version 4.6 staging) will produce this stdout into the console.
I'll try this versions:
4.6 staging => working 4.7 staging => doesn't work, immediatelly crash 4.8 staging => doesn't work, immediatelly crash
4.7 (devel) => runs, doesn't crash 4.8 (devel) => runs, doesn't crash
https://bugs.winehq.org/show_bug.cgi?id=47222
--- Comment #3 from xkendy@gmail.com --- I'm sorry, I don't know which new or modified patch in the version 4.7 is causing this error, because I install wine-staging from repository (apt install),
https://bugs.winehq.org/show_bug.cgi?id=47222
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |focht@gmx.net URL| |https://web.archive.org/web | |/20190519001422/https://wds | |.gcdn.co/wgc/releases_tTrHg | |LCKHBRiaL/wgc_19.02.00.4533 | |_eu/world_of_tanks_install_ | |eu.exe?enctid=btqajpza7w9m& | |enctid=btqajpza7w9m Keywords| |download Summary|Wine Staging have bug |World of Tanks 1.5.0 |inserted in version 4.7 - |launcher 'WotLauncher.exe' |WotLauncher.exe will crash |(0.3.x) crashes with |(WorldOfTanks) immediattely |Wine-Staging 4.7 Status|UNCONFIRMED |NEW Ever confirmed|0 |1
--- Comment #4 from Anastasius Focht focht@gmx.net --- Hello folks,
confirming.
--- snip --- $ wine --version wine-4.8-830-g82832c0c2c (Staging)
$ pwd /home/focht/wine-games/wineprefix64-wargaming/drive_c/Games/World_of_Tanks
$ WINEDEBUG=+seh,+relay,+mshtml,+jscript wine ./WoTLauncher.exe >>log.txt 2>&1 ... 00f9:trace:jscript:interp_add str(L"on") + str(L"unload") ... 00f9:trace:jscript:interp_ident L"J" ... 00f9:trace:jscript:identifier_eval L"J" ... 00f9:trace:jscript:jsdisp_get_id not found L"J" 00f9:trace:jscript:identifier_eval returning ref 68 for 2 00f9:trace:jscript:interp_call_member 2 0 ... 00f9:trace:mshtml:HTMLWindow2_QueryInterface (0x142cdb8)->(IID_IDispatchEx 0x34f0f8) 00f9:trace:mshtml:HTMLWindow2_AddRef (0x142cdb8) ref=16 00f9:trace:mshtml:WindowDispEx_InvokeEx (0x142cdb8)->(800101fb 409 1 0x34f110 (nil) 0x1431c2c 0x1431d30) 00f9:trace:mshtml:DispatchEx_InvokeEx (0x142cdf4)->(800101fb 409 1 0x34f110 (nil) 0x1431c2c 0x1431d30) 00f9:trace:mshtml:HTMLWindow2_QueryInterface (0x142cdb8)->(IID_IHTMLWindow3 0x34ee0c) 00f9:trace:mshtml:HTMLWindow2_AddRef (0x142cdb8) ref=17 00f9:Call oleaut32.DispCallFunc(0142cdbc,00000024,00000004,0000000a,00000003,0143a068,0034ee40,0034ee30) ret=7abe4a3d 00f9:Call ntdll.RtlAllocateHeap(00110000,00000000,00000038) ret=7cae6439 00f9:Ret ntdll.RtlAllocateHeap() retval=014a4c98 ret=7cae6439 ... 00f9:trace:mshtml:HTMLWindow3_attachEvent (0x142cdb8)->(L"onunload" 0x150f8d8 0x34ed58) ... 00f9:fixme:mshtml:get_listener_container unimplemented event L"unload" 00f9:Call ntdll.RtlAllocateHeap(00110000,00000000,00000026) ret=7ac25440 00f9:Ret ntdll.RtlAllocateHeap() retval=014a4cd8 ret=7ac25440 ... 00f9:trace:mshtml:ensure_doc_nsevent_handler L"unload" 00f9:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7ac29d92 00f9:Ret ntdll.RtlAllocateHeap() retval=014a4d08 ret=7ac29d92 00f9:Call ntdll.RtlFreeHeap(00110000,00000000,014a4c98) ret=7cae67a1 00f9:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7cae67a1 00f9:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7bcb49d7 ip=7bcb49d7 tid=00f9 00f9:trace:seh:raise_exception info[0]=00000000 00f9:trace:seh:raise_exception info[1]=13131406 00f9:trace:seh:raise_exception eax=131313f2 ebx=00001313 ecx=0034ed3c edx=131313f2 esi=80020010 edi=131313f2 00f9:trace:seh:raise_exception ebp=0034ffc8 esp=0034ffa0 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010202 00f9:trace:seh:call_stack_handlers calling handler at (nil) code=c0000005 flags=0 --- snip ---
Using debugger to avoid the useless crash reporter...
--- snip --- $ winedbg --gdb ./WoTLauncher.exe
...
Thread 1 received signal SIGSEGV, Segmentation fault. 0x7acc2dd8 in attach_event (event_target=0x140e24c, name=0x147e40c, disp=0x14fa128, res=0x7ca79439 <DispCallFunc+121>) at /home/focht/projects/wine/staging-src-4.8/dlls/mshtml/htmlevent.c:3071 3071 *res = VARIANT_TRUE;
Wine-gdb> bt #0 0x7acc2dd8 in attach_event (event_target=0x140e24c, name=0x147e40c, disp=0x14fa128, res=0x7ca79439 <DispCallFunc+121>) at /home/focht/projects/wine/staging-src-4.8/dlls/mshtml/htmlevent.c:3071 #1 0x7ad1bcee in HTMLWindow3_attachEvent (iface=<optimized out>, event=<optimized out>, pDisp=<optimized out>, pfResult=<optimized out>) at /home/focht/projects/wine/staging-src-4.8/dlls/mshtml/htmlwindow.c:1712 #2 0x7ca61182 in call_method () from /home/focht/projects/wine/staging-install-4.8-x86_64/bin/../lib/wine/oleaut32.dll.so #3 0x7ca79888 in DispCallFunc (pvInstance=<optimized out>, oVft=<optimized out>, cc=<optimized out>, vtReturn=<optimized out>, cActuals=<optimized out>, prgvt=<optimized out>, prgpvarg=<optimized out>, pvargResult=<optimized out>) at /home/focht/projects/wine/staging-src-4.8/dlls/oleaut32/typelib.c:6866 #4 0x7ac7da3d in invoke_builtin_function (func=0x1505ef0, dp=0x32f190, res=0x0, caller=0x141dfe0, This=<optimized out>) at /home/focht/projects/wine/staging-src-4.8/dlls/mshtml/dispex.c:1212 #5 0x7ac81e59 in DispatchEx_InvokeEx (iface=<optimized out>, id=<optimized out>, lcid=<optimized out>, wFlags=<optimized out>, pdp=<optimized out>, pvarRes=<optimized out>, pei=<optimized out>, pspCaller=<optimized out>) at /home/focht/projects/wine/staging-src-4.8/dlls/mshtml/dispex.c:1263 #6 0x7ad1c4ef in WindowDispEx_InvokeEx (iface=<optimized out>, id=<optimized out>, lcid=<optimized out>, wFlags=<optimized out>, pdp=<optimized out>, pvarRes=<optimized out>, pei=<optimized out>, pspCaller=<optimized out>) at ../../include/dispex.h:319 #7 0x7a356e59 in disp_call (ctx=0x141dea8, disp=0x140e210, id=-2147417605, flags=<optimized out>, argc=<optimized out>, argv=0x148e8e0, ret=0x0) at ../../include/dispex.h:319 #8 0x7a35ac1c in exprval_call (ctx=<optimized out>, ref=<optimized out>, flags=<optimized out>, argc=2, argv=0x148e8e0, r=0x0) at /home/focht/projects/wine/staging-src-4.8/dlls/jscript/engine.c:327 #9 0x7a35e01a in interp_call_member (ctx=0x141dea8) at /home/focht/projects/wine/staging-src-4.8/dlls/jscript/engine.c:124 #10 0x7a361be2 in exec_source (ctx=<optimized out>, flags=1, bytecode=0x1431b58, function=<optimized out>, scope=0x0, this_obj=<optimized out>, function_instance=0x0, variable_obj=0x141e000, argc=0, argv=0x0, r=0x0) at /home/focht/projects/wine/staging-src-4.8/dlls/jscript/engine.c:2810 #11 0x7a36d972 in exec_global_code (code=0x1431b58, This=<optimized out>, This=<optimized out>) at /home/focht/projects/wine/staging-src-4.8/dlls/jscript/jscript.c:112 #12 0x7a36f0ea in JScriptParse_ParseScriptText (iface=<optimized out>, pstrCode=<optimized out>, pstrItemName=<optimized out>, punkContext=<optimized out>, pstrDelimiter=<optimized out>, dwSourceContextCookie=<optimized out>, ulStartingLine=<optimized out>, dwFlags=<optimized out>, pvarResult=<optimized out>, pexcepinfo=<optimized out>) at /home/focht/projects/wine/staging-src-4.8/dlls/jscript/jscript.c:803 #13 0x7ad68a63 in parse_elem_text (text=0x1442328, script_elem=<optimized out>, script_host=<optimized out>) at ../../include/activscp.h:1133 #14 0x7ad693d7 in doc_insert_script (window=0x140e210, script_elem=0x141b1b8, from_parser=1) at /home/focht/projects/wine/staging-src-4.8/dlls/mshtml/script.c:1294 #15 0x7ad2caf8 in run_insert_script (doc=0x1417968, script_iface=0x9c4b950, parser_iface=0x9b41ea8) at /home/focht/projects/wine/staging-src-4.8/dlls/mshtml/mutation.c:348 #16 0x7ad2bb2f in nsRunnable_Run (iface=0x141b198) at /home/focht/projects/wine/staging-src-4.8/dlls/mshtml/mutation.c:597 #17 0x02e0e0a1 in ?? () #18 0x7ad2d228 in nsDocumentObserver_AttemptToExecuteScript (iface=<optimized out>, aContent=<optimized out>, aParser=<optimized out>, aBlock=<optimized out>) at /home/focht/projects/wine/staging-src-4.8/dlls/mshtml/mutation.c:904 #19 0x02ee2592 in ?? () #20 0xb9540000 in ?? () --- snip ---
The working case:
--- snip --- $ wine --version wine-4.6-830-gdf1c5f0212 (Staging)
$ pwd /home/focht/wine-games/wineprefix64-wargaming/drive_c/Games/World_of_Tanks
$ winedbg --gdb ./WoTLauncher.exe
Wine-gdb> b HTMLWindow3_attachEvent Function "HTMLWindow3_attachEvent" not defined. Make breakpoint pending on future shared library load? (y or [n]) y Breakpoint 1 (HTMLWindow3_attachEvent) pending.
Wine-gdb> c Continuing.
Thread 1 hit Breakpoint 1, HTMLWindow3_attachEvent (iface=<optimized out>, event=<optimized out>, pDisp=<optimized out>, pfResult=<optimized out>) at /home/focht/projects/wine/staging-src-4.6/dlls/mshtml/htmlwindow.c:1701 1701 {
Wine-gdb> bt #0 HTMLWindow3_attachEvent (iface=<optimized out>, event=<optimized out>, pDisp=<optimized out>, pfResult=<optimized out>) at /home/focht/projects/wine/staging-src-4.6/dlls/mshtml/htmlwindow.c:1701 #1 0x7caf9762 in call_method () from /home/focht/projects/wine/staging-install-4.6-x86_64/bin/../lib/wine/oleaut32.dll.so #2 0x7cb140ec in DispCallFunc (pvInstance=<optimized out>, oVft=<optimized out>, cc=<optimized out>, vtReturn=<optimized out>, cActuals=<optimized out>, prgvt=<optimized out>, prgpvarg=<optimized out>, pvargResult=<optimized out>) at /home/focht/projects/wine/staging-src-4.6/dlls/oleaut32/typelib.c:6866 #3 0x7cb158cd in ITypeInfo_fnInvoke (iface=<optimized out>, pIUnk=<optimized out>, memid=<optimized out>, wFlags=<optimized out>, pDispParams=<optimized out>, pVarResult=<optimized out>, pExcepInfo=<optimized out>, pArgErr=<optimized out>) at /home/focht/projects/wine/staging-src-4.6/dlls/oleaut32/typelib.c:7492 #4 0x7ad0577a in typeinfo_invoke (This=<optimized out>, func=0x1310460, flags=<optimized out>, dp=0x32f110, res=0x0, ei=0x130b1dc) at ../../include/oaidl.h:1544 #5 0x7ad08d22 in DispatchEx_InvokeEx (iface=<optimized out>, id=<optimized out>, lcid=<optimized out>, wFlags=<optimized out>, pdp=<optimized out>, pvarRes=<optimized out>, pei=<optimized out>, pspCaller=<optimized out>) at /home/focht/projects/wine/staging-src-4.6/dlls/mshtml/dispex.c:1273 #6 0x7adb7c34 in WindowDispEx_InvokeEx (iface=<optimized out>, id=<optimized out>, lcid=<optimized out>, wFlags=<optimized out>, pdp=<optimized out>, pvarRes=<optimized out>, pei=<optimized out>, pspCaller=<optimized out>) at ../../include/dispex.h:319 #7 0x7a4866c1 in disp_call (ctx=0x130b1a8, disp=0x12dd978, id=-2147417605, flags=<optimized out>, argc=<optimized out>, argv=0x1372780, ret=0x0) at ../../include/dispex.h:319 #8 0x7a48a81c in exprval_call (ctx=<optimized out>, ref=<optimized out>, flags=<optimized out>, argc=2, argv=0x1372780, r=0x0) at /home/focht/projects/wine/staging-src-4.6/dlls/jscript/engine.c:327 #9 0x7a48e0b4 in interp_call_member (ctx=0x130b1a8) at /home/focht/projects/wine/staging-src-4.6/dlls/jscript/engine.c:124 #10 0x7a492124 in exec_source (ctx=<optimized out>, flags=1, bytecode=0x131e4c8, function=0x131e4ec, scope=0x0, this_obj=<optimized out>, function_instance=0x0, variable_obj=0x130ced8, argc=0, argv=0x0, r=0x0) at /home/focht/projects/wine/staging-src-4.6/dlls/jscript/engine.c:2810 #11 0x7a49e1f2 in exec_global_code (code=0x131e4c8, This=<optimized out>, This=<optimized out>) at /home/focht/projects/wine/staging-src-4.6/dlls/jscript/jscript.c:112 #12 0x7a49fb9e in JScriptParse_ParseScriptText (iface=<optimized out>, pstrCode=<optimized out>, pstrItemName=<optimized out>, punkContext=<optimized out>, pstrDelimiter=<optimized out>, dwSourceContextCookie=<optimized out>, ulStartingLine=<optimized out>, dwFlags=<optimized out>, pvarResult=<optimized out>, pexcepinfo=<optimized out>) at /home/focht/projects/wine/staging-src-4.6/dlls/jscript/jscript.c:803 #13 0x7ae0bc40 in parse_elem_text (text=<optimized out>, script_elem=<optimized out>, script_host=<optimized out>) at ../../include/activscp.h:1133 #14 0x7ae0c652 in doc_insert_script (window=0x12dd978, script_elem=0x1308ce8, from_parser=1) at /home/focht/projects/wine/staging-src-4.6/dlls/mshtml/script.c:1294 #15 0x7adca1b8 in run_insert_script (doc=0x13053c8, script_iface=0x9736cb8, parser_iface=0x9646050) at /home/focht/projects/wine/staging-src-4.6/dlls/mshtml/mutation.c:348 #16 0x7adc913f in nsRunnable_Run (iface=0x1308cc8) at /home/focht/projects/wine/staging-src-4.6/dlls/mshtml/mutation.c:597 #17 0x6a83e0a1 in ?? () #18 0x7adca996 in nsDocumentObserver_AttemptToExecuteScript (iface=<optimized out>, aContent=<optimized out>, aParser=<optimized out>, aBlock=<optimized out>) at /home/focht/projects/wine/staging-src-4.6/dlls/mshtml/mutation.c:904 #19 0x6a912592 in ?? () #20 0x6cbc0000 in ?? () --- snip ---
If you look closely at the call stacks you see that 'IDispatchEx::InvokeEx' calls 'typeinfo_invoke' in working case vs. 'invoke_builtin_function' in non-working case.
https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/mshtml/dispex.c#l1582
https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/mshtml/dispex.c#l1262
--- snip --- 1262 if(func->call_vtbl_off) 1263 hres = invoke_builtin_function(This, func, dp, res, caller); 1264 else 1265 hres = typeinfo_invoke(This, func, flags, dp, res, ei); 1266 break; --- snip ---
I didn't do a regression test but rather looked at changes in mainline Wine 4.6 vs. 4.7 that might be of relevance here:
https://source.winehq.org/git/wine.git/history/6e3f39a4c59fd529c7b532dcde1bb...
* https://source.winehq.org/git/wine.git/commitdiff/40c74cf33620e7a690c829a3eb... ("mshtml: Support argument type conversion for functions with dual interface return type.")
* https://source.winehq.org/git/wine.git/commitdiff/0a942e5d49908fe918e43d5ed0... ("mshtml: Support argument type conversion for functions with dual interface arguments.")
* https://source.winehq.org/git/wine.git/commitdiff/830c55bcf43c6642194f452b1b... ("mshtml: Support argument type conversion for functions with IDispatch arguments.")
* https://source.winehq.org/git/wine.git/commitdiff/64ff525b6a4536f4cf2b95268e... ("mshtml: Support type conversion in functions with arguments using default values.")
Maybe some ole/typelib patch in Wine-Staging causes breakage here. I didn't look very hard though. Hope that's enough for Zebediah to continue here ;-)
$ sha1sum world_of_tanks_install_eu_btqajpza7w9m.exe 9b708145b9be479514daa2e16ac3f6a89246f8b9 world_of_tanks_install_eu_btqajpza7w9m.exe
$ du -sh world_of_tanks_install_eu_btqajpza7w9m.exe 6.2M world_of_tanks_install_eu_btqajpza7w9m.exe
Regards
https://bugs.winehq.org/show_bug.cgi?id=47222
--- Comment #5 from Zebediah Figura z.figura12@gmail.com --- Is it necessary to download all 12 GB of the game to reproduce this?
https://bugs.winehq.org/show_bug.cgi?id=47222
--- Comment #6 from xkendy@gmail.com --- No it not necessary to download all files. I shared WoTLauncher.exe (+cfg) files here: https://drive.google.com/drive/folders/1vMbtR_wqEUUiFb2z5PmyoL5qUuOCiPBB
Here is simple test for reproduce:
mkdir -p /tmp/testcase/drive_c/Games/World_of_Tanks mv WoTLauncher.exe /tmp/testcase/drive_c/Games/World_of_Tanks/ mv WoTLauncher.cfg /tmp/testcase/drive_c/Games/World_of_Tanks/ export WINEARCH="win32" export WINEPREFIX=/tmp/testcase
And finnaly run: /opt/wine-staging/bin/wine WoTLauncher.exe
In 4.7-staging and 4.8-staging will crash immediately
In 4.6-staging run, but complains for missing files from game (but for test this bug, is this enough)
https://bugs.winehq.org/show_bug.cgi?id=47222
Zebediah Figura z.figura12@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Component|-unknown |mshtml Product|Wine-staging |Wine
--- Comment #7 from Zebediah Figura z.figura12@gmail.com --- The Staging patch that triggers the bug isn't one of the oleaut32 or related patches, and looking at them I would have been surprised. I think it's probably the heap patches. DispCallFunc() reads one past the end of a heap-allocated array func->arg_types. On plain Wine this is garbage, which somehow causes a valid pointer to get passed, but on Staging it's VT_EMPTY, which causes a junk pointer to be passed.
(I'm also not sure why the call stacks are different; the code path taken is the same in both cases.)
I've sent a patch: https://source.winehq.org/patches/data/165046
https://bugs.winehq.org/show_bug.cgi?id=47222
Zebediah Figura z.figura12@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED Fixed by SHA1| |23e0d22b7c8c350b47e76c61121 | |8a4e7ff5ac570
--- Comment #8 from Zebediah Figura z.figura12@gmail.com --- Fixed by https://source.winehq.org/git/wine.git/commitdiff/23e0d22b7c8c350b47e76c611218a4e7ff5ac570.
https://bugs.winehq.org/show_bug.cgi?id=47222
--- Comment #9 from xkendy@gmail.com --- Thank you !
This patch will be included in 4.9-staging version ?
regards
https://bugs.winehq.org/show_bug.cgi?id=47222
--- Comment #10 from Zebediah Figura z.figura12@gmail.com --- (In reply to xkendy from comment #9)
Thank you !
This patch will be included in 4.9-staging version ?
Yes, it will be included in Wine 4.9 and Wine-Staging 4.9.
https://bugs.winehq.org/show_bug.cgi?id=47222
winetest@luukku.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |winetest@luukku.com
--- Comment #11 from winetest@luukku.com --- (In reply to Zebediah Figura from comment #10)
(In reply to xkendy from comment #9)
Thank you !
This patch will be included in 4.9-staging version ?
Yes, it will be included in Wine 4.9 and Wine-Staging 4.9.
Since the change is so small I would suggest to promote this patch to stable series of wine too.
https://bugs.winehq.org/show_bug.cgi?id=47222
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #12 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 4.9.