bug#7190: Crash in menus on w32

[grischka <grishka@gmx.de>]

Lennart Borgman wrote:
>>> Is not that an important difference?
>> Not if you want to fix the bug.
> 
> It looks like I am thinking nearly exactly the opposite.
> 
> For a simple bug it does not matter. For a complicated bug you can not
> look at all possible places. That would take too long time. So putting
> some structure on the different places and evaluating them makes much
> sense to me.

This bug is simple.

>>>>> By
>>>>> adding DebPrint call we could perhaps see if some code where called in
>>>>> an order we did not expect.
>>>> Perhaps see the information that you already have?  For example
>>>>  #7  0x011c4e4b in w32_free_submenu_strings (menu=0x205e3) at
>>>> w32menu.c:1701
>>>> is telling where is "some code", and
>>>>  "Invalid Address specified to RtlFreeHeap( 00850000, 0088BDC8 )"
>>>> is telling about "order we did not expect", as likely in:  Called
>>>> twice for the same memory object.  If in doubt, try to prove that
>>>> it can't happen.
>>> Yes, perhaps. But it could also be that memory objects are freed in an
>>> order we did not expect.
>>>
>> Why should it matter in what order "Invalid Address" is passed to free?
> 
> Maybe I am misunderstanding, I do not know much about this part of the
> code. Are you saying that you could not get this error from calls to
> RtlFreeHeap coming in the wrong order? (That would perhaps help much
> to know.)

Yes,  RtlFreeHeap (like any free) doesn't care about order.  It only
cares that it's a valid object (which it isn't if it was already freed).
Did not someone see corrupted first letters in menu strings and such?
That is also a symptom of premature free, often.  Count 1+1 ...