http://bugs.winehq.org/show_bug.cgi?id=12044
--- Comment #41 from Sam Edwards CFSworks@gmail.com 2012-02-26 19:11:33 CST --- Upgraded to 1.4-rc5, bug still happens, but I've figured out what's going on.
Source likes to render its font glyphs into textures. The function causing the crash is designed to render a font into an RGBA buffer, which the caller uses to turn into a texture. To figure out what Y-coordinate to start rendering into, Source uses (lptm->tmAscent - lpgm->gmptGlyphOrigin.y). As long as gmptGlyphOrigin.y is not greater than tmAscent, this will be a non-negative number, and it will start copying into the buffer at a valid Y position.
In the case of the toilets, the gmptGlyphOrigin.y is 45, while the tmAscent for its font is 43, which results in Source attempting to copy into its texture buffer at -2: an out-of-bounds range.
This means that the problem is either with Wine's reporting of the text metrics or the glyph origin, since it should not be giving an origin with a greater Y than the ascent. I haven't tested this on Windows, so I don't know which function is returning an incorrect value, but if I were to guess I'd say it's the GetTextMetrics call.
At any rate, a WARN should probably be added to GetGlyphOutline when this occurs, so that we can see if this is the same as bug 7698.