Crash in MSG_PeekHardwareMsg

[Uwe Bonnes]

Hallo,

the archive viewer "start.exe" for the CDROM archive of german magazine CT
crashes since some time:

085a8b90:Ret  USER.114: DISPATCHMESSAGE() retval=0x00000000 ret=02ef:005c ds=033f
085a8b90:Call USER.108: GETMESSAGE(0x033fd1be,0x0000,0x0000,0x0000) ret=02ef:4055 ds=033f
fixme:pthread_kill_other_threads_np
...
Unhandled exception: page fault on read access to 0xffff0203
 in 32-bit code (0x40a1718f).
In 32-bit mode.
0x40a1718f (MSG_PeekHardwareMsg+0x4f [message.c:595] in libkeyboard.so): repe movsl     (%esi),%
es:(%edi)
597             nextqmsg = qmsg->nextMsg;
Wine-dbg>bt
Backtrace:
=>0 0x40a1718f (MSG_PeekHardwareMsg+0x4f(msg=0x40d26d28, hwnd=0x0, first=0x0, last=0x0, remove=0x1) [message.c:595] in libkeyboard.so) (ebp=40d26cbc)
  1 0x40a17faf (MSG_PeekMessage+0x30f(type=0x0, msg_out=0x40d26d84, hwnd=0x0, first=0x0, last=0x0, flags=0x1, peek=0x0) [message.c:1187] in libkeyboard.so) (ebp=40d26d44)
  2 0x40a185d7 (GetMessage32_16+0x67(msg16_32=0x33fd1be, hWnd=0x0, first=0x0, last=0x0, wHaveParamHigh=0x0) [message.c:1468] in libkeyboard.so) (ebp=40d26da0)
  3 0x40a186b0 (GetMessage16+0x30(msg=0x33fd1be, hwnd=0x0, first=0x0, last=0x0) [message.c:1491] in libkeyboard.so) (ebp=40d26dc0)
  4 0x409c6e20 (USER_CallFrom16_p_word_lwww+0x30(proc=0x40a18680, args=0x404690a4) [user.spec.c:213] in libkeyboard.so) (ebp=40d26ddc)
  5 0x4008d7ae (__wine_call_from_16_word+0x8e [asmrelay.s] in libntdll.so) (ebp=40d26e0c)
  6 0x02ef:0x4055 (bp=d1ec)
  7 0x02ef:0x4240 (bp=d200)
  8 0x02e7:0x5a11 (bp=d26a)
  9 0x02e7:0x0063 (bp=0000)

Any ideas?

Uwe Bonnes                [e-mail]

Free Software: If you contribute nothing, expect nothing
--

[Rein Klazes]

On Sat, 12 May 2001 20:56:35 +0200, you wrote:
> Hallo,
>
> the archive viewer "start.exe" for the CDROM archive of german magazine CT
> crashes since some time:
>
> 085a8b90:Ret  USER.114: DISPATCHMESSAGE() retval=0x00000000 ret=02ef:005c ds=033f
> 085a8b90:Call USER.108: GETMESSAGE(0x033fd1be,0x0000,0x0000,0x0000) ret=02ef:4055 ds=033f
> fixme:pthread_kill_other_threads_np
> ...
> Unhandled exception: page fault on read access to 0xffff0203
>  in 32-bit code (0x40a1718f).
> In 32-bit mode.
> 0x40a1718f (MSG_PeekHardwareMsg+0x4f [message.c:595] in libkeyboard.so): repe movsl     (%esi),%
> es:(%edi)
> 597             nextqmsg = qmsg->nextMsg;
> Wine-dbg>bt
> Backtrace:
> =>0 0x40a1718f (MSG_PeekHardwareMsg+0x4f(msg=0x40d26d28, hwnd=0x0, first=0x0, last=0x0, remove=0x1) [message.c:595] in libkeyboard.so) (ebp=40d26cbc)

Dutch tax 2000 declaration setup program crashes at exactly the same
point. Cause of this seems to be some memory allocation/corruption
problem. At some point the memory used by the sysMsgQueue, is
allocated again by some HeapAlloc() and happily used by its requester.

I haven't found out why unfortunately.

Rein.