[Bug 1127] New: - Page fault in heap functions in native Winhlp32 (win2k) when cancelling from the full text search setup window

http://bugs.winehq.com/show_bug.cgi?id=1127

           Summary: Page fault in heap functions in native Winhlp32 (win2k)
                    when cancelling from the full text search setup window
           Product: Wine
           Version: 20010112
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: wine-kernel
        AssignedTo: wine-bugs(a)winehq.com
        ReportedBy: R.J.Shearman(a)warwick.ac.uk


Winhlp32 crashes when cancelling from the full text search setup window.
How to reproduce:
1. run winedbg winhlp32 (Windows 2000 native version)
2. select a .hlp file (I selected any from msoe.hlp  msoeacct.hlp  wab.hlp)
3. click on "Help Topics" toolbar item
4. click cancel in "Find Setup Wizard" window

Depending on where it crashes it gives either a page fault on a null pointer (HEAP_FindFreeBlock) or a page fault on 0xC (RtlAllocateHeap)
It seems to be random where it crashes.
HEAP_FindFreeBlock [heap.c:608]
DWORD arena_size = (pArena->size & ARENA_SIZE_MASK) +

0 0x400ce8f4 HEAP_FindFreeBlock(heap=0x40370000, size=0x80, ppSubHeap=0x406925f8)
1 0x400cf318 RtlAllocateHeap(heap=0x40370000, flags=0x2, size=0x80)
2 0x408e6293 list_window_children(hwnd=0x11005e, atom=0x0, tid=0x0)
3 0x408ea5d0 WIN_ListChildren
4 0x408dbd7b RDW_UpdateRgns
5 0x408dc5ca RedrawWindow
6 0x40a7ee4e expose_window
7 0x50a7f0c7 X11DRV_Expose
8 0x40a75b6b EVENT_ProcessEvent
...
13 0x40904de7 GetMessageA
14 0x0102b892 winhlp32.exe..text+0x2a892

Another crash trace:
RtlAllocateHeap+0xe6 [heap.c:1039]
pArena->prev->next = pArena->next;

0 0x400cf386 RtlAllocateHeap(heap=0x4037, flags=0x2, size=0x20)
1 0x4081b293 REGION_AllocWineRegion(n=0x2)
2 0x4081b31c REGION_CreateRegion(n=0x2)
3 0x4081b5d4 CreateRectRgn(left=0x32, top=0x43, right=0x158, bottom=0x45)
4 0x4081b647 CreateRectRgnIndirect
5 0x408dc4e3 RedrawWindow
6 0x40a7ee4e expose_window
7 0x40a7f0c7 X11DRV_Expose
...
13 0x40904de7 GetMessageA
14 0x0102b892 winhlp32.exe..text+0x2a892

Nothing out of the ordinary appears at the console

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://bugs.winehq.com/show_bug.cgi?id=1127>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.