Bug in the heap management code?

[Michael Günnewig]

Hallo.

When I try to play "The Elder Scroll III: Tribunal" version 1.4.1313
german under wine I get a page fault after some time. The time span
differs and so the calling point of the heap management but it always
occurs in HEAP_CreateFreeBlock in line 415.

Generating of a full "-debugmsg +heap" log is nearly impossible
because it takes too long to start the game and start playing
(after > 200 min. it still wasn't finished with initializing). 

,-----
| err:ntdll:RtlpWaitForCriticalSection section 0x4046001c "?" wait timed out in thread 0010, blocked by 000c, retrying (60 sec)
| err:ntdll:RtlpWaitForCriticalSection section 0x7d63d8 "?" wait timed out in thread 0009, blocked by 000c, retrying (60 sec)
| Unhandled exception: page fault on write access to 0x53acae7c in 32-bit code (0x400826d1).
| In 32-bit mode.
| 0x400826d1 (HEAP_CreateFreeBlock+0x11 [heap.c:415] in libntdll.dll.so): movl   $0x45455246,0x4(%esi)
| 419         pEnd = (char *)ptr + size;
| Wine-dbg>bt
| Backtrace:
| =>0 0x400826d1 (HEAP_CreateFreeBlock+0x11(subheap=0x539a0000, ptr=0x53acae78, size=0x3f6ebd18) [heap.c:415] in libntdll.dll.so) (ebp=4c031d80)
|   1 0x400829be (HEAP_ShrinkBlock+0x4e(subheap=0x539a0000, pArena=0x53aaae70, size=0x20000) [heap.c:521] in libntdll.dll.so) (ebp=4c031d9c)
|   2 0x400838c7 (RtlAllocateHeap+0xa7(heap=0x40460000, flags=0xa, size=0x20000) [heap.c:1159] in libntdll.dll.so) (ebp=4c031dc8)
|   3 0x40aac68e (IDirect3DDevice8Impl_CreateImageSurface+0x9e(iface=0x4052fca8, Width=0x100, Height=0x80, Format=0x31545844, ppSurface=0x53a81dd0) [device.c:1987] in d3d8.dll.so) (ebp=4c031dec)
|   4 0x40aaba39 (IDirect3DDevice8Impl_CreateTexture+0x119(iface=0x4052fca8, Width=0x100, Height=0x80, Levels=0x5, Usage=0x0, Format=0x31545844, Pool=0x1, ppTexture=0x52c58170) [device.c:539] in d3d8.dll.so) (ebp=4c031e20)
|   5 0x006b9766 (Morrowind.exe..text+0x2b8766 in Morrowind.exe) (ebp=535bb5c0)
|   6 0x00000001 (ebp=00748e84)
|   7 0x006cf2a0 (Morrowind.exe..text+0x2ce2a0 in Morrowind.exe) (ebp=006ce690)
|   8 0x00000478 (ebp=e8f18b56)
| *** Invalid address 0xe8f18b56 (MSVCP60.DLL..reloc+0x70dfab56)
`-----
,-----
| err:ntdll:RtlpWaitForCriticalSection section 0x4046001c "?" wait timed out in thread 0010, blocked by 000c, retrying (60 sec)
| err:ntdll:RtlpWaitForCriticalSection section 0x4046001c "?" wait timed out in thread 0009, blocked by 000c, retrying (60 sec)
| Unhandled exception: page fault on write access to 0x537c0064 in 32-bit code (0x400826d1).
| In 32-bit mode.
| 0x400826d1 (HEAP_CreateFreeBlock+0x11 [heap.c:415] in libntdll.dll.so): movl   $0x45455246,0x4(%esi)
| 419         pEnd = (char *)ptr + size;
| Wine-dbg>bt
| Backtrace:
| =>0 0x400826d1 (HEAP_CreateFreeBlock+0x11(subheap=0x536b0000, ptr=0x537c0060, size=0x3f6f4c38) [heap.c:415] in libntdll.dll.so) (ebp=4c032518)
|   1 0x400829be (HEAP_ShrinkBlock+0x4e(subheap=0x536b0000, pArena=0x537bff90, size=0xc8) [heap.c:521] in libntdll.dll.so) (ebp=4c032534)
|   2 0x400838c7 (RtlAllocateHeap+0xa7(heap=0x40460000, flags=0x2, size=0xc8) [heap.c:1159] in libntdll.dll.so) (ebp=4c032560)
|   3 0x412befe7 (MSVCRT.DLL.??_U at YAPAXI@Z+0x27 in msvcrt.dll.so) (ebp=4c032580)
|   4 0x00412b03 (Morrowind.exe..text+0x11b03 in Morrowind.exe) (ebp=4c03261c)
|   5 0x00412dcb (Morrowind.exe..text+0x11dcb in Morrowind.exe) (ebp=4af5fce8)
|   6 0x5376b8e0 (_end+0x832c1f0) (ebp=4cbe2238)
|   7 0x444e414c (_end+0x2ebf630) (ebp=007428b0)
|   8 0x004c8620 (Morrowind.exe..text+0xc7620 in Morrowind.exe) (ebp=004c7b90)
|   9 0x00000018 (ebp=e8f18b56)
| *** Invalid address 0xe8f18b56 (MSVCP60.DLL..reloc+0x70dfab56)
`-----


  Michael