[Bug 32954] New: Trying to download flash from iexplore crashes in jscript

http://bugs.winehq.org/show_bug.cgi?id=32954

Bug #: 32954
           Summary: Trying to download flash from iexplore crashes in
                    jscript
           Product: Wine
           Version: 1.5.23
          Platform: x86
               URL: http://get.adobe.com/flashplayer/
        OS/Version: Linux
            Status: NEW
          Keywords: download
          Severity: normal
          Priority: P2
         Component: jscript
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
    Classification: Unclassified

Created attachment 43526
  --> http://bugs.winehq.org/attachment.cgi?id=43526
backtrace

$ wine iexplore http://get.adobe.com/flashplayer/

click download, on next page, wait a couple seconds, and it should crash (or
click on the page anywhere, that also seems to trigger it).

Backtrace:
=>0 0x7c92b804 create_exec_ctx+0x84(script_ctx=0x7164748, this_obj=<is not
available>, var_disp=0x4f9b350, scope=0x7c88390, is_global=0, ret=0x32ed2c)
[/home/austin/wine-git/dlls/jscript/../../include/oaidl.h:801] in jscript
(0x0032ec98)
  1 0x7c92e2d0 invoke_source+0x30f(ctx=0x7164748, function=0x85b43f8,
this_obj=(nil), argc=0x1, argv=0x32ee88, r=0x32eec8)
[/home/austin/wine-git/dlls/jscript/function.c:232] in jscript (0x0032ed48)
  2 0x7c92ea33 Function_invoke+0xb2(func_this=0x85b43f8, jsthis=(nil),
flags=0x1, argc=0x1, argv=0x32ee88, r=0x32eec8)
[/home/austin/wine-git/dlls/jscript/function.c:356] in jscript (0x0032eda8)
  3 0x7c9220ad invoke_prop_func+0x2cc(This=0x85b43f8, jsthis=<is not
available>, prop=0x85b4440, flags=0x1, argc=0x1, argv=0x32ee88, r=0x32eec8,
caller=(nil)) [/home/austin/wine-git/dlls/jscript/dispex.c:388] in jscript
(0x0032ee18)
  4 0x7c922c6f DispatchEx_InvokeEx+0x41e(iface=0x110000, id=0x8, lcid=0x40,
wFlags=<couldn't compute location>, pdp=(nil), pvarRes=0x7c954086,
pei=0x32ed48, pspCaller=0x7c92e2d0)
[/home/austin/wine-git/dlls/jscript/dispex.c:692] in jscript (0x0032eee8)
  5 0x7d13bed6 call_disp_func+0x105(disp=<is not available>, dp=<is not
available>, retv=0x32f038)
[/home/austin/wine-git/dlls/mshtml/../../include/dispex.h:299] in mshtml
(0x0032ef88)
  6 0x7d13c266 call_event_handlers.clone+0x1e5() in mshtml (0x0032f068)
  7 0x7d13cc62 fire_event_obj+0x371(doc=0x7a09320, eid=EVENTID_CLICK,
event_obj=0x7f175b8, target=0x80c60b8, script_this=(nil))
[/home/austin/wine-git/dlls/mshtml/htmlevent.c:1073] in mshtml (0x0032f108)
  8 0x7d13d329 fire_event+0x88(doc=0x7a09320, eid=EVENTID_CLICK, set_event=0x1,
target=0x80c60b8, nsevent=0x7a59988, script_this=(nil))
[/home/austin/wine-git/dlls/mshtml/htmlevent.c:1188] in mshtml (0x0032f138)
  9 0x7d18fb35 handle_htmlevent+0x114(iface=0x110000, event=0x8)
[/home/austin/wine-git/dlls/mshtml/nsevents.c:318] in mshtml (0x0032f1a8)
  10 0x6a63b7f0 in xul (+0x9fb7ef) (0x04f99f40)
  11 0x00187f04 (0x6b0da4b8)
  12 0x6a63cef8 in xul (+0x9fcef7) (0x6a63cf14)
0x7c92b804 create_exec_ctx+0x84
[/home/austin/wine-git/dlls/jscript/../../include/oaidl.h:801] in jscript: movl
0x0(%edi),%eax
801         return This->lpVtbl->AddRef(This);