Jacek Caban (@jacek) commented about dlls/mshtml/navigate.c:
if(This->bsc.binding) process_document_response_headers(This->bsc.window->doc, This->bsc.binding); - if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING) + + if(!(This->bsc.bindf & BINDF_ASYNCHRONOUS)) { + HTMLDocumentNode *doc = This->bsc.window->base.inner_window->doc; + HTMLDocumentObj *doc_obj = doc->doc_obj; + + doc->doc_obj = NULL; + doc->cp_container.forward_container = NULL; + if(doc_obj->doc_node == doc) { + doc_obj->doc_node = NULL; + IHTMLDOMNode_Release(&doc->node.IHTMLDOMNode_iface); + }
This seems hackish, I think we could reset GeckoBrowser's document pointer early in document object's destructor instead of `detach_gecko_browser` and handle that where needed. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/4054#note_49431