http://bugs.winehq.org/show_bug.cgi?id=22860
--- Comment #35 from Nikolay Sivov bunglehead@gmail.com 2010-11-28 16:58:43 CST --- Interesting, so it depends on libxml2 version too, cause I have a different crash. You're using installer from URL bug field?
This is wrong:
--- trace:msxml:domelem_Release (0x6fb7958) ref=1 trace:msxml:domelem_Release (0x6fb7958) ref=0 trace:msxml:xmldoc_release (0xb70dddd8)->(1) trace:msxml:domelem_Release (0x6fb7928) ref=0 trace:msxml:xmldoc_release (0xb70dddd8)->(0) trace:msxml:xmldoc_release freeing docptr 0xb70dddd8 ... libxml document is released, ... trace:msxml:domdoc_Release (0x6fb7870)->(0) trace:msxml:xmldoc_release (0xb70dc7a0)->(2) trace:msxml:domdoc_get_xml (0x6f88bc0)->(0x31dded8) trace:msxml:domdoc_get_xml -1, len=0 trace:msxml:domelem_Release (0x6f88c78) ref=0 trace:msxml:xmldoc_release (0xb70dddd8)->(-1) ... but DOM element still exists at this point, so last release operates on already freed memory ... trace:msxml:domdoc_Release (0x6f88bc0)->(0) ---
Same symptoms as here http://bugs.winehq.org/show_bug.cgi?id=18376#c29.