http://bugs.winehq.org/show_bug.cgi?id=21210
Andrew Eikum aeikum@codeweavers.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aeikum@codeweavers.com
--- Comment #1 from Andrew Eikum aeikum@codeweavers.com 2010-01-07 14:41:30 --- The crash is caused by the wrong codepath being executed. IHlink_fnNavigate binds its target to an object and navigates to it. Since we have an mshtml implementation, the URLMoniker is bound as an HTMLDocument object. This HTMLDocument object is then navigated to, but the HTMLDocument has no client on which to render (or something like that). The null pointer causes a crash in mshtml's OleObject_DoVerb.
Instead, IHlink_fnNavigate should be passing the URL off to ShellExecute. This requires the bind to fail, which it would if we didn't try to use mshtml. The solution to this problem, I think, is to have some sort of identifier in IHlink, providing a way to determine whether the IHlink object was created by mshtml (in which case we want to continue with the bind as we do currently) or by an application (in which case we want to do whatever native does when a link is being navigated to -- that is, use ShellExecute).
I've asked Jacek Caban to give his opinion. Problem identified, solution (hopefully) incoming.