Esme Povirk (@madewokherd) commented about dlls/comdlg32/navbar.c:
DestroyWindow(crumb2->hwnd);
ILFree(crumb2->pidl);
crumb2->pidl = crumb1->pidl;
crumb2->hwnd = crumb1->hwnd;
}
else
{
DestroyWindow(crumb1->hwnd);
ILFree(crumb1->pidl);
}
}
else
break;
crumb1 = LIST_ENTRY(crumb1->entry.prev, struct crumb, entry);
crumb2 = LIST_ENTRY(crumb2->entry.prev, struct crumb, entry);
Since the loop doesn't terminate when it runs out of items in new_crumbs, this will continue iterating items from the end again. I think it happens to do the right thing, but it is confusing.