https://bugs.winehq.org/show_bug.cgi?id=39466
--- Comment #9 from Zhiyi Zhang zzhang@codeweavers.com --- Crash path: Edit WM_PAINT()-> Edit BeginPaint() -> DefWindowProc -> Send WM_NCPAINT() to parent -> Mopyfish windowproc WM_NCPAINT() -> Mopyfish calls EM_SET,GETHANDLE several times (After EM_GETHANDLE, es->text is released with EDIT_UnlockBuffer with parameter force TRUE) -> Back in Edit WM_PAINT, es->text becomes NULL ...Oops...