https://bugs.winehq.org/show_bug.cgi?id=39466
--- Comment #8 from Zhiyi Zhang zzhang@codeweavers.com --- Ehh... EDIT_EM_GetHandle() fires again.
Check out the crash log on wine 3.7. During the first WM_PAINT. the last EDIT_UnlockBuffer() gets called with force TRUE, causing a NULL pointer set to es->text.