[Bug 20198] Help icon crashes Internet Explorer 7

http://bugs.winehq.org/show_bug.cgi?id=20198

--- Comment #4 from Juan Lang   2009-09-29 11:01:05 ---
> From your log:

Unhandled exception: page fault on read access to 0x00000000 in 32-bit code
(0x7e8952e8).
(snip)
=>0 0x7e8952e8 TOOLBAR_TTGetDispInfo+0x3ba(infoPtr=0x1c45e0, lpnmtdi=0x32da90)
[/mnt/ramdisk/wine-1.1.30~winehq1/dlls/comctl32/toolbar.c:6159] in comctl32
(0x0032d7d8)
(snip)
0x7e8952e8 TOOLBAR_TTGetDispInfo+0x3ba
[/mnt/ramdisk/wine-1.1.30~winehq1/dlls/comctl32/toolbar.c:6159] in comctl32:
movzbl    0x0(%eax),%eax

The odd thing is, looking at the code, line 6159 of toolbar.c is:
        else if (tbgit.pszText[0])
tbgit.pszText is assigned earlier on line 6136:
        tbgit.pszText = szBuffer;
and both szBuffer and tbgit are allocated on the stack, on lines 6129-30:
        CHAR szBuffer[INFOTIPSIZE+1];
        NMTBGETINFOTIPA tbgit;
So what's NULL, I wonder?

Maybe a +toolbar log would help.