msvcrt: Correctly walk up the list of trylevels in except_handler3.

dlls/msvcrt/except.c

@@ -219,10 +219,10 @@ int CDECL _except_handler3(PEXCEPTION_RECORD rec,
 
     while (trylevel != TRYLEVEL_END)
     {
+      TRACE( "level %d prev %d filter %p\n", trylevel, pScopeTable[trylevel].previousTryLevel,
+             pScopeTable[trylevel].lpfnFilter );
       if (pScopeTable[trylevel].lpfnFilter)
       {
-        TRACE("filter = %p\n", pScopeTable[trylevel].lpfnFilter);
-
         retval = call_filter( pScopeTable[trylevel].lpfnFilter, &exceptPtrs, &frame->_ebp );
 
         TRACE("filter returned %s\n", retval == EXCEPTION_CONTINUE_EXECUTION ?
@@ -241,13 +241,13 @@ int CDECL _except_handler3(PEXCEPTION_RECORD rec,
           /* Set our trylevel to the enclosing block, and call the __finally
            * code, which won't return
            */
-          frame->trylevel = pScopeTable->previousTryLevel;
+          frame->trylevel = pScopeTable[trylevel].previousTryLevel;
           TRACE("__finally block %p\n",pScopeTable[trylevel].lpfnHandler);
           call_finally_block(pScopeTable[trylevel].lpfnHandler, &frame->_ebp);
           ERR("Returned from __finally block - expect crash!\n");
        }
       }
-      trylevel = pScopeTable->previousTryLevel;
+      trylevel = pScopeTable[trylevel].previousTryLevel;
     }
   }
 #else