[Bug 39256] msxml3/tests/domdoc.c crashes under valgrind

[wine-bugs at winehq.org]

https://bugs.winehq.org/show_bug.cgi?id=39256

Thomas Faller <tfaller1 at gmx.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tfaller1 at gmx.de

--- Comment #1 from Thomas Faller <tfaller1 at gmx.de> ---
If I run the test, valgrind does not crash. But there is an invalid free error
(more or less the same callstack):


==31818== Invalid free() / delete / delete[] / realloc()
==31818==    at 0x7BC4FDAD: RtlFreeHeap (heap.c:1764)
==31818==    by 0x63FF408: heap_free (msxml_private.h:189)
==31818==    by 0x63FF408: free_properties (???:0)
==31818==    by 0x6406B06: xmldoc_release_refs (domdoc.c:615)
==31818==    by 0x6407E3F: xmldoc_release (domdoc.c:626)
==31818==    by 0x63FF2C3: domdoc_Release (domdoc.c:957)
==31818==    by 0x4EA47B6: IXMLDOMDocument2_Release (msxml2.h:5224)
==31818==    by 0x4EA47B6: test_get_ownerDocument (???:0)
==31818==    by 0x4EA5710: func_domdoc (domdoc.c:12050)
==31818==    by 0x4E74F35: main (test.h:584)
==31818==  Address 0x48e5fd8 is 4 bytes after a block of size 92 free'd
==31818==    at 0x7BC4FDAD: RtlFreeHeap (heap.c:1764)
==31818==    by 0x59B289C: FONT_DeleteObject (font.c:778)
==31818==    by 0x59D0BD0: DeleteObject (gdiobj.c:944)
==31818==    by 0x578121F: get_text_metr_size (sysparams.c:483)
==31818==    by 0x57849CE: normalize_nonclientmetrics (sysparams.c:648)
==31818==    by 0x57849CE: SystemParametersInfoW (???:0)
==31818==    by 0x578306B: GetSystemMetrics (sysparams.c:2434)
==31818==    by 0x5782D79: GetSystemMetrics (sysparams.c:2453)
==31818==    by 0x5798F11: WINPOS_GetMinMaxInfo (winpos.c:774)
==31818==    by 0x579554A: WIN_CreateWindowEx (win.c:1567)
==31818==    by 0x578F2F4: CreateWindowExW (win.c:1750)
==31818==    by 0x6C75FAF: get_notif_hwnd (bindprot.c:130)
==31818==    by 0x6C72660: start_binding (binding.c:1412)
==31818== 
==31818== Invalid free() / delete / delete[] / realloc()
==31818==    at 0x7BC4FDAD: RtlFreeHeap (heap.c:1764)
==31818==    by 0x63FF427: heap_free (msxml_private.h:189)
==31818==    by 0x63FF427: free_properties (???:0)
==31818==    by 0x6406B06: xmldoc_release_refs (domdoc.c:615)
==31818==    by 0x6407E3F: xmldoc_release (domdoc.c:626)
==31818==    by 0x63FF2C3: domdoc_Release (domdoc.c:957)
==31818==    by 0x4EA47B6: IXMLDOMDocument2_Release (msxml2.h:5224)
==31818==    by 0x4EA47B6: test_get_ownerDocument (???:0)
==31818==    by 0x4EA5710: func_domdoc (domdoc.c:12050)
==31818==    by 0x4E74F35: main (test.h:584)
==31818==  Address 0x48e66f0 is 24 bytes inside a block of size 98 free'd
==31818==    at 0x7BC4FDAD: RtlFreeHeap (heap.c:1764)
==31818==    by 0x7BC7352E: RtlFreeUnicodeString (rtlstr.c:319)
==31818==    by 0x7B83E442: CreateFileW (file.c:1592)
==31818==    by 0x6C78161: FileProtocol_StartEx (file.c:278)
==31818==    by 0x6C763E1: BindProtocol_StartEx (urlmon.h:8029)
==31818==    by 0x6C72CEC: start_binding (urlmon.h:8029)
==31818==    by 0x6C730CE: bind_to_storage (binding.c:1569)
==31818==    by 0x6C8AD5C: URLMoniker_BindToStorage (umon.c:280)
==31818==    by 0x63E7A34: IMoniker_BindToStorage (objidl.h:3772)
==31818==    by 0x63E7A34: bind_url (???:0)
==31818==    by 0x64074B5: domdoc_load_moniker (domdoc.c:2093)
==31818==    by 0x64074B5: domdoc_load (???:0)
==31818==    by 0x4E77130: test_domdoc (msxml.h:2051)
==31818==    by 0x4EA4ABF: func_domdoc (domdoc.c:12019)
==31818==

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.