Jacek Caban : shdocvw: Use BindToObject to load document ...

[Dan Kegel]

I'm seeing a new crash in shdocvw/tests/webbrowser.c since yesterday.
I haven't verified this with bisect, but the stack traces
seem to point to Jacek's set of changes.  Both can be seen here:
http://kegel.com/wine/valgrind/logs-2008-01-04/vg-shdocvw_webbrowser-diff.txt

The first one is a new valgrind warning:
+ Syscall param writev(vector[2]) points to uninitialised byte(s)
+    at  (within /lib/ld-2.5.so)
+    by  wine_server_call (server.c:244)
+    by  send_debug_event (exception.c:200)
+    by  raise_exception (exception.c:357)
+    by  __regs_RtlRaiseException (exception.c:388)
+    by  raise_segv_exception (signal_i386.c:1032)
+    by  ???
+    by  set_moniker (persist.c:326)
+    by  PersistMoniker_Load (persist.c:427)
+    by  report_data (binding.c:400)
+    by  InternetProtocolSink_ReportData (binding.c:1073)
+    by  BPInternetProtocolSink_ReportData (bindprot.c:518)
+    by  AboutProtocol_Start (protocol.c:275)
+    by  BindProtocol_Start (bindprot.c:192)
+    by  start_binding (binding.c:1446)
+    by  bind_to_object (binding.c:1513)
+    by  URLMonikerImpl_BindToObject (umon.c:490)
+    by  navigate_mon (navigate.c:563)
+    by  navigate_url (navigate.c:659)
+    by  WebBrowser_Navigate2 (webbrowser.c:695)

And the second one is a new crash:
+Unhandled exception: page fault on read access to 0xffffffff in
32-bit code (0x06ce27c6).
+=>1 0x06ce27c6 set_document_bscallback+0xb6(doc=0x7f018f80,
callback=0x7f01b748) [dlls/mshtml/mshtml_private.h:563] in mshtml
(0x7f22f488)
+  2 0x06cf732a set_moniker+0x6ba(This=0x7f018f80, mon=0x7f017e38,
pibc=0x7f019570, bind_complete=0x7f22f628) [dlls/mshtml/persist.c:327]
in mshtml (0x7f22f5e8)
+  3 0x06cf7a35 PersistMoniker_Load+0x45(iface=0x7f018f90,
fFullyAvailable=0x1, pimkName=0x7f017e38, pibc=<?>, grfMode=0x12)
[dlls/mshtml/persist.c:428] in mshtml (0x7f22f638)
+  4 0x06c088a1 report_data+0x761(This=0x7f018970, bscf=<?>,
progress=<?>, progress_max=0x1e) [dlls/urlmon/binding.c:400] in urlmon
(0x7f22f6d8)
+  5 0x06c08ba4 InternetProtocolSink_ReportData+0xb4(iface=0x7f018974,
grfBSCF=0xd, ulProgress=0x1e, ulProgressMax=<?>)
[dlls/urlmon/binding.c:1073] in urlmon (0x7f22f718)
+  6 0x06c0a23f
BPInternetProtocolSink_ReportData+0x4f(iface=0x7f018e18, grfBSCF=0xd,
ulProgress=0x1e, ulProgressMax=<?>) [dlls/urlmon/bindprot.c:518] in
urlmon (0x7f22f758)
+  7 0x06cf8e1c AboutProtocol_Start+0x1cc(iface=0x7f018e48, szUrl=<?>,
pOIProtSink=0x7f018e18, pOIBindInfo=0x7f018e0c, grfPI=0x0,
dwReserved=0x0) [dlls/mshtml/protocol.c:279] in mshtml (0x7f22f808)
+  8 0x06c0b49e BindProtocol_Start+0x1ce(iface=0x7f018e08,
szUrl=0x7f018540, pOIProtSink=<?>, pOIBindInfo=0x7f018978, grfPI=0x0,
dwReserved=0x0) [dlls/urlmon/bindprot.c:192] in urlmon (0x7f22f888)
+  9 0x06c09881 start_binding+0xa91(mon=0x7f017e38, binding_ctx=0x0,
url=<?>, pbc=0x7f018838, to_obj=0x1, riid=0x6bdfda8, ret=0x7f22f9ac)
[dlls/urlmon/binding.c:1446] in urlmon (0x7f22f988)
+  10 0x06c099ca bind_to_object+0x3a(mon=0x7f017e38, url=0x7f018540,
pbc=0x7f018838, riid=0x6bdfda8, ppv=0x7f22fc34)
[dlls/urlmon/binding.c:1514] in urlmon (0x7f22f9b8)
+  11 0x06c17c88 URLMonikerImpl_BindToObject+0xe8(iface=0x7f017e38,
pbc=<?>, pmkToLeft=0x0, riid=<?>, ppv=0x7f22fc34)
[dlls/urlmon/umon.c:491] in urlmon (0x7f22fa18)
+  12 0x06bd1937 navigate_mon+0x507(This=0x7f0176d8, mon=0x7f017e38,
post_data=0x0, post_data_len=0x0, headers=0x0)
[dlls/shdocvw/navigate.c:563] in shdocvw (0x7f22fc58)
+  13 0x06bd1ec3 navigate_url+0xd3(This=0x7f0176d8, url=0x7f017e14,
Flags=0x0, TargetFrameName=0x0, PostData=0x0, Headers=0x0)
[dlls/shdocvw/navigate.c:659] in shdocvw (0x7f22fca8)
+  14 0x06bd98b9 WebBrowser_Navigate2+0x79(iface=<?>, URL=<?>,
Flags=0x0, TargetFrameName=0x0, PostData=0x0, Headers=0x0)
[dlls/shdocvw/webbrowser.c:696] in shdocvw (0x7f22fce8)
+  15 0x045e68d4 test_Navigate2+0x154(unk=<?>)
[dlls/shdocvw/tests/webbrowser.c:1540] in shdocvw_test (0x7f22fd48)
+  16 0x045e7634 test_WebBrowser+0x934()
[dlls/shdocvw/tests/webbrowser.c:1609] in shdocvw_test (0x7f22fe18)
+  17 0x045e8a6c func_webbrowser+0xac()
[dlls/shdocvw/tests/webbrowser.c:1658] in shdocvw_test (0x7f22fe58)
+  18 0x045e8c98 run_test+0x128(name=0x7f0003f8)
[include/wine/test.h:389] in shdocvw_test (0x7f22fea8)