https://bugs.winehq.org/show_bug.cgi?id=21940
--- Comment #25 from minion minion.procyk@gmail.com --- welp, maybe someone smarter than me can chime in here. Seems like we're failing to properly allocate the string that gets set. I really don't know how to fix this. You can achieve this log with WINEDEBUG=trace+msxml,+pid,+tid with the previously attached patch applied.
Here's the relevant bit from the log:
0008:0009:trace:msxml:domtext_QueryInterface (0x4596eb0)->({2933bf80-7b36-11d2-b20e-00c04f983e60} 0x34bf08) 0008:0009:trace:msxml:domtext_AddRef (0x4596eb0)->(2) 0008:0009:trace:msxml:domtext_Release (0x4596eb0)->(1) 0008:0009:trace:msxml:domtext_QueryInterface (0x4596eb0)->({2933bf86-7b36-11d2-b20e-00c04f983e60} 0x34bfa8) 0008:0009:trace:msxml:domtext_AddRef (0x4596eb0)->(2) 0008:0009:trace:msxml:domtext_Release (0x4596eb0)->(1) 0008:0009:trace:msxml:domtext_AddRef (0x4596eb0)->(2) 0008:0009:trace:msxml:domelem_Release (0x48d7208)->(1) 0008:0009:trace:msxml:domelem_Release (0x48d7208)->(0) 0008:0009:trace:msxml:xmldoc_release_refs (0x53cacb00)->(3) 0008:0009:trace:msxml:domtext_AddRef (0x4596eb0)->(3) 0008:0009:trace:msxml:domtext_AddRef (0x4596eb0)->(4) 0008:0009:trace:msxml:domtext_Release (0x4596eb0)->(3) 0008:0009:trace:msxml:domtext_Release (0x4596eb0)->(2) 0008:0009:trace:msxml:domtext_put_data (0x4596eb0)->(L"ref_rect") 0008:0009:trace:msxml:node_set_content (0x4596eb0)->(L"ref_rect") wine: Unhandled page fault on write access to 0x005f5041 at address 0x42e8fa (thread 0009), starting debugger...