WineHQ
Bug Tracking Database – Bug 20847

 Bugzilla

 

Last modified: 2014-08-03 14:55:58 UTC  

Touhou Hisoutenskou crashes in deck construction/end of battle

Bug 20847 - Touhou Hisoutenskou crashes in deck construction/end of battle
Touhou Hisoutenskou crashes in deck construction/end of battle
Status: CLOSED FIXED
AppDB: Show Apps affected by this bug
Product: Wine
Classification: Unclassified
Component: gdi32
1.1.33
x86 Linux
: P2 normal
: ---
Assigned To: Mr. Bugs
:
: 22875 (view as bug list)
Depends on:
Blocks:
  Show dependency tree
 
Reported: 2009-11-27 10:53 UTC by 11aug89yr
Modified: 2014-08-03 14:55 UTC (History)
7 users (show)

See Also:
Regression SHA1:
Fixed by SHA1: db86409db66362c56031429ec124e65064e4f0bd
Distribution: ---
Staged patchset:


Attachments
Wine output (6.02 KB, text/plain)
2010-07-25 16:34 UTC, 1AA71A3E
Details
patch (509 bytes, patch)
2010-07-26 18:57 UTC, 1AA71A3E
Details | Diff
A very simple patch to make sure GetGlyphOutlineA won't return 0. (621 bytes, patch)
2013-04-05 22:12 UTC, 凤凰院红旗
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description 11aug89yr 2009-11-27 10:53:59 UTC
Game crashes when any battle ends or I'm choosing the character in the deck construction option.
Than terminal echoes line:
"wine: Unhandled division by zero at address 0x41199a (thread 0023), starting debugger..."
Comment 1 Vitaliy Margolen 2009-11-27 17:03:49 UTC
Set ShowCrashDialog to 0 and try again ( http://wiki.winehq.org/UsefulRegistryKeys ) . If it produces more output - attach it. Pleae make sure you have debug symbols installed.
Comment 2 11aug89yr 2009-11-28 09:58:54 UTC
Sorry,but it is no more output, wine is not responding and I have to use Ctrl+c to terminate it.
Comment 3 1AA71A3E 2010-07-25 16:34:12 UTC
Created attachment 29832 [details]
Wine output

Wine output from a crash when confirming Sanae's first line in Cirno's scenario. The address is the same.
Comment 4 1AA71A3E 2010-07-25 16:40:28 UTC
Oh, wait, it isn't.
Comment 5 Anastasius Focht 2010-07-25 17:37:10 UTC
Hello,

did you check:

http://www.shrinemaiden.org/forum/index.php?topic=5902.0

and specifically:

http://hisouten.koumakan.jp/wiki/Linux_support

There seems to be a pretty good bug understanding/analysis between Wine and the game.
My guess is your crash (division by zero) is font/glyph related.

Could you try to run the game as follows:

WINEDEBUG=+tid,+seh,+relay,+font LANG=ja_JP.UTF-8 wine ./th123.exe &> log.txt

and attach resulting log when it crashes.
Could you also try the following:

$ winetricks corefonts

and if that doesn't help:

$ winetricks allfonts

and see if it changes something.

Regards
Comment 6 1AA71A3E 2010-07-25 18:24:46 UTC
(In reply to comment #5)
> Could you try to run the game as follows:
> 
> WINEDEBUG=+tid,+seh,+relay,+font LANG=ja_JP.UTF-8 wine ./th123.exe &> log.txt
> 
> and attach resulting log when it crashes.

You're seriously asking me to attach a 3361241-line long log?

> Could you also try the following:
> 
> $ winetricks corefonts

Didn't help. I had corefonts already anyway.

> and if that doesn't help:
> 
> $ winetricks allfonts

This didn't help either.
Comment 7 Jeff Zaroyko 2010-07-25 18:31:14 UTC
(In reply to comment #6)
> You're seriously asking me to attach a 3361241-line long log?

Try to compress it with bzip2.
Comment 8 1AA71A3E 2010-07-25 19:52:05 UTC
I was concerned about its usefulness...

http://asth.net/files/log.txt.bz2

Too big to attach.
Comment 9 Anastasius Focht 2010-07-26 01:37:08 UTC
Hello,

my guess was correct, looks like Wine returns invalid glyphs which the app doesn't expect.

--- snip ---
...
0023:Call gdi32.CreateFontA(00000018,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000080,00000004,00000000,00000002,00000031,16711c1c "\x82l\x82r \x83S\x83V\x83b\x83N") ret=0041171b
0023:trace:font:CreateFontIndirectExW (24 0 0 0 31 4 0 2 128) L"\ff2d\ff33 \30b4\30b7\30c3\30af"    => 0x468
0023:Ret  gdi32.CreateFontA() retval=00000468 ret=0041171b
0023:Call user32.GetDC(00010048) ret=0041172b
0023:trace:font:WineEngCreateFontInstance L"System", h=16, it=0, weight=400, PandF=22, charset=128 orient 0 escapement 0 
...
0023:trace:font:WineEngCreateFontInstance returning cached gdiFont(0x146a88) for hFont 0x7c
0023:trace:font:X11DRV_SelectFont hdc=0x428, hfont=0x7c
0023:trace:font:X11DRV_SelectFont gdiFont = 0x146a88
0023:trace:font:update_font_code_page charset 128 => cp 932
0023:Ret  user32.GetDC() retval=00000428 ret=0041172b
0023:Call gdi32.SelectObject(00000428,00000468) ret=00411738
0023:trace:font:WineEngCreateFontInstance L"\ff2d\ff33 \30b4\30b7\30c3\30af", h=24, it=0, weight=400, PandF=31, charset=128 orient 0 escapement 0
0023:trace:font:WineEngCreateFontInstance DC transform 1.000000 0.000000 0.000000 1.000000
0023:trace:font:find_in_cache Found 0x92e4368 in unused list
0023:trace:font:WineEngCreateFontInstance returning cached gdiFont(0x92e4368) for hFont 0x468
0023:trace:font:X11DRV_SelectFont hdc=0x428, hfont=0x468
0023:trace:font:X11DRV_SelectFont gdiFont = 0x92e4368
0023:trace:font:update_font_code_page charset 128 => cp 932
0023:Ret  gdi32.SelectObject() retval=0000007c ret=00411738
0023:Call gdi32.GetTextMetricsA(00000428,05f5e380) ret=00411749
0023:trace:font:GetTextMetricsW text metrics:
    Weight = 400	 FirstChar = 32	 AveCharWidth = 12
    Italic =   0	 LastChar = 65518		 MaxCharWidth = 24
    UnderLined = 0	 DefaultChar = 31	 Overhang = 0
    StruckOut = 0	 BreakChar = 32	 CharSet = 128
    PitchAndFamily = 36
    --------------------
    InternalLeading = 0
    Ascent = 21
    Descent = 3
    Height = 24
0023:Ret  gdi32.GetTextMetricsA() retval=00000001 ret=00411749 
...
0023:Call gdi32.GetGlyphOutlineA(00000428,00008140,00000005,05f5e39c,00000000,00000000,00883ec4) ret=004118f9
0023:trace:font:FONT_mbtowc mapped "\x81@" -> L"\3000"
0023:trace:font:GetGlyphOutlineW (0x428, 3000, 0005, 0x5f5e39c, 0, (nil), 0x883ec4)
0023:trace:font:WineEngGetGlyphOutline 0x92e4368, 3000, 00000005, 0x5f5e39c, 00000000, (nil), 0x883ec4
0023:trace:font:WineEngGetGlyphOutline font transform 1.000000 0.000000 0.000000 1.000000
0023:trace:font:WineEngGetGlyphOutline 0,0,(0,0),24,0
0023:Ret  gdi32.GetGlyphOutlineA() retval=00000000 ret=004118f9
...
0023:trace:seh:raise_exception code=c0000094 flags=0 addr=0x41190a ip=0041190a tid=0023
0023:trace:seh:raise_exception  eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=16711c10 edi=00000006
0023:trace:seh:raise_exception  ebp=05f5e3dc esp=05f5e380 cs=0073 ds=007b es=007b fs=0033 gs=003b flags=00210246
0023:trace:seh:call_vectored_handlers calling handler at 0x7e44c5a0 code=c0000094 flags=0
...
Unhandled exception: divide by zero in 32-bit code (0x0041190a).
Register dump:
 CS:0073 SS:007b DS:007b ES:007b FS:0033 GS:003b
 EIP:0041190a ESP:05f5e380 EBP:05f5e3dc EFLAGS:00210246(  R- --  I  Z- -P- )
 EAX:00000000 EBX:00000000 ECX:00000000 EDX:00000000
 ESI:16711c10 EDI:00000006
...
0x0041190a: divl	%ecx,%eax
--- snip ---

GetGlyphOutlineA() return value is most likely only checked for GDI_ERROR (-1) but Wine returns 0 bytes (eax = 0) -> sloppy app coding.
Although this should not happen on a standard Windows box, the app could use some sort of fallback glyph - but appearently this problem is never anticipated.

The division by zero most likely results from returned GLYPHMETRICS params being zero (gmBlackBoxY = 0 and the like).

This bug is also described at the support site I mentioned previously:

--- quote ---
    * Crashes in certain menus and when Sanae is picked 

    Symptoms: 
    When entering various menus in the game or entering any fight where Sanae is involved, the game will immediately crash. 

    The bug: 
    th123's GetGlyphOutline() code does not check to see if it returned an invalid glyph, since this never happens on Windows. So, whenever any text includes a glyph that is returned as invalid by wine, such as a space, the game will just crash with an integer divide by zero. 

    The fix: 
    Override GetGlyphOutline() and return a faked response for spaces. 
--- quote ---

Regards
Comment 10 1AA71A3E 2010-07-26 18:57:28 UTC
Created attachment 29846 [details]
patch

Thanks.
It crashes on 0x8140 SHIFT-JIS (U+3000) character in scenario dialogue, and on 0x20 in deck construction because it gets 0 on gmBlackBoxY.

I made a simple fix that sets gmBlackBoxY to 1 on those two symbols.
Comment 11 Dan Kegel 2010-08-10 07:49:44 UTC
*** Bug 22875 has been marked as a duplicate of this bug. ***
Comment 12 Anton Yarth 2010-09-06 23:06:17 UTC
It's same problem in Bug #18440, duplicating.

(In reply to comment #10)
> Created an attachment (id=29846) [details]
> patch
> 
> Thanks.
> It crashes on 0x8140 SHIFT-JIS (U+3000) character in scenario dialogue, and on
> 0x20 in deck construction because it gets 0 on gmBlackBoxY.
> 
> I made a simple fix that sets gmBlackBoxY to 1 on those two symbols.

I always examine gmBlackBoxY, and if it = 0, then set gmBlackBoxY to 1
Comment 13 Luca Bennati 2011-11-05 13:52:06 UTC
Still crashes on 1.3.32.
Happens repeatedly on choosing Sanae (green-haired with frog hairpin) on menu, arcade mode.
Comment 14 Luca Bennati 2011-11-16 15:47:07 UTC
This issue seems to be a dupe of bug 18440, since hacking GetGlyphOutline with suggested minimal check fixes them both.
Comment 15 凤凰院红旗 2013-04-05 22:12:44 UTC
Created attachment 44101 [details]
A very simple patch to make sure GetGlyphOutlineA won't return 0.
Comment 16 凤凰院红旗 2013-04-05 22:14:05 UTC
Sorry for my bad english.
it still crashes for me on 1.5.27 in Archlinux.
I found these lines in log:
--- snip ---
0035:Ret  gdi32.GetGlyphOutlineA() retval=00000000 ret=004118f9
0035:trace:seh:raise_exception code=c0000094 flags=0 addr=0x41190a ip=0041190a tid=0035
0035:trace:seh:raise_exception  eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00884000 edi=0000005b
0035:trace:seh:raise_exception  ebp=03c7e2a4 esp=03c7e248 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00210246
0035:trace:seh:call_stack_handlers calling handler at 0x83e183 code=c0000094 flags=0
--- snip ---
It seems that the exception is caused by return value of GetGlyphOutlineA……So I modified GetGlyphOutlineA and make it returns GDI_ERROR when GetGlyphOutlineW returns 0(But it may cause more bugs...)
Comment 17 Chiitoo 2013-08-29 17:49:14 UTC
Hies!


This seems to affect the new user interface of FINAL FANTASY XI Online as well.  At the time of writing, it's only available to be used on the test-server client, so I didn't create a link to the bug yet (and it does seem like it might be slightly different; let me know if it should have its own bug, and I'll create one, if no one else does).

The crash happens immediately when game launches, and should show a box with accept/decline options, using the new UI elements.

The following “fixes” the division by zarrro crash:


dlls/gdi32/freetype.c:6552

if(lpgm->gmBlackBoxX == 0 && (glyph == 0x20)) lpgm->gmBlackBoxX = 1;


It looksl ike it wants “Alps Condensed”, and the replacement font (AR PL UKai CN) doesn't quite look as good, but that's more or less to be expected at this point, I maybe guess.


Tested on:


wine-1.7.0-346-g1bf936c

x11-drivers/nvidia-drivers-325.15

Linux-3.9.11-ck-x86_64-AMD_Phenom-tm-_II_X6_1090T_Processor-with-gentoo-2.2


I hope this helps!
Comment 18 Sagawa 2013-10-02 10:09:40 UTC
Should be fixed by db86409db66362c56031429ec124e65064e4f0bd.
Comment 19 Chiitoo 2013-10-02 17:48:58 UTC
Many thanks!

I can't say for this particular app, but from a quick look-see, it looks like it's fixed for FINAL FANTASY XI Online (test-server client).


gokuro~
Comment 20 Bruno Jesus 2014-01-29 05:19:58 UTC
(In reply to comment #18)
> Should be fixed by db86409db66362c56031429ec124e65064e4f0bd.

(In reply to comment #19)
> Many thanks!
> 
> I can't say for this particular app, but from a quick look-see, it looks
> like it's fixed for FINAL FANTASY XI Online (test-server client).

Assuming fixed as per last comment.
Comment 21 Alexandre Julliard 2014-02-07 13:06:42 UTC
Closing bugs fixed in 1.7.12.


Privacy Policy
If you have a privacy inquiry regarding this site, please write to [email protected]

Hosted By CodeWeavers