LoadOEMResource crash [Was: Re: Problem report: SHRINKER.ERR, fix to DEVICE_Open/CreateFileA? ]

[Pavel Troller]

> A quick look at running the app under --winver nt40 shows two problems. 
> It hits the first problem and wants to display a SHRINKER.ERR dialog box 
> saying "Dispatcher initialisation error". However, when wine tries to 
> display that message box, it looks like the app spins -- it eats up all 
> of the CPU -- when the app calls x11drv.LoadOEMResource. These are the 
> last lines of the relay trace:
> 
Hi!
  I have a very similar problem. It's not related to shrinker, but to
LoadOEMResource. I'm trying to install an app (Child's Czech graphical
programming system Baltik) and it segfaults. Closer look shows exactly
the same behavior of LoadOEMResource.

0806ea10:Call window proc 0x406c1d9c (hwnd=00010029,msg=WM_CREATE,wp=00000000,lp=404d4554)
0806ea10:trace:win32:_EnterSysLevel (0x40749d2c, level 2): thread 0x806ea10 (fs 008f, pid 17074) count before 0
0806ea10:trace:win32:_EnterSysLevel (0x40749d2c, level 2): thread 0x806ea10 (fs 008f, pid 17074) count after  1
0806ea10:trace:win32:_LeaveSysLevel (0x40749d2c, level 2): thread 0x806ea10 (fs 008f, pid 17074) count before 1
0806ea10:trace:win32:_LeaveSysLevel (0x40749d2c, level 2): thread 0x806ea10 (fs 008f, pid 17074) count after  0
0806ea10:trace:win32:_EnterSysLevel (0x40749d2c, level 2): thread 0x806ea10 (fs 008f, pid 17074) count before 0
0806ea10:trace:win32:_EnterSysLevel (0x40749d2c, level 2): thread 0x806ea10 (fs 008f, pid 17074) count after  1
0806ea10:trace:win32:_LeaveSysLevel (0x40749d2c, level 2): thread 0x806ea10 (fs 008f, pid 17074) count before 1
0806ea10:trace:win32:_LeaveSysLevel (0x40749d2c, level 2): thread 0x806ea10 (fs 008f, pid 17074) count after  0
0806ea10:trace:resource:LoadImageW (0x0000,0x7ff7,0,0,0,0x00000000)
0806ea10:Call x11drv.LoadOEMResource(00007ff7,00000001) ret=406edd92
0806ea10:trace:heap:HeapAlloc (40390000,00000002,0000008c): returning 403f9cf8
0806ea10:trace:seh:EXC_RtlRaiseException code=c0000005 flags=0
0806ea10: queue_exception_event( first=1, record={context={flags=00000000,eax=404d1cf0,ebx=40981658,ecx=00000031,edx=404d1c74,esi=00000000,edi=404d3d14,ebp=403f9cf8,eip=40974ece,esp=404cdb80,eflags=00010202,cs=0023,ds=002b,es=002b,fs=008f,gs=0000,dr0=00000000,dr1=00000000,dr2=00000000,dr3=00000000,dr6=00000000,dr7=00000000,float={00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000}},rec={code=c0000005,flags=0,rec=(nil),addr=0x40974ece,params={1,404cdb7c}} )
0806ea10: queue_exception_event() = 0 { handle=0 }
0806ea10:trace:seh:EXC_CallHandler calling handler at 0x40389af8 code=c0000005 flags=0
0806ea10:trace:seh:EXC_RtlRaiseException code=c0000005 flags=0
0806ea10: queue_exception_event( first=1, record={context={flags=401138a0,eax=404d476e,ebx=400ff684,ecx=00000034,edx=00000057,esi=400fcd5f,edi=404d49e6,ebp=40389af8,eip=40389b00,esp=404d4914,eflags=00010202,cs=0023,ds=002b,es=002b,fs=008f,gs=0000,dr0=0000000c,dr1=404d4518,dr2=404d433c,dr3=400689a1,dr6=402bf834,dr7=404d47c0,float={402bf834,404d47c8,40390cf9,40389af8,402bf834,404d47d8,402d3226,40389af8,40390d1a,404d440c,402d2894,40389af8,404d4424,402bf834,404d47fc,402bf834,404d4804,403910ef,00000000,402bf834,404d4814,000003d6,402cea86,404d4424,40730fa0,404d4590,402cea6d,404d4424}},rec={code=c0000005,flags=0,rec=(nil),addr=0x40389b00,params={1,b4f24034}} )
0806ea10: queue_exception_event() = 0 { handle=0 }
0806ea10:trace:seh:EXC_CallHandler calling handler at 0x40068c90 code=c0000005 flags=0
0806ea10:trace:seh:EXC_CallHandler handler returned 2
0806ea10:trace:seh:EXC_CallHandler calling handler at 0x402cea86 code=c0000005 flags=10
0806ea10:trace:seh:EXC_RtlRaiseException code=c0000005 flags=0
0806ea10: queue_exception_event( first=1, record={context={flags=404d40e0,eax=0000000e,ebx=400ff684,ecx=00000035,edx=404d4790,esi=400fcd5d,edi=404d42fc,ebp=402cea86,eip=402cea99,esp=404d424c,eflags=00010216,cs=0023,ds=002b,es=002b,fs=008f,gs=0000,dr0=402bf834,dr1=404d40e8,dr2=402bf834,dr3=404d40f0,dr6=402bf834,dr7=404d40f8,float={40390d26,ffffffff,00000000,65363034,32396464,402bf834,404d4114,402bf834,404d411c,403846c0,00000000,402bf834,404d412c,000003c9,40390d26,403846c0,00000000,00000000,00000000,40390000,00000000,00000000,00000000,00000000,00000000,40390d26,40390d26,00000000}},rec={code=c0000005,flags=0,rec=(nil),addr=0x402cea99,params={1,e}} )

And the trace then also shows repetitive patterns, however not ad infinitum,
after about 10 seconds it segfaults (generating about 265 Megs of log).
Maybe You wasn't patient enough or my machine is faster :-)

  It is also interesting that the same call is made once before and it doesn't
make any harm:

0806ea10:Call user32.LoadBitmapA(00000000,00007ff7) ret=00438315
0806ea10:trace:resource:LoadImageW (0x0000,0x7ff7,0,0,0,0x00000000)
0806ea10:Call x11drv.LoadOEMResource(00007ff7,00000001) ret=406edd92
0806ea10:trace:heap:HeapAlloc (40390000,00000002,0000008c): returning 403f0f94
0806ea10:trace:win32:_EnterSysLevel (0x407eb904, level 3): thread 0x806ea10 (fs 008f, pid 17074) count before 0
0806ea10:trace:win32:_EnterSysLevel (0x407eb904, level 3): thread 0x806ea10 (fs 008f, pid 17074) count after  1
0806ea10:trace:heap:HeapAlloc (40390000,00000002,00000038): returning 403f102c
0806ea10:trace:gdi:GDI_AllocObject (0130): enter 1
0806ea10:trace:gdi:GDI_ReleaseObj (0130): leave 1
0806ea10:trace:win32:_LeaveSysLevel (0x407eb904, level 3): thread 0x806ea10 (fs 008f, pid 17074) count before 1
0806ea10:trace:win32:_LeaveSysLevel (0x407eb904, level 3): thread 0x806ea10 (fs 008f, pid 17074) count after  0
0806ea10:trace:heap:HeapFree (40390000,00000002,403f0f94): returning TRUE
0806ea10:Ret  x11drv.LoadOEMResource() retval=00000130 ret=406edd92
0806ea10:Ret  user32.LoadBitmapA() retval=00000130 ret=00438315

                                  With regards, Pavel Troller