richedit (ro): "Select all" or "Copy" crashes wine

[Tobias Burnus]

Hi,

in Diamond 2.x 
(http://www.codeweavers.com/compatibility/browse/name?app_id=865) there 
is a structure-data richedit (read-only). (Under Windows: 
http://www.physik.fu-berlin.de/~tburnus/wine/diamond_info.png; it's on 
the right side; Wine looks similar, but the background is grey and it is 
not that sleek.)

I can flawlessly select some text using the mouse or the keyboard, but 
if I use the context menu and choose either of
- "Select all"
- "Copy" (after selecting something)
it crashes with:

wine: Unhandled exception (thread 0009), starting debugger...
WineDbg starting on pid 0x8
Unhandled exception: page fault on read access to 0x00000000 in 32-bit 
code (0x451e158b).
In 32 bit mode.
Register dump:
 CS:0073 SS:007b DS:007b ES:007b FS:003b GS:0033
 EIP:451e158b ESP:406dfb98 EBP:406dfbb4 EFLAGS:00210246(   - 00      -RIZP1)
 EAX:40425b70 EBX:451eecec ECX:40b77600 EDX:451f2c50
 ESI:00000000 EDI:40425b70
Stack dump:
0x406dfb98:  4058a80e 4058a80e 451eecec 00000000
0x406dfba8:  451eecec 404240d8 00000111 406dfbe8
0x406dfbb8:  451e3ba8 40425b70 00000000 00000000
0x406dfbc8:  00000111 00000000 00000301 00000301
0x406dfbd8:  44b68a14 40b6a450 00000000 00020048
0x406dfbe8:  406dfc0c 40ae88f7 00020048 00000111
Backtrace:
=>1 0x451e158b RTFSetEditStream in riched32 (0x406dfbb4)
  2 0x451e3ba8 RICHED32_WindowProc in riched32 (0x406dfbe8)
  3 0x40ae88f7 WINPROC_wrapper in user32 (0x406dfc0c)
  4 0x40ae9c1b WINPROC_CallWndProc in user32 (0x406dfc50)
  5 0x40aef2c5 CallWindowProcA in user32 (0x406dfc94)
  6 0x00563a90fixme:dbghelp_msc:pe_load_debug_directory This guy has FPO 
information
 in diamond (+0x163a90) (0x406dfcb4)
  7 0x005641c2 in diamond (+0x1641c2) (0x406dfcd4)
  8 0x00562ed9 in diamond (+0x162ed9) (0x406dfd40)
  9 0x005631e5 in diamond (+0x1631e5) (0x406dfd5c)
  10 0x40ae88f7 WINPROC_wrapper in user32 (0x406dfd80)
  11 0x40ae9c1b WINPROC_CallWndProc in user32 (0x406dfdc4)
  12 0x40aef2c5 CallWindowProcA in user32 (0x406dfe08)
  13 0x40ad26f2 DispatchMessageA in user32 (0x406dfe34)
  14 0x00567cb7 in diamond (+0x167cb7) (0x005f3d50)
  15 0x00000001 (0x005ab278)
  16 0x00464520 in diamond (+0x64520) (0x00589f71)
0x451e158b RTFSetEditStream+0x2b in riched32: movl      0x0(%esi),%eax

A WINEDEBUG=+relay,+seh,+tid gives the following (excerpt):
(This is with Meissner's wine-20050211-1.1 and CXOffice-nightly 05-02-21 
and occurs also with earlier versions of WINE. The excerpt below comes 
from wine-20050211-1.1 with "Select all".)

[...]
0009:Call window proc 0x5631b9 
(hwnd=0x20048,msg=WM_COMMAND,wp=000000b1,lp=00000000)
0009:Call kernel32._ConfirmSysLevel(40b77600) ret=40ade8c5
0009:Ret  kernel32._ConfirmSysLevel() retval=00000000 ret=40ade8c5
0009:Call kernel32.TlsGetValue(00000007) ret=0058c6c9
0009:Ret  kernel32.TlsGetValue() retval=403cdc08 ret=0058c6c9
0009:Call kernel32.TlsGetValue(00000007) ret=0058c6c9
0009:Ret  kernel32.TlsGetValue() retval=403cdc08 ret=0058c6c9
0009:Call kernel32.TlsGetValue(00000007) ret=0058c6c9
0009:Ret  kernel32.TlsGetValue() retval=403cdc08 ret=0058c6c9
0009:Call 
user32.CallWindowProcA(451e38b0,00020048,00000111,000000b1,00000000) 
ret=00563a90
0009:Call kernel32._EnterSysLevel(40b77600) ret=40ade890
0009:Call ntdll.RtlEnterCriticalSection(40b77600) ret=4050828b
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=4050828b
0009:Ret  kernel32._EnterSysLevel() retval=4058a640 ret=40ade890
0009:Call kernel32._LeaveSysLevel(40b77600) ret=40ade920
0009:Call ntdll.RtlLeaveCriticalSection(40b77600) ret=40507fc1
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=40507fc1
0009:Ret  kernel32._LeaveSysLevel() retval=4058a80e ret=40ade920
0009:Call kernel32._EnterSysLevel(40b77600) ret=40ade890
0009:Call ntdll.RtlEnterCriticalSection(40b77600) ret=4050828b
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=4050828b
0009:Ret  kernel32._EnterSysLevel() retval=4058a640 ret=40ade890
0009:Call kernel32._LeaveSysLevel(40b77600) ret=40ade920
0009:Call ntdll.RtlLeaveCriticalSection(40b77600) ret=40507fc1
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=40507fc1
0009:Ret  kernel32._LeaveSysLevel() retval=4058a80e ret=40ade920
0009:Call kernel32.GlobalGetAtomNameW(0000c043,406df99c,0000003c) 
ret=40aba1ba
0009:Ret  kernel32.GlobalGetAtomNameW() retval=00000008 ret=40aba1ba
0009:Call kernel32._EnterSysLevel(40b77600) ret=40ade890
0009:Call ntdll.RtlEnterCriticalSection(40b77600) ret=4050828b
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=4050828b
0009:Ret  kernel32._EnterSysLevel() retval=4058a640 ret=40ade890
0009:Call kernel32._LeaveSysLevel(40b77600) ret=40ade920
0009:Call ntdll.RtlLeaveCriticalSection(40b77600) ret=40507fc1
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=40507fc1
0009:Ret  kernel32._LeaveSysLevel() retval=4058a80e ret=40ade920
0009:Call window proc 0x451e38b0 
(hwnd=0x20048,msg=WM_COMMAND,wp=000000b1,lp=00000000)
0009:Call kernel32._ConfirmSysLevel(40b77600) ret=40ade8c5
0009:Ret  kernel32._ConfirmSysLevel() retval=00000000 ret=40ade8c5
0009:Call user32.GetWindowLongW(00020048,00000004) ret=451e38e2
0009:Call kernel32._EnterSysLevel(40b77600) ret=40ade890
0009:Call ntdll.RtlEnterCriticalSection(40b77600) ret=4050828b
0009:Ret  ntdll.RtlEnterCriticalSection() retval=00000000 ret=4050828b
0009:Ret  kernel32._EnterSysLevel() retval=4058a640 ret=40ade890
0009:Call kernel32._LeaveSysLevel(40b77600) ret=40ade920
0009:Call ntdll.RtlLeaveCriticalSection(40b77600) ret=40507fc1
0009:Ret  ntdll.RtlLeaveCriticalSection() retval=00000000 ret=40507fc1
0009:Ret  kernel32._LeaveSysLevel() retval=4058a80e ret=40ade920
0009:Ret  user32.GetWindowLongW() retval=404240c0 ret=451e38e2
0009:trace:seh:EXC_RtlRaiseException code=c0000005 flags=0 addr=0x451e158b
0009:trace:seh:EXC_RtlRaiseException  info[0]=00000000
0009:trace:seh:EXC_RtlRaiseException  info[1]=00000000
0009:trace:seh:EXC_RtlRaiseException  eax=40425b30 ebx=451eecec 
ecx=00000000 edx=451f2c50 esi=00000000 edi=40425b30
0009:trace:seh:EXC_RtlRaiseException  ebp=406df9ec esp=406df9d0 cs=0073 
ds=007b es=007b fs=003b gs=0033 flags=00210246
0009:trace:seh:EXC_CallHandler calling handler at 0x562f3e code=c0000005 
flags=0
0009:Call kernel32.GetLastError() ret=00547758
0009:Ret  kernel32.GetLastError() retval=00000000 ret=00547758
0009:Call kernel32.TlsGetValue(00000006) ret=00547766
0009:Ret  kernel32.TlsGetValue() retval=44b60100 ret=00547766
0009:Call kernel32.SetLastError(00000000) ret=005477ba
0009:Ret  kernel32.SetLastError() retval=00000000 ret=005477ba
0009:trace:seh:EXC_CallHandler handler returned 1
0009:trace:seh:EXC_CallHandler calling handler at 0x54c1e0 code=c0000005 
flags=0
0009:Call kernel32.GetLastError() ret=00547758
0009:Ret  kernel32.GetLastError() retval=00000000 ret=00547758
0009:Call kernel32.TlsGetValue(00000006) ret=00547766
0009:Ret  kernel32.TlsGetValue() retval=44b60100 ret=00547766
0009:Call kernel32.SetLastError(00000000) ret=005477ba
0009:Ret  kernel32.SetLastError() retval=00000000 ret=005477ba
0009:Call kernel32.UnhandledExceptionFilter(406df57c) ret=0054e15a
0009:Call kernel32.IsBadCodePtr(41036a10) ret=005503a1
0009:Ret  kernel32.IsBadCodePtr() retval=00000000 ret=005503a1
0009:Call kernel32.IsBadCodePtr(1000a670) ret=410386a1
0009:Ret  kernel32.IsBadCodePtr() retval=00000000 ret=410386a1
0009:Call 
ntdll.NtCreateEvent(406df240,001f0003,406df408,00000001,00000000) 
ret=404c574f
0009:Ret  ntdll.NtCreateEvent() retval=00000000 ret=404c574f
wine: Unhandled exception (thread 0009), starting debugger...
0009:Call ntdll.RtlInitUnicodeString(406df238,40568a80 
L"Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug") 
ret=404c
57e0
[...]

Tobias