Crash in RGNOBJAPI_Lock

How to reproduce: break into kdbg, type "set condition * first always", then "cont". Click on the "Start" button.

This is from r45099 (self-compiled):

Entered debugger on embedded INT3 at 0x0008:0x80940a5a.
kdb:> set condition * first always
kdb:> cont
Entered debugger on first-chance exception (Exception Code: 0xc0000005) (Page Fault)
Memory at 0x00350D68 could not be read: Page not present.
kdb:> bt
Eip:
<win32k.sys:1015a2 (subsystems/win32/win32k/objects/region.c:2160 (@RGNOBJAPI_Unlock@4))>
Frames:
<win32k.sys:103466 (subsystems/win32/win32k/objects/region.c:3235 (NtGdiCreateRectRgn@16))>
<win32k.sys:c50d6 (subsystems/win32/win32k/objects/cliprgn.c:31 (@CLIPPING_UpdateGCRegion@4))>
<win32k.sys:c53b1 (subsystems/win32/win32k/objects/cliprgn.c:92 (@GdiSelectVisRgn@8))>
<win32k.sys:cc250 (subsystems/win32/win32k/objects/dclife.c:665 (NtGdiCreateCompatibleDC@4))>
<win32k.sys:830d0 (subsystems/win32/win32k/ntuser/cursoricon.c:1359 (UserDrawIconEx))>
<win32k.sys:83bb1 (subsystems/win32/win32k/ntuser/cursoricon.c:1582 (NtUserDrawIconEx@44))>
<ntoskrnl.exe:138c97 (ntoskrnl/ke/i386/trap.s:252 (CopyParams))>
<ntdll.dll:a136>
<explorer.exe:430b3>