Jinoh Kang (@iamahuman) commented about dlls/ieframe/dochost.c:
new_entry->stream = get_travellog_stream(This); if(This->travellog.loading_pos == -1) { This->travellog.position++;
We should assert here that position is still less than size after the increment.