- wine-gitlab - winehq.org

Re: [PATCH v5 0/3] MR8834: server: Use process_vm_writev / process_vm_readv instead of ptrace when available.
by Paul Gofman (＠gofman) 05 Nov '25

05 Nov '25

So probably the commit to blame is a1627e3c40a747e122ffb4ad22da79977c2eae7e , worked fine with luckier stack layout before. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8834#note_120938

1 0

Re: [PATCH v5 0/3] MR8834: server: Use process_vm_writev / process_vm_readv instead of ptrace when available.
by Rémi Bernon (＠rbernon) 05 Nov '25

05 Nov '25

Yeah info should probably be `vm_region_basic_info_data_64_t` if I understand the `VM_REGION_BASIC_INFO_64` parameter correctly, and changing it to that type fixes the crash. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8834#note_120936

1 0

Re: [PATCH v5 0/3] MR8834: server: Use process_vm_writev / process_vm_readv instead of ptrace when available.
by Paul Gofman (＠gofman) 05 Nov '25

05 Nov '25

If I have to guess, this part looks suspicious: ``` ret = mach_vm_region( process_port, &region_address, &region_size, VM_REGION_BASIC_INFO_64, (vm_region_info_t)&info, &info_count, &object_name ); ``` ((vm_region_info_t)&info). That seems like the parameter which address on stack is below our 'written' (so writing past it can do this), and it is suspiciously casted. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8834#note_120935

1 0

Re: [PATCH v5 0/3] MR8834: server: Use process_vm_writev / process_vm_readv instead of ptrace when available.
by Paul Gofman (＠gofman) 05 Nov '25

05 Nov '25

From this disassembly, %r8 (which is 'written' parameter) is saved on stack (`movq %r8, -0x68(%rbp)`), it is moved to %rdx in the end for assignment. I think it is likely that some code inside the fucntion before '*written' assignment smashes the stack and 'written' (and a whole change introduced by this patch) is a random victim. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8834#note_120934

1 0

Re: [PATCH v5 0/3] MR8834: server: Use process_vm_writev / process_vm_readv instead of ptrace when available.
by Rémi Bernon (＠rbernon) 05 Nov '25

05 Nov '25

No idea, but I think it's unlikely, it's been crashing the same way on my nightly builds (which is why I looked into it) and with a local build. I find it unlikely they would match and produce the same build output. Then yes, the address in lldb is weird, there's probably something going on. Disassembly of the bogus `write_process_memory`: ``` obj-wine-x86_64/server/mach.o: file format mach-o 64-bit x86-64 Disassembly of section __TEXT,__text: 0000000000000ce0 <_write_process_memory>: ; { ce0: 55 pushq %rbp ce1: 48 89 e5 movq %rsp, %rbp ce4: 41 57 pushq %r15 ce6: 41 56 pushq %r14 ce8: 41 55 pushq %r13 cea: 41 54 pushq %r12 cec: 53 pushq %rbx ced: 48 83 ec 68 subq $0x68, %rsp ; return process->trace_data; cf1: 44 8b bf 98 01 00 00 movl 0x198(%rdi), %r15d ; if (!process_port) cf8: 45 85 ff testl %r15d, %r15d cfb: 74 59 je 0xd56 <_write_process_memory+0x76> cfd: 49 89 cd movq %rcx, %r13 d00: 41 89 d6 movl %edx, %r14d d03: 49 89 f4 movq %rsi, %r12 d06: 4c 89 45 98 movq %r8, -0x68(%rbp) ; if (posix_memalign( (void **)&data, get_page_size(), size )) d0a: e8 00 00 00 00 callq 0xd0f <_write_process_memory+0x2f> d0f: 44 89 f3 movl %r14d, %ebx d12: 48 8d 7d b0 leaq -0x50(%rbp), %rdi ; if (posix_memalign( (void **)&data, get_page_size(), size )) d16: 48 89 c6 movq %rax, %rsi d19: 48 89 da movq %rbx, %rdx d1c: e8 00 00 00 00 callq 0xd21 <_write_process_memory+0x41> d21: 85 c0 testl %eax, %eax d23: 74 62 je 0xd87 <_write_process_memory+0xa7> ; static inline void set_error( unsigned int err ) { global_error = err; if (current) current->error = err; } d25: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xd2c <_write_process_memory+0x4c> d2c: c7 00 17 00 00 c0 movl $0xc0000017, (%rax) ## imm = 0xC0000017 d32: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xd39 <_write_process_memory+0x59> d39: 48 8b 08 movq (%rax), %rcx d3c: 31 c0 xorl %eax, %eax d3e: 48 85 c9 testq %rcx, %rcx d41: 0f 84 fd 02 00 00 je 0x1044 <_write_process_memory+0x364> d47: c7 81 70 01 00 00 17 00 00 c0 movl $0xc0000017, 0x170(%rcx) ## imm = 0xC0000017 d51: e9 ee 02 00 00 jmp 0x1044 <_write_process_memory+0x364> d56: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xd5d <_write_process_memory+0x7d> d5d: c7 00 22 00 00 c0 movl $0xc0000022, (%rax) ## imm = 0xC0000022 d63: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xd6a <_write_process_memory+0x8a> d6a: 48 8b 08 movq (%rax), %rcx d6d: 31 c0 xorl %eax, %eax ; static inline void set_error( unsigned int err ) { global_error = err; if (current) current->error = err; } d6f: 48 85 c9 testq %rcx, %rcx d72: 0f 84 cc 02 00 00 je 0x1044 <_write_process_memory+0x364> d78: c7 81 70 01 00 00 22 00 00 c0 movl $0xc0000022, 0x170(%rcx) ## imm = 0xC0000022 d82: e9 bd 02 00 00 jmp 0x1044 <_write_process_memory+0x364> ; memcpy( (void *)data, src, size ); d87: 48 8b 7d b0 movq -0x50(%rbp), %rdi d8b: 4c 89 ee movq %r13, %rsi d8e: 48 89 da movq %rbx, %rdx d91: e8 00 00 00 00 callq 0xd96 <_write_process_memory+0xb6> ; ret = mach_vm_write( process_port, (mach_vm_address_t)ptr, data, (mach_msg_type_number_t)size ); d96: 48 8b 55 b0 movq -0x50(%rbp), %rdx d9a: 44 89 ff movl %r15d, %edi d9d: 4c 89 e6 movq %r12, %rsi da0: 44 89 f1 movl %r14d, %ecx da3: e8 00 00 00 00 callq 0xda8 <_write_process_memory+0xc8> da8: 41 89 c5 movl %eax, %r13d ; if (ret == KERN_INVALID_ADDRESS) dab: 83 f8 01 cmpl $0x1, %eax dae: 0f 85 91 01 00 00 jne 0xf45 <_write_process_memory+0x265> ; mach_vm_address_t region_address = current_address; db4: 4c 89 65 c8 movq %r12, -0x38(%rbp) ; mach_msg_type_number_t info_count = VM_REGION_BASIC_INFO_COUNT_64; db8: c7 45 d4 09 00 00 00 movl $0x9, -0x2c(%rbp) dbf: 48 8d 45 a4 leaq -0x5c(%rbp), %rax ; ret = mach_vm_region( process_port, &region_address, &region_size, VM_REGION_BASIC_INFO_64, dc3: 48 89 04 24 movq %rax, (%rsp) dc7: 48 8d 75 c8 leaq -0x38(%rbp), %rsi dcb: 48 8d 55 b8 leaq -0x48(%rbp), %rdx dcf: 4c 8d 85 78 ff ff ff leaq -0x88(%rbp), %r8 dd6: 4c 8d 4d d4 leaq -0x2c(%rbp), %r9 dda: 44 89 ff movl %r15d, %edi ddd: b9 09 00 00 00 movl $0x9, %ecx de2: e8 00 00 00 00 callq 0xde7 <_write_process_memory+0x107> ; if (ret != KERN_SUCCESS) de7: 85 c0 testl %eax, %eax de9: 74 08 je 0xdf3 <_write_process_memory+0x113> deb: 41 89 c5 movl %eax, %r13d ; if ((ret = task_suspend( process_port )) != KERN_SUCCESS) dee: e9 52 01 00 00 jmp 0xf45 <_write_process_memory+0x265> ; if (region_address > current_address || df3: 48 8b 45 c8 movq -0x38(%rbp), %rax df7: 41 bd 01 00 00 00 movl $0x1, %r13d ; if (region_address > current_address || dfd: 4c 39 e0 cmpq %r12, %rax e00: 0f 87 3f 01 00 00 ja 0xf45 <_write_process_memory+0x265> ; region_address + region_size <= current_address) e06: 48 03 45 b8 addq -0x48(%rbp), %rax e0a: 4c 39 e0 cmpq %r12, %rax ; if (region_address > current_address || e0d: 0f 86 32 01 00 00 jbe 0xf45 <_write_process_memory+0x265> ; if (!is_rosetta() && !(info.protection & VM_PROT_WRITE)) e13: e8 00 00 00 00 callq 0xe18 <_write_process_memory+0x138> e18: 85 c0 testl %eax, %eax e1a: 75 13 jne 0xe2f <_write_process_memory+0x14f> e1c: 41 bd 02 00 00 00 movl $0x2, %r13d ; if (!is_rosetta() && !(info.protection & VM_PROT_WRITE)) e22: f6 85 78 ff ff ff 02 testb $0x2, -0x88(%rbp) e29: 0f 84 16 01 00 00 je 0xf45 <_write_process_memory+0x265> ; if ((ret = task_suspend( process_port )) != KERN_SUCCESS) e2f: 44 89 ff movl %r15d, %edi e32: e8 00 00 00 00 callq 0xe37 <_write_process_memory+0x157> e37: 85 c0 testl %eax, %eax e39: 75 b0 jne 0xdeb <_write_process_memory+0x10b> ; while (remaining_size) e3b: 45 85 f6 testl %r14d, %r14d e3e: 0f 84 f1 00 00 00 je 0xf35 <_write_process_memory+0x255> e44: 44 89 75 c4 movl %r14d, -0x3c(%rbp) e48: 4c 89 e3 movq %r12, %rbx ; region_address = current_address; e4b: 48 89 5d c8 movq %rbx, -0x38(%rbp) ; info_count = VM_REGION_BASIC_INFO_COUNT_64; e4f: c7 45 d4 09 00 00 00 movl $0x9, -0x2c(%rbp) ; ret = mach_vm_region( process_port, &region_address, &region_size, VM_REGION_BASIC_INFO_64, e56: 48 8d 45 a4 leaq -0x5c(%rbp), %rax e5a: 48 89 04 24 movq %rax, (%rsp) e5e: 44 89 ff movl %r15d, %edi e61: 48 8d 75 c8 leaq -0x38(%rbp), %rsi e65: 48 8d 55 b8 leaq -0x48(%rbp), %rdx e69: b9 09 00 00 00 movl $0x9, %ecx e6e: 4c 8d 85 78 ff ff ff leaq -0x88(%rbp), %r8 e75: 4c 8d 4d d4 leaq -0x2c(%rbp), %r9 e79: e8 00 00 00 00 callq 0xe7e <_write_process_memory+0x19e> ; if (ret != KERN_SUCCESS) break; e7e: 85 c0 testl %eax, %eax e80: 0f 85 b4 00 00 00 jne 0xf3a <_write_process_memory+0x25a> ; if (region_address > current_address || e86: 48 8b 45 c8 movq -0x38(%rbp), %rax e8a: 41 bd 01 00 00 00 movl $0x1, %r13d ; if (region_address > current_address || e90: 48 39 d8 cmpq %rbx, %rax e93: 0f 87 a4 00 00 00 ja 0xf3d <_write_process_memory+0x25d> ; region_address + region_size <= current_address) e99: 48 03 45 b8 addq -0x48(%rbp), %rax e9d: 48 39 d8 cmpq %rbx, %rax ; if (region_address > current_address || ea0: 0f 86 97 00 00 00 jbe 0xf3d <_write_process_memory+0x25d> ; if (!is_rosetta() && !(info.protection & VM_PROT_WRITE)) ea6: e8 00 00 00 00 callq 0xeab <_write_process_memory+0x1cb> eab: 85 c0 testl %eax, %eax ead: 75 0d jne 0xebc <_write_process_memory+0x1dc> eaf: f6 85 78 ff ff ff 02 testb $0x2, -0x88(%rbp) eb6: 0f 84 97 01 00 00 je 0x1053 <_write_process_memory+0x373> ; write_size = region_size - (current_address - region_address); ebc: 48 8b 55 b8 movq -0x48(%rbp), %rdx ec0: 48 29 da subq %rbx, %rdx ec3: 48 03 55 c8 addq -0x38(%rbp), %rdx ; if (write_size > remaining_size) write_size = remaining_size; ec7: 8b 45 c4 movl -0x3c(%rbp), %eax eca: 48 39 c2 cmpq %rax, %rdx ecd: 48 0f 43 d0 cmovaeq %rax, %rdx ; ret = mach_vm_protect( process_port, current_address, write_size, 0, ed1: 44 89 ff movl %r15d, %edi ed4: 48 89 de movq %rbx, %rsi ed7: 48 89 55 a8 movq %rdx, -0x58(%rbp) edb: 31 c9 xorl %ecx, %ecx edd: 41 b8 03 00 00 00 movl $0x3, %r8d ee3: e8 00 00 00 00 callq 0xee8 <_write_process_memory+0x208> ; if (ret != KERN_SUCCESS) break; ee8: 85 c0 testl %eax, %eax eea: 75 4e jne 0xf3a <_write_process_memory+0x25a> ; data + (current_address - (mach_vm_address_t)ptr), write_size ); eec: 48 89 da movq %rbx, %rdx eef: 4c 29 e2 subq %r12, %rdx ef2: 48 03 55 b0 addq -0x50(%rbp), %rdx ; ret = mach_vm_write( process_port, current_address, ef6: 44 89 ff movl %r15d, %edi ef9: 48 89 de movq %rbx, %rsi efc: 48 8b 4d a8 movq -0x58(%rbp), %rcx f00: e8 00 00 00 00 callq 0xf05 <_write_process_memory+0x225> ; if (ret != KERN_SUCCESS) break; f05: 85 c0 testl %eax, %eax f07: 75 31 jne 0xf3a <_write_process_memory+0x25a> ; info.protection ); f09: 44 8b 85 78 ff ff ff movl -0x88(%rbp), %r8d ; ret = mach_vm_protect( process_port, current_address, write_size, 0, f10: 44 89 ff movl %r15d, %edi f13: 48 89 de movq %rbx, %rsi f16: 48 8b 55 a8 movq -0x58(%rbp), %rdx f1a: 31 c9 xorl %ecx, %ecx f1c: e8 00 00 00 00 callq 0xf21 <_write_process_memory+0x241> ; if (ret != KERN_SUCCESS) break; f21: 85 c0 testl %eax, %eax f23: 75 15 jne 0xf3a <_write_process_memory+0x25a> f25: 48 8b 45 a8 movq -0x58(%rbp), %rax ; current_address += write_size; f29: 48 01 c3 addq %rax, %rbx ; while (remaining_size) f2c: 29 45 c4 subl %eax, -0x3c(%rbp) f2f: 0f 85 16 ff ff ff jne 0xe4b <_write_process_memory+0x16b> f35: 45 31 ed xorl %r13d, %r13d f38: eb 03 jmp 0xf3d <_write_process_memory+0x25d> f3a: 41 89 c5 movl %eax, %r13d ; task_resume( process_port ); f3d: 44 89 ff movl %r15d, %edi f40: e8 00 00 00 00 callq 0xf45 <_write_process_memory+0x265> ; free( (void *)data ); f45: 48 8b 7d b0 movq -0x50(%rbp), %rdi f49: e8 00 00 00 00 callq 0xf4e <_write_process_memory+0x26e> ; switch (mach_error) f4e: 41 83 fd 04 cmpl $0x4, %r13d f52: 0f 87 a9 00 00 00 ja 0x1001 <_write_process_memory+0x321> f58: 44 89 e8 movl %r13d, %eax f5b: 48 8d 0d fe 00 00 00 leaq 0xfe(%rip), %rcx ## 0x1060 <_write_process_memory+0x380> ; switch (mach_error) f62: 48 63 04 81 movslq (%rcx,%rax,4), %rax f66: 48 01 c8 addq %rcx, %rax f69: 48 8b 55 98 movq -0x68(%rbp), %rdx f6d: ff e0 jmpq *%rax ; static inline void set_error( unsigned int err ) { global_error = err; if (current) current->error = err; } f6f: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xf76 <_write_process_memory+0x296> f76: c7 00 05 00 00 c0 movl $0xc0000005, (%rax) ## imm = 0xC0000005 f7c: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xf83 <_write_process_memory+0x2a3> f83: 48 8b 00 movq (%rax), %rax f86: b9 05 00 00 c0 movl $0xc0000005, %ecx ## imm = 0xC0000005 f8b: 48 85 c0 testq %rax, %rax f8e: 0f 85 92 00 00 00 jne 0x1026 <_write_process_memory+0x346> f94: eb 67 jmp 0xffd <_write_process_memory+0x31d> f96: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xf9d <_write_process_memory+0x2bd> f9d: c7 00 0d 00 00 c0 movl $0xc000000d, (%rax) ## imm = 0xC000000D fa3: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xfaa <_write_process_memory+0x2ca> faa: 48 8b 00 movq (%rax), %rax fad: b9 0d 00 00 c0 movl $0xc000000d, %ecx ## imm = 0xC000000D fb2: 48 85 c0 testq %rax, %rax fb5: 75 6f jne 0x1026 <_write_process_memory+0x346> fb7: eb 44 jmp 0xffd <_write_process_memory+0x31d> fb9: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xfc0 <_write_process_memory+0x2e0> fc0: c7 00 22 00 00 c0 movl $0xc0000022, (%rax) ## imm = 0xC0000022 fc6: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xfcd <_write_process_memory+0x2ed> fcd: 48 8b 00 movq (%rax), %rax fd0: b9 22 00 00 c0 movl $0xc0000022, %ecx ## imm = 0xC0000022 fd5: 48 85 c0 testq %rax, %rax fd8: 75 4c jne 0x1026 <_write_process_memory+0x346> fda: eb 21 jmp 0xffd <_write_process_memory+0x31d> fdc: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xfe3 <_write_process_memory+0x303> fe3: c7 00 17 00 00 c0 movl $0xc0000017, (%rax) ## imm = 0xC0000017 fe9: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xff0 <_write_process_memory+0x310> ff0: 48 8b 00 movq (%rax), %rax ff3: b9 17 00 00 c0 movl $0xc0000017, %ecx ## imm = 0xC0000017 ff8: 48 85 c0 testq %rax, %rax ffb: 75 29 jne 0x1026 <_write_process_memory+0x346> ffd: 31 c0 xorl %eax, %eax ; static inline void set_error( unsigned int err ) { global_error = err; if (current) current->error = err; } fff: eb 40 jmp 0x1041 <_write_process_memory+0x361> 1001: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0x1008 <_write_process_memory+0x328> 1008: c7 00 01 00 00 c0 movl $0xc0000001, (%rax) ## imm = 0xC0000001 100e: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0x1015 <_write_process_memory+0x335> 1015: 48 8b 00 movq (%rax), %rax 1018: b9 01 00 00 c0 movl $0xc0000001, %ecx ## imm = 0xC0000001 101d: 48 85 c0 testq %rax, %rax 1020: 48 8b 55 98 movq -0x68(%rbp), %rdx 1024: 74 06 je 0x102c <_write_process_memory+0x34c> 1026: 89 88 70 01 00 00 movl %ecx, 0x170(%rax) ; if (ret == KERN_SUCCESS && written) *written = size; 102c: 45 85 ed testl %r13d, %r13d 102f: 0f 94 c0 sete %al 1032: 48 85 d2 testq %rdx, %rdx 1035: 74 0a je 0x1041 <_write_process_memory+0x361> 1037: 45 85 ed testl %r13d, %r13d 103a: 75 05 jne 0x1041 <_write_process_memory+0x361> 103c: 44 89 32 movl %r14d, (%rdx) 103f: b0 01 movb $0x1, %al ; return (ret == KERN_SUCCESS); 1041: 0f b6 c0 movzbl %al, %eax ; } 1044: 48 83 c4 68 addq $0x68, %rsp 1048: 5b popq %rbx 1049: 41 5c popq %r12 104b: 41 5d popq %r13 104d: 41 5e popq %r14 104f: 41 5f popq %r15 1051: 5d popq %rbp 1052: c3 retq 1053: 41 bd 02 00 00 00 movl $0x2, %r13d ; if (!is_rosetta() && !(info.protection & VM_PROT_WRITE)) 1059: e9 df fe ff ff jmp 0xf3d <_write_process_memory+0x25d> 105e: 66 90 nop 1060: cc int3 1061: ff ff <unknown> 1063: ff 0f decl (%rdi) 1065: ff ff <unknown> 1067: ff 59 ff lcalll *-0x1(%rcx) 106a: ff ff <unknown> 106c: 7c ff jl 0x106d <_write_process_memory+0x38d> 106e: ff ff <unknown> 1070: 36 ff ff <unknown> 1073: ff <unknown> ``` -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8834#note_120933

1 0

Re: [PATCH v5 0/3] MR8834: server: Use process_vm_writev / process_vm_readv instead of ptrace when available.
by Paul Gofman (＠gofman) 05 Nov '25

05 Nov '25

The code in `req_write_process_memory` calling write_process_memory is: ``` ... if ((process = get_process_from_handle( req->handle, PROCESS_VM_WRITE ))) { data_size_t len = get_req_data_size(); reply->written = 0; if (len) write_process_memory( process, req->addr, len, get_req_data(), &reply->written ); release_object( process ); } ``` reply->written was just assigned and it didn't crash. However, address of that which got to `write_process_memory` is bogus. Can it happen by any chance that something went wrong with the build, if not assuming some mindbreaking guesses or compiler errors that could happen if some compiled .o files are stale?? -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8834#note_120932

1 0

[PATCH 0/3] MR9373: dmusic,dmsynth: Reduce memory usage part 2
by Anton Baskanov (＠baskanov) 05 Nov '25

05 Nov '25

-- https://gitlab.winehq.org/wine/wine/-/merge_requests/9373

3 4

Re: [PATCH v5 0/3] MR8834: server: Use process_vm_writev / process_vm_readv instead of ptrace when available.
by Rémi Bernon (＠rbernon) 05 Nov '25

05 Nov '25

On Wed Nov 5 20:54:11 2025 +0000, Rémi Bernon wrote: > 295bd9bdcbda8e96cbfb51ec2861c340f4ed0db1 causes a wineserver crash on > macOS when running the kernel32:debugger tests. ``` * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x300000000) frame #0: 0x000000010001c44c wineserver`write_process_memory(process=0x00007f8f67f17410, ptr=10880000, size=1, src=<unavailable>, written=0x0000000300000000) at mach.c:542:50 [opt] 539 out: 540 free( (void *)data ); 541 mach_set_error( ret ); -> 542 if (ret == KERN_SUCCESS && written) *written = size; 543 return (ret == KERN_SUCCESS); 544 } 545 warning: wineserver was compiled with optimization - stepping may behave oddly; variables may not be available. (lldb) bt * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x300000000) * frame #0: 0x000000010001c44c wineserver`write_process_memory(process=0x00007f8f67f17410, ptr=10880000, size=1, src=<unavailable>, written=0x0000000300000000) at mach.c:542:50 [opt] frame #1: 0x000000010002840e wineserver`req_write_process_memory(req=0x00007f8f77f04ec8, reply=<unavailable>) at process.c:1800:18 [opt] frame #2: 0x000000010003bda1 wineserver`call_req_handler(thread=0x00007f8f77f04d50) at request.c:305:9 [opt] frame #3: 0x000000010003bc21 wineserver`read_request(thread=0x00007f8f77f04d50) at request.c:360:13 [opt] frame #4: 0x000000010004a827 wineserver`thread_poll_event(fd=<unavailable>, event=1) at thread.c:596:30 [opt] frame #5: 0x0000000100011be4 wineserver`main_loop [inlined] fd_poll_event(fd=<unavailable>, event=<unavailable>) at fd.c:510:5 [opt] frame #6: 0x0000000100011bdd wineserver`main_loop [inlined] main_loop_epoll at fd.c:722:39 [opt] frame #7: 0x0000000100011a09 wineserver`main_loop at fd.c:972:5 [opt] frame #8: 0x000000010001d402 wineserver`main(argc=<unavailable>, argv=<unavailable>) at main.c:269:5 [opt] frame #9: 0x0000000200102345 dyld`start + 1909 ``` -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8834#note_120930

1 0

Re: [PATCH v5 0/3] MR8834: server: Use process_vm_writev / process_vm_readv instead of ptrace when available.
by Rémi Bernon (＠rbernon) 05 Nov '25

05 Nov '25

295bd9bdcbda8e96cbfb51ec2861c340f4ed0db1 causes a wineserver crash on macOS when running the kernel32:debugger tests. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/8834#note_120929

1 0

[PATCH v4 0/1] MR9375: opengl32: Avoid null pointer dereferences when filtering extensions.
by Tim Clem (＠tclem) 05 Nov '25

05 Nov '25

Fixes: 2127e9ae7d90466f3b8883708799047214409832 --- Fixes a crash on macOS. Perhaps the extensions string regularly has a trailing space on other platforms? The previous filter_extensions_list method set `end` differently and avoided this case. -- v4: opengl32: Avoid null pointer dereferences when filtering extensions. https://gitlab.winehq.org/wine/wine/-/merge_requests/9375

4 4

2025

2024

2023

2022

wine-gitlab