[Bug 2796] Wine crashes when using Combobox from riched20

[Wine Bugs]

http://bugs.winehq.org/show_bug.cgi?id=2796

------- Additional Comments From [e-mail]  2005-15-03 03:33 -------
BTW this is a regression from 20050211. There this didn't happen.
Strange thing is, it still happens with 20050211 if I don't remove the
riched20.dll from 20050310 (wich obviously is new there). Unfortunately removing
if from 20050310 does not work.

Additional Info:
I get this message, before anything goes wrong.
fixme:richedit:RichEditANSIWndProc EM_AUTOURLDETECT: stub
fixme:richedit:RichEditANSIWndProc WM_SETFONT: stub
fixme:richedit:RichEditANSIWndProc EM_EXLIMITTEXT: stub

And, I can crash it by editing more than 22 characters and not touching the menu
at all, resulting in this stack trace:
err:heap:HEAP_ValidateInUseArena Heap 422c0000: in-use arena 422c1780 next block
has PREV_FREE flag
err:heap:HEAP_ValidateInUseArena Heap 422c0000: in-use arena 422c1970 next block
has PREV_FREE flag
err:heap:HEAP_ValidateInUseArena Heap 422c0000: in-use arena 422c1b60 next block
has PREV_FREE flag
err:heap:HEAP_ValidateInUseArena Heap 422c0000: in-use arena 422c0c60 next block
has PREV_FREE flag
err:heap:HEAP_ValidateInUseArena Heap 422c0000: in-use arena 422c1d50 next block
has PREV_FREE flag
err:heap:HEAP_ValidateInUseArena Heap 422c0000: in-use arena 422c1590 next block
has PREV_FREE flag
err:heap:HEAP_ValidateInUseArena Heap 422c0000: in-use arena 422c1f40 next block
has PREV_FREE flag
err:heap:HEAP_ValidateInUseArena Heap 422c0000: in-use arena 422c13a0 next block
has PREV_FREE flag
err:heap:HEAP_ValidateInUseArena Heap 422c0000: in-use arena 422c2240 next block
has PREV_FREE flag
wine: Unhandled exception (thread 0009), starting debugger...
WineDbg starting on pid 0x8
Unhandled exception: page fault on write access to 0x0032003d in 32-bit code
(0x4007088c).
In 32 bit mode.
Register dump:
 CS:0023 SS:002b DS:002b ES:002b FS:003b GS:0033
 EIP:4007088c ESP:406cef70 EBP:406cef88 EFLAGS:00010202(   - 00      - -RI1)
 EAX:422c0060 EBX:400a4384 ECX:406cef78 EDX:00320031
 ESI:422c2268 EDI:00000040
Stack dump:
0x406cef70:  00000000 422c0000 422c0000 422b8410
0x406cef80:  406cf014 00000003 406cefa8 422a4832
0x406cef90:  422c0000 00000002 00000040 422b8410
0x406cefa0:  406cf014 00000010 406cefb8 422accdb
0x406cefb0:  00000003 422b8410 406ceff0 422acd9d
0x406cefc0:  00000010 0000000d 000000db 422c0db8
Backtrace:
=>1 0x4007088c RtlAllocateHeap(heap=0x422c0000, flags=0x2, size=0x40)
[heap.c:1163] in ntdll (0x406cef88)
  2 0x422a4832 ME_MakeDI+0x26(type=0x3) [list.c:128] in riched20 (0x406cefa8)
  3 0x422accdb ME_MakeRow(height=0x10, baseline=0xd, width=0xdb) [wrap.c:39] in
riched20 (0x406cefb8)
  4 0x422acd9d ME_InsertRowStart(wc=0x406cf014, pEnd=0x0) [wrap.c:72] in
riched20 (0x406ceff0)
  5 0x422aced8 ME_WrapEndParagraph+0x2c(wc=0x406cf014, p=0x422c0598) [wrap.c:97]
in riched20 (0x406cf004)
  6 0x422ad5ca ME_WrapTextParagraph+0xb6(c=0x406cf07c, tp=0x422c05e0)
[/home/mteske/src/wine-20050310/dlls/riched20/wrap.c:376] in riched20 (0x406cf060)
  7 0x422ad786 ME_WrapMarkedParagraphs(editor=0x422c0098)
[/home/mteske/src/wine-20050310/dlls/riched20/wrap.c:437] in riched20 (0x406cf0c8)
  8 0x422a4dc9 ME_Repaint(editor=0x422c0098) [paint.c:156] in riched20 (0x406cf0ec)
  9 0x422a4e59 ME_UpdateRepaint(editor=0x422c0098) [paint.c:170] in riched20
(0x406cf108)
  10 0x422a3092 RichEditANSIWndProc(hWnd=0x200a4, msg=0x102, wParam=0x33,
lParam=0x40001) [/home/mteske/src/wine-20050310/dlls/riched20/editor.c:795] in
riched20 (0x406cfb50)
  11 0x4074cd9f WINPROC_wrapper+0x17 in user32 (0x406cfb74)
  12 0x4074d094 WINPROC_CallWndProc+0x54(proc=0x422a2528, hwnd=0x200a4,
msg=0x102, wParam=0x33, lParam=0x40001)
[/home/mteske/src/wine-20050310/dlls/user/../../windows/winproc.c:420] in user32
(0x406cfba0)
  13 0x407524b1 CallWindowProcA(func=0x422a2528, hwnd=0x200a4, msg=0x102,
wParam=0x33, lParam=0x40001)
[/home/mteske/src/wine-20050310/dlls/user/../../windows/winproc.c:3240] in
user32 (0x406cfbd4)
  14 0x5f401f01 L�q@`a@+0x5a5 in mfc42 (0x406cfbf4)
  15 0x5f401f2b L�q@`a@+0x5cf in mfc42 (0x406cfc14)
  16 0x0054451e in aruser (+0x14451e) (0x406cfc2c)
  17 0x5f401e84 L�q@`a@+0x528 in mfc42 (0x406cfcb0)
  18 0x5f401aff L�q@`a@+0x1a3 in mfc42 (0x406cfcd0)
  19 0x5f401a88 L�q@`a@+0x12c in mfc42 (0x406cfd30)
  20 0x5f401a10 L�q@`a@+0xb4 in mfc42 (0x406cfd4c)
  21 0x5f4019cf L�q@`a@+0x73 in mfc42 (0x406cfd78)
  22 0x4074cd9f WINPROC_wrapper+0x17 in user32 (0x406cfd9c)
  23 0x4074d094 WINPROC_CallWndProc+0x54(proc=0x5f401996, hwnd=0x200a4,
msg=0x102, wParam=0x33, lParam=0x40001)
[/home/mteske/src/wine-20050310/dlls/user/../../windows/winproc.c:420] in user32
(0x406cfdc8)
  24 0x407524b1 CallWindowProcA(func=0x407ea93c, hwnd=0x200a4, msg=0x102,
wParam=0x33, lParam=0x40001)
[/home/mteske/src/wine-20050310/dlls/user/../../windows/winproc.c:3240] in
user32 (0x406cfdfc)
  25 0x4077f3ae DispatchMessageA+0xaa(msg=0x73a2f4)
[/home/mteske/src/wine-20050310/dlls/user/message.c:2907] in user32 (0x406cfe3c)
  26 0x5f401328 L�q@`a@+0x2a5 in mfc42 (0x0073a2f4)
  27 0x00000102 (0x000200a4)
  28 0x00000000 (0x00000000)
0x4007088c RtlAllocateHeap+0x80 [heap.c:1163] in ntdll: movl    %eax,0xc(%edx)
Unable to open file 'heap.c'