Editor 11.0.1.0 crashes on file open under Wine (Linux)

[richard durpekt]

Hi,

I'm running PDF-XChange Editor Plus (Portable x64) 11.0.1.0 on Linux via Wine and hitting a reproducible crash. I understand Linux/Wine is not an officially supported platform — I'm reporting this because the crash appears to be inside the Editor's own code (not a Wine API failure), so it may be useful regardless of platform.

Environment

• PDF-XChange Editor Plus 11.0.1.0 (Portable x64)
• Wine 11.0 (stable, official WineHQ build) — also reproduced on Wine Staging 11.x
• Clean, dedicated 64-bit Wine prefix
• Runtime installed via winetricks: vcrun2022, dotnetdesktop9, corefonts, tahoma
• Emulated Windows version: Windows 10
• Host: Ubuntu 26.04, kernel 7.0

What happens

The Editor starts fine and the Home screen renders correctly. The crash is triggered specifically by the file-open action:

• clicking the "Open" tile on the Home screen, or
• double-clicking a file in the Recent files list.

Browsing the Home screen and clicking other tiles does not crash. Opening a PDF by passing it on the command line (PDFXEdit.exe file.pdf) works fine — only the in-app open path crashes.

What I have already ruled out

• Not plugins. I disabled all plug-ins (.pvp) — crash is identical.
• Not a specific Wine version. Reproduced on both Wine 11.0 stable and Wine Staging 11.x.
• Not graphics/compositor. The crash backtrace goes straight through user32 -> DispatchMessageW into the Editor's code; no rendering layer is involved.
• Not a failed COM call. Wine's OLE trace shows the last operation before the crash — marshaling of the window's IDropTarget — completing successfully (hr 0). The fault occurs immediately afterwards, inside pxceditorcore.x64, while handling the mouse-up (WM_LBUTTONUP) message.

Crash signature

Invalid read at 0xFFFFFFFFFFFFFFFF (null/invalid pointer), faulting inside pxceditorcore.x64 on an indirect call through an object vtable (callq *0x70(%rax) with a corrupted rax). The fault is reached via:

Code: Select all

WM_LBUTTONUP (msg 0x202)
  -> user32!DispatchMessageW
    -> pxceditor
      -> pxceditorcore.x64  (+0x28bcc5c)  <-- page fault here

The OLE trace immediately before the fault (the window has just been set up for drag-and-drop, then the crash hits):

Code: Select all

RegisterDragDrop (...)
CoMarshalInterface ... IID {00000122-0000-0000-c000-000000000046} (IDropTarget) ... MSHLFLAGS_TABLESTRONG
...
CoMarshalInterface completed with hr 0
wine: Unhandled page fault on read access to FFFFFFFFFFFFFFFF
      at address 00006FFFF90ACC5C (thread 03e0)

This pattern — a successful IDropTarget setup immediately followed by a vtable call through an invalid pointer when the open action is processed — suggests the file-open code path dereferences an object that was never initialised (or whose creation silently failed) on this platform, without a null check.

Attachments

• wine-crash-dump.txt — full Wine crash dump (backtrace + loaded modules).
• pxc-ole.log — Wine +ole,+combase trace up to the crash.

I'm happy to provide additional logs (e.g. with specific WINEDEBUG channels) or test any build you'd like me to try. Thanks for taking a look.

[Dimitar - PDF-XChange]

Hello richard durpekt,

Welcome to our forum.

Thank you for reporting this issue to us.

The crash logs have been forwarded to our developers for further investigation.

We will keep you posted on the progress regarding this issue.

Regards.

[Ivan - Tracker Software]

We found the issue. It will be fixed in the next build.
Sorry for the inconvenience.