WineHQ
Bug Tracking Database – Bug 8539

 Bugzilla

 

Last modified: 2014-03-07 14:13:29 UTC  

VMXBuider 0.8 (VB6 app) fails to create new VM, reporting "Run-time error '-2147417848 (80010108)': Automation error"

First Last Prev Next    This bug is not in your last search results.
Bug 8539 - VMXBuider 0.8 (VB6 app) fails to create new VM, reporting "Run-time error '-2147417848 (80010108)': Automation error"
VMXBuider 0.8 (VB6 app) fails to create new VM, reporting "Run-time error '-2...
Status: CLOSED FIXED
AppDB: Show Apps affected by this bug
Product: Wine
Classification: Unclassified
Component: oleaut32
0.9.25.
x86-64 Linux
: P2 normal
: ---
Assigned To: Mr. Bugs
http://uni-smr.ac.ru/archive/vm/VMWar...
: download
Depends on:
Blocks: 35635
  Show dependency tree
 
Reported: 2007-05-29 13:14 UTC by Dennis Schneck
Modified: 2014-03-07 14:13 UTC (History)
2 users (show)

See Also:
Regression SHA1:
Fixed by SHA1: 4da741daf16f041f0222f4fb71ef648d759251df
Distribution: ---
Staged patchset:

Attachments
Debug Log File (10.82 KB, text/plain)
2007-05-29 13:19 UTC, Dennis Schneck 		Details
patch (1.62 KB, patch)
2014-02-21 05:53 UTC, Nikolay Sivov 		Details | Diff
View All Add an attachment (back traces, logs, proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dennis Schneck 2007-05-29 13:14:44 UTC 
VMXBuilder crash
Comment 1 Dennis Schneck 2007-05-29 13:19:45 UTC 
Created attachment 6513 [details]
Debug Log File

Debug Logfile
Comment 2 Dennis Schneck 2007-05-29 13:20:38 UTC 
Useing Debian GNU Linux 4.0 with wine-0.9.25.

Wann use VMXBuilder:

http://petruska.stardock.net/Software/VMware.html

Install:

1. CoreFiles
http://petruska.stardock.net/Software/Files/CoreSetup.exe

2. VMXBuilder
http://petruska.stardock.net/Software/Files/VMXBuilderSetup.exe

4. run VMXBuilder

wine .wine/drive_c/Program\ Files/RDPSoftware/VMware/VMX\ Builder/VMXBuilder.exe

5. create a "New Virtual Maschine"

then the "VMXBuilder.exe" crash
Comment 3 Vitaliy Margolen 2007-05-29 13:56:16 UTC 
Please upgrade to more recent version of Wine, remove ~/.wine directory and try
again. Also when you attach debug logs please make sure it is complete. Your log
missing actual crash, the information that is really important!

Also I assume you have contacted author of that software?
> Caution! This is still in Beta test!
> Please send any bug reports to my email, with Subject "VMX Builder Bugs".
Comment 4 Louis Lenders 2007-05-29 14:50:27 UTC 
Confirming. Looks like another bug in oleaut32. With following workaround the
next window comes up just fine: 

1. Copy scrrun.dll to system32, and do regsvr32 scrrun.dll
2. Using native oleaut32.dll
Comment 5 Dennis Schneck 2007-05-30 04:26:03 UTC 
>1. Copy scrrun.dll to system32, and do regsvr32 scrrun.dll

i needed the MFC42.DLL to register, but nothing happend
the same problem.

I tryed it on a fedora core 6 with wine wine-0.9.32 too

thanks
Comment 6 Dennis Schneck 2007-05-30 04:27:27 UTC 
wine .wine/drive_c/Program\ Files/RDPSoftware/VMware/VMX\ Builder/VMXBuilder.exe 
fixme:ole:OleLoadPictureEx
(0xa43824,25222,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=0,y=0,f=0,0x33fae8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x16d428),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x16d588),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x16d620),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x16d6b8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x16d750),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x16d7e0),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x16da28),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x16dac8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x16db68),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,6974,1,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=0,y=0,f=0,0x33fa88),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,6974,1,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=0,y=0,f=0,0x33fa88),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x178858),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x1789d0),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x178a60),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x178af0),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x178b80),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x178c10),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x178e48),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa43824,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x178ec0),
partially implemented.
fixme:ole:OLEPictureImpl_SaveAsFile (0x15f3e0)->(0x182a38, 0, (nil)), hacked stub.
fixme:ole:OLEPictureImpl_Render Not quite correct implementation of rendering
icons...
fixme:shell:BrsFolder_OnCreate flags 140 not implemented
fixme:ole:OLEPictureImpl_Render Not quite correct implementation of rendering
icons...
fixme:win:LockWindowUpdate (0x10038), partial stub!
fixme:win:LockWindowUpdate ((nil)), partial stub!
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x20edf8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x173830),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x1738a8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x21ae88),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x21af20),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x216898),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18a2b38),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18a2bb0),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=18,y=18,f=0,0x18a8560),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=18,y=18,f=0,0x18a85d8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=18,y=18,f=0,0x18a8650),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=18,y=18,f=0,0x18a86c8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9118),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d92a0),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9330),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9408),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9480),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9558),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9758),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9800),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9890),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9938),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d9aa8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e0720),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e0898),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e0928),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e09e0),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e0a78),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e0b10),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e0d08),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e0d98),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e0e28),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e0fc8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e1070),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e10e8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e1248),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e1310),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e1388),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e1418),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18e1500),
partially implemented.
fixme:ole:OLEPictureImpl_get_hPal unimplemented for type 3. Returning 0 palette.
fixme:ole:OLEPictureImpl_get_hPal unimplemented for type 3. Returning 0 palette.
fixme:ole:OLEPictureImpl_get_hPal unimplemented for type 3. Returning 0 palette.
fixme:ole:OLEPictureImpl_get_hPal unimplemented for type 3. Returning 0 palette.
fixme:ole:OLEPictureImpl_FindConnectionPoint no connection point for
{33ad4ed2-6699-11cf-b70c-00aa0060d393}
fixme:ole:OLEPictureImpl_FindConnectionPoint no connection point for
{33ad4ed2-6699-11cf-b70c-00aa0060d393}
fixme:ole:OLEPictureImpl_FindConnectionPoint no connection point for
{33ad4ed2-6699-11cf-b70c-00aa0060d393}
fixme:ole:OLEPictureImpl_FindConnectionPoint no connection point for
{33ad4ed2-6699-11cf-b70c-00aa0060d393}
fixme:ole:OLEPictureImpl_FindConnectionPoint no connection point for
{33ad4ed2-6699-11cf-b70c-00aa0060d393}
fixme:ole:OLEPictureImpl_FindConnectionPoint no connection point for
{33ad4ed2-6699-11cf-b70c-00aa0060d393}
fixme:ole:OLEPictureImpl_FindConnectionPoint no connection point for
{33ad4f92-6699-11cf-b70c-00aa0060d393}
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x20ddc0),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x20e180),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x20f3b0),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x18ecdf8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x18ec968),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=22,y=22,f=0,0x18eb928),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d00d0),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=16,y=16,f=0,0x18d0148),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=18,y=18,f=0,0x18cafa8),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=18,y=18,f=0,0x18cb020),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=18,y=18,f=0,0x18cb098),
partially implemented.
fixme:ole:OleLoadPictureEx
(0xa4a694,0,0,{7bf80980-bf32-101a-8bbb-00aa00300cab},x=18,y=18,f=0,0x18cb110),
partially implemented.
err:region:CombineRgn Invalid rgn=(nil)
err:region:CombineRgn Invalid rgn=(nil)
fixme:ole:OLEPictureImpl_Render type 0 not implemented
wine: Unhandled page fault on read access to 0x00000000 at address 0x7a6705ad
(thread 0009), starting debugger...
Comment 7 Louis Lenders 2007-05-30 06:35:35 UTC 
>i needed the MFC42.DLL to register, but nothing happend ,the same problem.

You forgot the second step in the work-around: copy oleaut32.dll from a windows
partition to ~/.wine/drive_c/windows/system32/ and run with
WINEDLLOVERRIDES="oleaut32=n" wine applicationname.exe

(that's what i meant with using native oleaut32)
Comment 8 Dennis Schneck 2007-05-30 07:02:43 UTC 
thanks very much ! that helps ! i looks like it works!
Comment 9 Vitaliy Margolen 2007-05-30 07:23:01 UTC 
Please DO NOT PASTE logs or back traces!
Comment 10 Louis Lenders 2008-03-06 02:13:20 UTC 
Still present in current git. As for the scrrun.dll, it comes free with AlltoAvi ( http://downloads.sourceforge.net/alltoavi/AllToAVI_v4_r5394_Setup.exe?modtime=1185303407&big_mirror=0 ), so i guess not part of Windows so no need to implement that one. Bug in oleaut32 still present
Comment 11 Austin English 2009-01-10 17:04:34 UTC 
Still present in git.
Comment 12 Nikolay Sivov 2009-10-19 09:55:49 UTC 
It works with wine-1.1.31-272-g8c743cb. Create New VM button doesn't crash this program. I'm not able to actually create VM - it exits with runtime error telling me that I don't have some license.

Could someone test again with 1.1.31?
Comment 13 Louis Lenders 2009-11-24 11:05:52 UTC 
(In reply to comment #12)
> It works with wine-1.1.31-272-g8c743cb. Create New VM button doesn't crash this
> program. I'm not able to actually create VM - it exits with runtime error
> telling me that I don't have some license.
> 
> Could someone test again with 1.1.31?

Still present (wine-1.1.33). The app crashes for me. Native oleaut32 works around the bug

(make sure first do winetricks wsh56)
Comment 14 Austin English 2009-11-24 12:05:56 UTC 
Please attach a +ole,+relay,+seh,+tid trace.
Comment 15 Austin English 2011-05-09 15:13:34 UTC 
Download url is dead, please retest in 1.3.19 or newer wine and update url if a new one is available.
Comment 16 Austin English 2013-11-13 16:49:12 UTC 
This is your friendly reminder that there has been no bug activity for 2 years. Is this still an issue in current (1.7.6 or newer) wine? If so, please attach the terminal output in 1.7.6 (see http://wiki.winehq.org/FAQ#get_log).
Comment 17 Anastasius Focht 2014-01-01 16:17:24 UTC 
Hello folks,

confirming, still present.

prerequisite: 'winetricks -q vb6run comctl32ocx tabctl32'

The app complains about missing 'MSCOMCT2.OCX' (Microsoft Windows Common Controls-2 6.0) on startup.

http://support.microsoft.com/kb/297381

Download: http://activex.microsoft.com/controls/vb6/mscomct2.cab

Maybe this could be added to winetricks.

Trace log:

--- snip ---
$ pwd
/home/focht/.wine/drive_c/Program Files/RDPSoftware/VMware/VMX Builder

$ WINEDEBUG=+tid,+seh,+relay,+snoop,+ole,+variant wine ./VMXBuilder.exe >>log.txt 2>&1
...
0025:CALL MSVBVM60.__vbaAryRecCopy(<unknown, check return>) ret=48754a9c
0025:Call oleaut32.SafeArrayCopy(01b85044,01b84fd0) ret=66103c0e
0025:trace:variant:SafeArrayCopy (0x1b85044,0x1b84fd0)
0025:trace:variant:SafeArrayGetVartype (0x1b85044,0x33e102)
0025:trace:variant:SafeArrayAllocDescriptorEx (36->VT_RECORD,2,0x1b84fd0)
0025:trace:variant:SafeArrayAllocDescriptor (2,0x1b84fd0)
0025:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7e7b19ac
0025:Ret  ntdll.RtlAllocateHeap() retval=01ba3ed0 ret=7e7b19ac
0025:trace:variant:SafeArrayAllocDescriptor (2): 32 bytes allocated for descriptor.
0025:Call ntdll.RtlAllocateHeap(00110000,00000008,000001a0) ret=7e7b19ac
0025:Ret  ntdll.RtlAllocateHeap() retval=01ba3f08 ret=7e7b19ac
0025:trace:variant:SafeArrayGetRecordInfo (0x1b85044,0x33e0a4)
0025:trace:ole:IRecordInfoImpl_AddRef (0x1b839a8) -> 14
0025:trace:variant:SafeArraySetRecordInfo (0x1ba3ee0,0x1b839a8)
0025:trace:ole:IRecordInfoImpl_AddRef (0x1b839a8) -> 15
0025:trace:ole:IRecordInfoImpl_Release (0x1b839a8) -> 14
0025:Ret  oleaut32.SafeArrayCopy() retval=00000000 ret=66103c0e
0025:RET  MSVBVM60.__vbaAryRecCopy(4872ce2c,01b84fd0,0033e1ac) retval=00000000 ret=48754a9c 
...
0025:CALL MSVBVM60.__vbaAryRecCopy(4872ce2c,01b84fd0,0033e1ac) ret=48754a9c
0025:Call oleaut32.SysFreeString(00000000) ret=6600e1a9
0025:Ret  oleaut32.SysFreeString() retval=0033e130 ret=6600e1a9
0025:Call oleaut32.SysFreeString(00000000) ret=6600e1ae
0025:Ret  oleaut32.SysFreeString() retval=0033e130 ret=6600e1ae
0025:Call oleaut32.SysFreeString(00000000) ret=6600e1b3
0025:Ret  oleaut32.SysFreeString() retval=0033e130 ret=6600e1b3
0025:Call KERNEL32.MultiByteToWideChar(00000000,00000000,4872b434 "VirtualMachineComps",ffffffff,00000000,00000000) ret=660da0b1
0025:Ret  KERNEL32.MultiByteToWideChar() retval=00000014 ret=660da0b1
0025:Call oleaut32.SysAllocStringLen(00000000,00000013) ret=660da0bc
0025:trace:ole:SysAllocStringLen (null)
0025:Ret  oleaut32.SysAllocStringLen() retval=01b95764 ret=660da0bc
0025:Call KERNEL32.MultiByteToWideChar(00000000,00000000,4872b434 "VirtualMachineComps",ffffffff,01b95764,00000014) ret=660da0db
0025:Ret  KERNEL32.MultiByteToWideChar() retval=00000014 ret=660da0db
0025:Call KERNEL32.RaiseException(c000008f,00000001,00000002,0033e154) ret=660d0956
0025:trace:seh:raise_exception code=c000008f flags=1 addr=0x7b83a89f ip=7b83a89f tid=0025
0025:trace:seh:raise_exception  info[0]=deadcafe
0025:trace:seh:raise_exception  info[1]=deadcafe
0025:trace:seh:raise_exception  eax=7b826921 ebx=7b8ba000 ecx=deadcafe edx=0033e0b4 esi=0033e154 edi=0033e120
0025:trace:seh:raise_exception  ebp=0033e0f8 esp=0033e094 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00200283
0025:trace:seh:call_stack_handlers calling handler at 0x48723286 code=c000008f flags=1
0025:CALL MSVBVM60.__vbaExceptHandler(<unknown, check return>) ret=7bc864f1 
...
0025:Call winex11.drv.SetWindowText(00020324,00215058 L"Run-time error '-2147417848 (80010108)':\n\nAutomation error") ret=7ec9f739
0025:Ret  winex11.drv.SetWindowText() retval=00000000 ret=7ec9f739
...
--- snip ---

The exception is thrown from VB6 runtime on __vbaAryRecCopy entry, it doesn't expect psa->fFeatures = 0x32 (FADF_RECORD | FADF_FIXEDSIZE | FADF_STATIC).

There is a test for psa->fFeatures flags: if any of (FADF_FIXEDSIZE | FADF_EMBEDDED | FADF_STATIC | FADF_AUTO) set (0x17) -> throw.
The FADF_RECORD type is ok (expected).

Maybe native 'sanitizes' some feature flags during first __vbaAryRecCopy from target safearray hence the second time when the safe array is now passed as source array these flags are not present (the app VB code doesn't touch them in between both __vbaAryRecCopy calls).

The caller is 'VMComps.dll' which consists of VB6 compiled native code (called from main VB6 VMXBuilder.exe).

$ sha1sum VMXBuilderSetup.exe 
f86ac9a2cc7070e200dce0aac0d7c2bd1e8f4543  VMXBuilderSetup.exe

$ du -sh VMXBuilderSetup.exe 
520K	VMXBuilderSetup.exe

$ wine --version
wine-1.7.9-286-g8f53710

Regards
Comment 18 Anastasius Focht 2014-01-09 16:44:05 UTC 
Hello folks,

commit http://source.winehq.org/git/wine.git/commitdiff/b058c96136850e543d171d766e5b132ba952cfb5 from bug 23005 helped a bit, the pre-checks of 'psa->fFeatures' on __vbaAryRecCopy() entry are now passed.

Still crashes though.

--- snip ---
$ pwd
/home/focht/.wine/drive_c/Program Files/RDPSoftware/VMware/VMX Builder

$ WINEDEBUG=+tid,+seh,+relay,+snoop,+ole,+variant wine ./VMXBuilder.exe >>log.txt 2>&1
...
0028:Call oleaut32.SafeArrayAllocData(01ba6c98) ret=660db9e8
0028:trace:variant:SafeArrayAllocData (0x1ba6c98)
0028:Call ntdll.RtlAllocateHeap(00110000,00000008,000001a0) ret=7e7b19ac
0028:Ret  ntdll.RtlAllocateHeap() retval=01ba6e58 ret=7e7b19ac
0028:trace:variant:SafeArrayAllocData 416 bytes allocated for data at 0x1ba6e58 (52 objects).
0028:Ret  oleaut32.SafeArrayAllocData() retval=00000000 ret=660db9e8
0028:Call oleaut32.SafeArraySetRecordInfo(01ba6c98,01ba5668) ret=660dba31
0028:trace:variant:SafeArraySetRecordInfo (0x1ba6c98,0x1ba5668) 
...
0028:Call oleaut32.SafeArrayCopy(01ba6d04,01ba6c90) ret=66103c0e
0028:trace:variant:SafeArrayCopy (0x1ba6d04,0x1ba6c90)
0028:trace:variant:SafeArrayGetVartype (0x1ba6d04,0x33e102)
0028:trace:variant:SafeArrayAllocDescriptorEx (36->VT_RECORD,2,0x1ba6c90)
0028:trace:variant:SafeArrayAllocDescriptor (2,0x1ba6c90)
0028:Call ntdll.RtlAllocateHeap(00110000,00000008,00000030) ret=7e7b19ac
0028:Ret  ntdll.RtlAllocateHeap() retval=01bc5b90 ret=7e7b19ac
0028:trace:variant:SafeArrayAllocDescriptor (2): 32 bytes allocated for descriptor.
0028:Call ntdll.RtlAllocateHeap(00110000,00000008,000001a0) ret=7e7b19ac
0028:Ret  ntdll.RtlAllocateHeap() retval=01bc5bc8 ret=7e7b19ac
0028:trace:variant:SafeArrayGetRecordInfo (0x1ba6d04,0x33e0a4)
0028:trace:ole:IRecordInfoImpl_AddRef (0x1ba5668) -> 14
0028:trace:variant:SafeArraySetRecordInfo (0x1bc5ba0,0x1ba5668)
0028:trace:ole:IRecordInfoImpl_AddRef (0x1ba5668) -> 15
0028:trace:ole:IRecordInfoImpl_Release (0x1ba5668) -> 14
0028:Ret  oleaut32.SafeArrayCopy() retval=00000000 ret=66103c0e
0028:RET  MSVBVM60.__vbaAryRecCopy(4872ce2c,01ba6c90,0033e1ac) retval=00000000 ret=48754a9c 
0028:CALL MSVBVM60.__vbaAryRecCopy(4872ce2c,01ba6c90,0033e1ac) ret=48754a9c
0028:Call oleaut32.SafeArrayDestroyData(01bc5ba0) ret=660db598
0028:trace:variant:SafeArrayDestroyData (0x1bc5ba0)
0028:trace:variant:SafeArrayGetRecordInfo (0x1bc5ba0,0x33e0b8)
0028:trace:ole:IRecordInfoImpl_AddRef (0x1ba5668) -> 15
0028:trace:ole:IRecordInfoImpl_RecordClear (0x1ba5668)->(0x1bc5bc8)
0028:trace:ole:IRecordInfoImpl_RecordClear (0x1ba5668)->(0x1bc5be8)
0028:trace:ole:IRecordInfoImpl_RecordClear (0x1ba5668)->(0x1bc5c08)
0028:Call ntdll.RtlFreeHeap(00110000,00000000,01bab4f0) ret=7e7a03d6
0028:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7e7a03d6
0028:trace:ole:IRecordInfoImpl_RecordClear (0x1ba5668)->(0x1bc5c28)
0028:Call ntdll.RtlFreeHeap(00110000,00000000,01bab530) ret=7e7a03d6
0028:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7e7a03d6
...
0028:trace:ole:IRecordInfoImpl_RecordClear (0x1ba5668)->(0x1bc5d48)
0028:Call ntdll.RtlFreeHeap(00110000,00000000,01bab838) ret=7e7a03d6
0028:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7e7a03d6
0028:Call ntdll.RtlFreeHeap(00110000,00000000,01bab870) ret=7e7a03d6
0028:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7e7a03d6
0028:trace:ole:IRecordInfoImpl_RecordClear (0x1ba5668)->(0x1bc5d68)
0028:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7e7a01e5 ip=7e7a01e5 tid=0028
0028:trace:seh:raise_exception  info[0]=00000000
0028:trace:seh:raise_exception  info[1]=00002935
0028:trace:seh:raise_exception  eax=00002935 ebx=7e8aa000 ecx=0033e010 edx=00000000 esi=0033e090 edi=7e7aff38
0028:trace:seh:raise_exception  ebp=0033dff8 esp=0033dfc0 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00210206
0028:trace:seh:call_stack_handlers calling handler at 0x48723286 code=c0000005 flags=0
0028:CALL MSVBVM60.__vbaExceptHandler(<unknown, check return>) ret=7bc866c9 
--- snip ---

Release of old resources before copy new data:

__vbaAryRecCopy() -> __vbaErase() -> SafeArrayDestroyData() on target safearray 

Seems some double free of bstr.

--- snip ---
Wine-dbg>bt
Backtrace:
=>0 0x7e7a01e2 SysFreeString+0x36(str=<couldn't compute location>) [/home/focht/projects/wine/wine-git/dlls/oleaut32/oleaut.c:259] in oleaut32 (0x0033e078)
  1 0x7e7aff45 IRecordInfoImpl_RecordClear+0x1f8(iface=<couldn't compute location>, pvExisting=<couldn't compute location>) [/home/focht/projects/wine/wine-git/dlls/oleaut32/recinfo.c:219] in oleaut32 (0x0033e0f8)
  2 0x7e7b2059 SAFEARRAY_DestroyData+0x16b(psa=0x1b53038, ulStartCell=0) [/home/focht/projects/wine/wine-build32/dlls/oleaut32/../../include/oaidl.h:4150] in oleaut32 (0x0033e178)
  3 0x7e7b3d4a SafeArrayDestroyData+0x9f(psa=0x1b53038) [/home/focht/projects/wine/wine-git/dlls/oleaut32/safearray.c:1239] in oleaut32 (0x0033e1c0)
  4 0x660db598 in msvbvm60 (+0xdb597) (0x0033e1f4)
  5 0x48754a9c in vmcomps (+0x34a9b) (0x0033e238)
  6 0x004b5b1a in vmxbuilder (+0xb5b19) (0x0033e2d4)
  7 0x0047650f in vmxbuilder (+0x7650e) (0x0033e37c)
  8 0x660ca914 in msvbvm60 (+0xca913) (0x0033e3d8)

Wine-dbg>p *This
{IRecordInfo_iface={lpVtbl=0x7e8c0700}, ref=0xf, guid={Data1=0x97dfd25d, Data2=0x596c, Data3=0x4f93, Data4="????"}, lib_index=0, n_vars=0x2, size=0x8, name="GuestOSVer", fields=0x1b32a78, pTypeInfo=0x1b32888}

...

{vt=VT_BSTR, varkind=VAR_PERINSTANCE, offset=0, name="DisplayedName"}
{vt=VT_BSTR, varkind=VAR_PERINSTANCE, offset=0x4, name="ConfigName"}
--- snip ---

Disabling bstr caching with OANOCACHE=1 didn't change behaviour (point of crash didn't move).

Regards
Comment 19 Nikolay Sivov 2014-01-10 06:26:51 UTC 
I don't trust IRecordInfo to be honest, mostly because it doesn't have any tests. I'll try to find time this weekend to improve the situation.
Comment 20 Nikolay Sivov 2014-01-14 03:37:14 UTC 
I just sent some tests for IRecordInfo, and now it's clearly doesn't look good. RecordCopy() is completely wrong, RecordClear() is incomplete. I also hit some potential typelib problems, need to solve these first.
Comment 21 Anastasius Focht 2014-02-04 16:26:25 UTC 
Hello folks,

still present with http://source.winehq.org/git/wine.git/commitdiff/60252ea65bbdf991938d919cd4c734809fb899bf

--- snip ---
...
0024:trace:ole:IRecordInfoImpl_RecordClear (0x1e35bc8)->(0x1e56090)
0024:Call ntdll.RtlFreeHeap(00110000,00000000,01e3bd40) ret=7e7b73c2
0024:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7e7b73c2
0024:Call ntdll.RtlFreeHeap(00110000,00000000,01e3bd78) ret=7e7b73c2
0024:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7e7b73c2
0024:trace:ole:IRecordInfoImpl_RecordClear (0x1e35bc8)->(0x1e560b0)
0024:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7e7b71d1 ip=7e7b71d1 tid=0024
0024:trace:seh:raise_exception  info[0]=00000000
0024:trace:seh:raise_exception  info[1]=00002935
0024:trace:seh:raise_exception  eax=00002935 ebx=7e8c2000 ecx=0033e010 edx=00000000 esi=0033e090 edi=7e7c6f38
0024:trace:seh:raise_exception  ebp=0033dff8 esp=0033dfc0 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00210206
0024:trace:seh:call_stack_handlers calling handler at 0x48723286 code=c0000005 flags=0
0024:CALL MSVBVM60.__vbaExceptHandler(<unknown, check return>) ret=7bc867c1 
...
--- snip ---

$ wine --version
wine-1.7.11-237-g00aeadc

Regards
Comment 22 Austin English 2014-02-06 14:34:14 UTC 
(In reply to comment #17)
> Hello folks,
> 
> confirming, still present.
> 
> prerequisite: 'winetricks -q vb6run comctl32ocx tabctl32'
> 
> The app complains about missing 'MSCOMCT2.OCX' (Microsoft Windows Common
> Controls-2 6.0) on startup.
> 
> http://support.microsoft.com/kb/297381
> 
> Download: http://activex.microsoft.com/controls/vb6/mscomct2.cab
> 
> Maybe this could be added to winetricks.

https://code.google.com/p/winetricks/source/detail?r=1103
Comment 23 Nikolay Sivov 2014-02-06 22:30:13 UTC 
The reason it crashes right now is that IRecordInfo_RecordClear() gets some invalid pointers when it tries to free BSTRs (values like 0x141 for example), need to figure out where these come from.
Comment 24 Nikolay Sivov 2014-02-08 08:16:22 UTC 
I spent some time today on this, and now I can say that SafeArrayCopyData() is broken when array is IRecordInfo based - this call just copies over pointers from existing array, and this is obviously won't go very well. Proper way to do so is to call IRecordInfo_RecordCopy(), I have some tests for that but need more time to polish them. Anyway it's not enough, after this fixed it still crashes in RecordCopy() on BSTR field. So it's really about safearray<->recordinfo interoperation as far as I can tell.
Comment 25 Nikolay Sivov 2014-02-18 22:29:47 UTC 
(In reply to comment #24)
> I spent some time today on this, and now I can say that SafeArrayCopyData()
> is broken when array is IRecordInfo based - this call just copies over
> pointers from existing array, and this is obviously won't go very well.
> Proper way to do so is to call IRecordInfo_RecordCopy(), I have some tests
> for that but need more time to polish them. Anyway it's not enough, after
> this fixed it still crashes in RecordCopy() on BSTR field. So it's really
> about safearray<->recordinfo interoperation as far as I can tell.

This one is fixed with http://source.winehq.org/git/wine.git/?a=commit;h=f85644c6f9d8f350ce19954fcbe5bed9d88856a3.
Comment 26 Anastasius Focht 2014-02-19 02:00:53 UTC 
Hello folks,

indeed, fixed by commit http://source.winehq.org/git/wine.git/?a=commit;h=f85644c6f9d8f350ce19954fcbe5bed9d88856a3

Thanks Nikolay

Regards
Comment 27 Nikolay Sivov 2014-02-19 02:19:50 UTC 
No, bug itself is not fixed. Still crashes for me on invalid pointer passed to SysFreeString(). Looks related to multidimensional array being used.
Comment 28 Anastasius Focht 2014-02-19 02:38:24 UTC 
Hello Nikolay,

you're right, it still crashes here too.
I made a mistake earlier while installing the app for test (applied winetricks step after install).

Regards
Comment 29 Nikolay Sivov 2014-02-21 05:53:40 UTC 
Created attachment 47592 [details]
patch

So it was actually a clearly visible problem, or two:

- with my recent patch I screwed up pointer incrementing when copying;
- after copy destination array wasn't updated with actual element size,
  this results in a crash on destroy, because it tries to do 32 byte increments
  (default value), instead of 16 bytes in this particular case of a structure
  with 2 BSTR pointers.

After this fixed (patch attached), next problem is clear:

---
fixme:scrrun:filesys_QueryInterface Unsupported interface {7fd52380-4e07-101b-ae2d-08002b2ec713}
fixme:scrrun:filesys_QueryInterface Unsupported interface {37d84f60-42cb-11ce-8135-00aa004bb851}
fixme:scrrun:filesys_get_Drives 0x7d510ef4 0x33f260
fixme:scrrun:filesys_QueryInterface Unsupported interface {df0b3d60-548f-101b-8e65-08002b2bd119}
---

with Runtime error '445' message box.
Comment 30 Anastasius Focht 2014-02-24 16:02:35 UTC 
Hello folks,

this is fixed by commit http://source.winehq.org/git/wine.git/commitdiff/4da741daf16f041f0222f4fb71ef648d759251df

(including multiple oleaut32 ones up to this commit)

A lot of crappy VB6 apps will be happy now ;-)

Thanks Nikolay

Regards
Comment 31 Alexandre Julliard 2014-03-07 14:13:29 UTC 
Closing bugs fixed in 1.7.14.
First Last Prev Next    This bug is not in your last search results.

Privacy Policy
If you have a privacy inquiry regarding this site, please write to [email protected]

Hosted By CodeWeavers