James Trotter wrote:
0x007ab8e6: pushl %eax 0x007ab8e7: call *0x8(%edx) 0x007ab8ea: movl %ebp,0x8(%esi) 0x007ab8ed: movl 0x4(%esi),%eax 0x007ab8f0: pushl %eax 0x007ab8f1: movl 0x0(%eax),%ecx
This very much looks like a use-after-free bug. The first two instructions are probably a COM *_Release call. Judging by the fact that this is a regression I would also guess that it is a Wine object. Also, by knowing that it is a game it is probably a DirectDraw, Direct3D or DirectSound object. Try turning on tracing for these and seeing what it turns up. If you see a decrement to 0 just before the crash then the theory is probably correct.
-- Rob Shearman
