[Bug 58363] New: Thief and Thief II crash in an unpredictable way when loading certain missions

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

Bug ID: 58363
           Summary: Thief and Thief II crash in an unpredictable way when
                    loading certain missions
           Product: Wine
           Version: 10.10
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 78761
  --> http://bugs.winehq.org/attachment.cgi?id=78761
Backtrace for latest crash

Ever since Wine 10.0 I've been experiencing various crashes when playing Thief
Gold and Thief II, with the crashes themselves happening either upon a cutscene
being played, or right after having finished it. The crashes seem to also be
unpredictable; some cutscenes will play just fine with the mission loading
afterwards, some will crash.

As an example, I often experience a crash when loading the first mission in
Thief Gold. Sometimes the cutscene plays but the game crashes after finishing
it (or skipping it with ESC), sometimes the game crashes even before playing
the cutscene. Some other times everything works out fine with the first
mission, but I experience a crash when loading the second.

Sometimes it helps to move the cutscene folder elsewhere. Movies no longer play
but missions seem to load. Unfortunately, crashes end up happening anyway when
loading other missions.

Even more interestingly, sometimes I am able to play a mission that was
crashing before by moving away the cutscene folder, load the mission, then move
back the cutscene folder. The crash no longer happens afterwards. Still, this
is no sure solution either - it works sometimes but it doesn't some other
times.

Crashes sometimes seem to be related to the game scripts. contained in script
modules with the extension OSM. As an example, here are the last lines in the
thief.log file after having experienced a crash:

: Loaded script module "miss03.osm" [FileModDate=2018-Jul-03]
: Loaded script module "script-t1.osm" [FileVer=2.1.0.0 ; ProductVer=2.1.0.0 ;
FileModDate=2018-Jul-03]

I'm also including the backtrace for a crash that occurred upon loading the
second mission in Thief Gold, the crash having happened after having skipped
the introductory cutscene.

What I've described happens on a clean 32-bit Wine 10.10 prefix. Both games
have been installed using the latest GOG installers. Though System Shock 2 runs
on the same engine, I haven't experienced any crash there (thus far).

[Bug 58363] Thief and Thief II crash in an unpredictable way when loading certain missions

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #1 from Ken Sharp  ---
The backtrace says you are using Staging, not vanilla Wine. Does this occur
with vanilla Wine?

I know you said that it is unpredictable but are you able to test the demo for
the same result?
https://archive.org/details/ThiefIiTheMetalAgeDemo
(Assuming that's the correct game)

[Bug 58363] Thief and Thief II crash in an unpredictable way when loading certain missions

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #2 from Jay451  ---
(In reply to Jay451 from comment #0)
> Created attachment 78761 [details]
> Backtrace for latest crash
>
> Ever since Wine 10.0 I've been experiencing various crashes when playing
> Thief Gold and Thief II, with the crashes themselves happening either upon a
> cutscene being played, or right after having finished it. The crashes seem
> to also be unpredictable; some cutscenes will play just fine with the
> mission loading afterwards, some will crash.
>
> As an example, I often experience a crash when loading the first mission in
> Thief Gold. Sometimes the cutscene plays but the game crashes after
> finishing it (or skipping it with ESC), sometimes the game crashes even
> before playing the cutscene. Some other times everything works out fine with
> the first mission, but I experience a crash when loading the second.
>
> Sometimes it helps to move the cutscene folder elsewhere. Movies no longer
> play but missions seem to load. Unfortunately, crashes end up happening
> anyway when loading other missions.
>
> Even more interestingly, sometimes I am able to play a mission that was
> crashing before by moving away the cutscene folder, load the mission, then
> move back the cutscene folder. The crash no longer happens afterwards.
> Still, this is no sure solution either - it works sometimes but it doesn't
> some other times.
>
> Crashes sometimes seem to be related to the game scripts. contained in
> script modules with the extension OSM. As an example, here are the last
> lines in the thief.log file after having experienced a crash:
>
> : Loaded script module "miss03.osm" [FileModDate=2018-Jul-03]
> : Loaded script module "script-t1.osm" [FileVer=2.1.0.0 ; ProductVer=2.1.0.0
> ; FileModDate=2018-Jul-03]
>
> I'm also including the backtrace for a crash that occurred upon loading the
> second mission in Thief Gold, the crash having happened after having skipped
> the introductory cutscene.
>
> What I've described happens on a clean 32-bit Wine 10.10 prefix. Both games
> have been installed using the latest GOG installers. Though System Shock 2
> runs on the same engine, I haven't experienced any crash there (thus far).

I have used Wine Stable before, in fact I had been using Wine Stable until
recently, when I switched to Staging so as to check if the issue had been fixed
in the meantime. I've been encountering the same issues on both versions. The
problem was not happening at all before Wine 10.0, in fact if I install Wine
9.22 from Ubuntu's repositories the games run without any issues.

The demo you linked runs on a much older version of the engine (OldDark) which
doesn't correspond to the one used in the modern Steam and GOG rereleases
(NewDark). The demos to Thief and Thief II have been converted to NewDark, and
you can find them at the following links:
https://www.moddb.com/mods/thief-the-dark-project-unified-demo
https://www.moddb.com/mods/thief-ii-demo-unwelcome-guest/downloads/thief-ii-...

I have just tried running both of those demos and have admittedly not
encountered any issues. However, I have also reinstalled the latest GOG
versions of the full games on a clean 32-bit Wine prefix and am still
encountering the same issues. Unfortunately I think the full game is needed to
reproduce the problem.

[Bug 58363] Thief and Thief II crash in an unpredictable way when loading certain missions

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #3 from Ken Sharp  ---
Thank you for testing the demos.

Sounds like a regression test will help here.
https://gitlab.winehq.org/wine/wine/-/wikis/Regression-Testing

[Bug 58363] Thief and Thief II crash in an unpredictable way when loading certain missions

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #4 from Jay451  ---
(In reply to Ken Sharp from comment #3)
> Thank you for testing the demos.
>
> Sounds like a regression test will help here.
> https://gitlab.winehq.org/wine/wine/-/wikis/Regression-Testing

I've checked out the page. That method sounds interesting. The responsible
patch should probably be somewhere between Wine 9.22 and Wine 10.0, including
the release candidates in the middle. I might try it out sometime in the
future.

[Bug 58363] Thief and Thief II crash in an unpredictable way when loading certain missions

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

Béla Gyebrószki  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
           Keywords|                            |regression

--- Comment #5 from Béla Gyebrószki  ---
Note that I made only a cursory test with these games (Thief Gold and Thief 2
from GOG.com).
There is a method to reliably reproduce the crash in Thief 2 (does not work
with Thief Gold though): start a new game from the main menu. When the game is
loaded press <ESC> and select <Restart> in the menu: the cinematic video plays
OK but when I click on the <Continue> button the game crashes.

@Jay451: can you reliably reproduce the crash following those steps ? If so,
the regression test is a bit easier to perform.

My regression test resulted:
commit 013b70d46135ec976547ef23c96d4b15a8843fa7
msvcrt: Call _wgetcwd in _getcwd function.

It is from Wine-10.0-rc1 so you were right about that assumption.

Workaround: Native msvcr90.dll makes the crash go away in Thief 2. (winetricks
vcrun2008)

As for Thief Gold: the game always crashes for me when trying to play the first
(intro) video but that is due to another commit.

Tested with Wine-10.10.

[Bug 58363] Thief and Thief II crash in an unpredictable way when loading certain missions

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #6 from Jay451  ---
(In reply to Béla Gyebrószki from comment #5)
> Note that I made only a cursory test with these games (Thief Gold and Thief
> 2 from GOG.com).
> There is a method to reliably reproduce the crash in Thief 2 (does not work
> with Thief Gold though): start a new game from the main menu. When the game
> is loaded press <ESC> and select <Restart> in the menu: the cinematic video
> plays OK but when I click on the <Continue> button the game crashes.
>
> @Jay451: can you reliably reproduce the crash following those steps ? If so,
> the regression test is a bit easier to perform.
>
> My regression test resulted:
> commit 013b70d46135ec976547ef23c96d4b15a8843fa7
> msvcrt: Call _wgetcwd in _getcwd function.
>
> It is from Wine-10.0-rc1 so you were right about that assumption.
>
> Workaround: Native msvcr90.dll makes the crash go away in Thief 2.
> (winetricks vcrun2008)
>
> As for Thief Gold: the game always crashes for me when trying to play the
> first (intro) video but that is due to another commit.
>
> Tested with Wine-10.10.

Thanks for your help, I don't have any experience with Wine regression tests so
I wasn't expecting to try it out myself just yet.

Yes, I can indeed reproduce the crash in Thief 2 following the exact steps
you've described. The workaround you mentioned does seem to solve that
particular crash.

I also experience a crash when playing the first intro video with Thief Gold,
even with the workaround of using the native msvcr90.dll library. Could you
mention the responsible commit just for reference?

The reason why in my previous posts I have reported crashes in different places
is because they seem to be sensitive to changes in the game files (such as
renaming files to lowercase or installing a patch, TFix and T2Fix in this
case). From now on I'll only do further reports by trying out a completely
vanilla install on a clean prefix each time.

[Bug 58363] Thief and Thief II crash in an unpredictable way when loading certain missions

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

Béla Gyebrószki  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|-unknown                    |msvcrt
    Regression SHA1|                            |013b70d46135ec976547ef23c96
                   |                            |d4b15a8843fa7
                 CC|                            |[e-mail]

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

Ken Sharp  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |minor
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
            Summary|Thief and Thief II crash in |Thief II crashes
                   |an unpredictable way when   |
                   |loading certain missions    |

--- Comment #7 from Ken Sharp  ---
As the cause of crashes are different in both games, they need to be logged as
separate bugs.

The cause for the crash in Thief II has been found so let's dedicate this bug
to that particular issue.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

Béla Gyebrószki  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download
                URL|                            |https://www.moddb.com/mods/
                   |                            |thief-ii-demo-unwelcome-gue
                   |                            |st/downloads/thief-ii-demo-
                   |                            |the-unwelcome-guest

--- Comment #8 from Béla Gyebrószki  ---
There is an alternate demo version for both Thief and Thief 2 which can be used
to reproduce the problem. These demos were modified to run the games with the
DarkEngine mod.

Thief 2 'Lost Alpha' demo:
https://www.moddb.com/mods/thief-ii-demo-unwelcome-guest/downloads/thief-ii-...

t2_lost_alpha_1.13.7z
md5sum: 0f50c2afb1f4e5338630ed55dc23052f

Doesn't need installation just extract the archive and start the demo with
thf2demo.exe.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #9 from Piotr Caban  ---
I can't reproduce the crash (movies are all black, I don't know if it's
related).

I have created https://gitlab.winehq.org/wine/wine/-/merge_requests/8349 to
address a bug in _getcwd. On my machine there are only 2 calls to _getcwd:
_getcwd(ptr, 260)
_getcwd(ptr2, 8192)
None of these calls will be affected by the patch.

Could you please give it a try? I'll need a relay log if it still crashes.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #10 from Béla Gyebrószki  ---
(In reply to Piotr Caban from comment #9)
> I can't reproduce the crash (movies are all black, I don't know if it's
> related).
>
> I have created https://gitlab.winehq.org/wine/wine/-/merge_requests/8349 to
> address a bug in _getcwd. On my machine there are only 2 calls to _getcwd:
> _getcwd(ptr, 260)
> _getcwd(ptr2, 8192)
> None of these calls will be affected by the patch.
>
> Could you please give it a try? I'll need a relay log if it still crashes.

The patch doesn't fix the problem for me, tested with Thief 2.
Do you need a debug log using WINEDEBUG=+relay only? I created one but it is
over 2 GB uncompressed.
https://drive.google.com/file/d/1oT6nb6xOop2W07gDOeJ2vJbtdyGASMVC/view?usp=d...

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #11 from Piotr Caban  ---
There are also only 2 calls to _getcwd in your log (when the application
starts). It's very unlikely that this function is causing the crash. Could you
please confirm that regression test result is correct.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #12 from Piotr Caban  ---
From the log:
0024:Call msvcr90.malloc(00020040) ret=005a4ac0
0024:Call ntdll.RtlAllocateHeap(01520000,00000000,00020040) ret=7a3adee6
0024:Ret  ntdll.RtlAllocateHeap() retval=00000000 ret=7a3adee6
0024:Ret  msvcr90.malloc() retval=00000000 ret=005a4ac0

There's a failing malloc call that causes the crash (looks like memory
exhaustion or heap corruption).

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #13 from Béla Gyebrószki  ---
(In reply to Piotr Caban from comment #11)
> There are also only 2 calls to _getcwd in your log (when the application
> starts). It's very unlikely that this function is causing the crash. Could
> you please confirm that regression test result is correct.

I will repeat the regression test tomorrow when I get home.
There are occasions when the game hangs instead of crashing with something like
0194:err:sync:RtlpWaitForCriticalSection section 01420078
"../dlls/ntdll/heap.c: heap.cs" wait timed out in thread 0194, blocked by 0024,
retrying (60 sec)
But these are rarer than the crash.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #14 from Béla Gyebrószki  ---
Created attachment 78794
  --> http://bugs.winehq.org/attachment.cgi?id=78794
backtrace with "-O0 -g"

I checked again and re-ran the regression test on Thief 2 and 'The Lost Alpha
demo'. This time I nuked the prefix and reinstalled the game between each
bisect step. The result was the same however: 013b70d was the first bad commit.
The backtrace looks different when Wine is compiled without optimizations.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #15 from Piotr Caban  ---
I have installed missing gstreamer codecs and the videos are working now. I
still can't reproduce the crash but there's a heap corruption when videos are
played. The heap corruption is still there in old wine that doesn't contain
013b70d commit (HEAD at 013b70d^).

I have also verified that there's heap corruption when native msvcr90 is used.

The game can be executed with ir50_32.dll disabled to workaround heap
corruption (WINEDLLOVERRIDES="ir50_32=d"). Videos will not be played in that
case.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #16 from Béla Gyebrószki  ---
(In reply to Piotr Caban from comment #15)
> I have installed missing gstreamer codecs and the videos are working now. I
> still can't reproduce the crash but there's a heap corruption when videos
> are played. The heap corruption is still there in old wine that doesn't
> contain 013b70d commit (HEAD at 013b70d^).
>
> I have also verified that there's heap corruption when native msvcr90 is
> used.
>
> The game can be executed with ir50_32.dll disabled to workaround heap
> corruption (WINEDLLOVERRIDES="ir50_32=d"). Videos will not be played in that
> case.

Umm...I'm kinda lost here.
Albeit ir50_32.dll as well as ir41_32.dll are both present in the installed
game directory, they are not even used (+loaddll) thus disabling ir50_32.dll
yields nothing: the videos are still playing and the crashes occur.
As I can see, lgvid.ax and lgvid.dll are responsible for video playback in the
game (Thief 2) and disabling lgvid.dll indeed disables the movies in the game
(the crash still occurs though).

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #17 from Piotr Caban  ---
(In reply to Béla Gyebrószki from comment #16)
> Umm...I'm kinda lost here.

You've been testing with GOG version of the game while I was using the demo.

I can reproduce the crash with GOG version of the game. There were 2
regressions. First was 013b70d that broke _getcwd (that was used in _getdcwd).
Next was 7bc161d0171bec69fdaf0256d39b0d93b49e82db that broke _getdcwd. It also
removed usage of _getcwd from _getdcwd function so fixing _getcwd didn't make
any difference.

I've created https://gitlab.winehq.org/wine/wine/-/merge_requests/8371 that
fixes _getdcwd.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

--- Comment #18 from Béla Gyebrószki  ---
(In reply to Piotr Caban from comment #17)
> I've created https://gitlab.winehq.org/wine/wine/-/merge_requests/8371 that
> fixes _getdcwd.

Thanks for your work Piotr, the patch fixes the crash in Thief 2 and System
Shock 2 for me.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

Piotr Caban  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |4fb71d2689dca54805d6581f78f
                   |                            |712668a4d5457
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #19 from Piotr Caban  ---
Marking as fixed.

[Bug 58363] Thief II crashes

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58363

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #20 from Alexandre Julliard  ---
Closing bugs fixed in 10.11.