[PATCH v5 0/3] MR8078: windows.ui: Fix a double free.

[Zhiyi Zhang (＠zhiyi)]

The object reference is actually held by ref_weak.

--
  v5: geolocation: Use helpers to implement IWeakReference.
      windows.ui: Use helpers to implement IWeakReference.
 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8078

[PATCH v5 1/3] windows.ui: Return a newer IUISettings5 interface.

[Zhiyi Zhang]

From: Zhiyi Zhang <zzhang(a)codeweavers.com>

Return a newer IUISettings5 interface in factory_ActivateInstance(). Returning IUISettings3 is not
wrong but it's not consistent now that IUISettings5 is available.
---
 dlls/windows.ui/uisettings.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/windows.ui/uisettings.c b/dlls/windows.ui/uisettings.c
index a2b59c46cdf..d5eae44b797 100644
--- a/dlls/windows.ui/uisettings.c
+++ b/dlls/windows.ui/uisettings.c
@@ -681,7 +681,7 @@ static HRESULT WINAPI factory_ActivateInstance( IActivationFactory *iface, IInsp
     impl->ref_strong = 1;
     impl->ref_weak = 1;
 
-    *instance = (IInspectable *)&impl->IUISettings3_iface;
+    *instance = (IInspectable *)&impl->IUISettings5_iface;
     return S_OK;
 }
 
-- 
GitLab


https://gitlab.winehq.org/wine/wine/-/merge_requests/8078

[PATCH v5 2/3] windows.ui: Use helpers to implement IWeakReference.

[Zhiyi Zhang]

From: Zhiyi Zhang <zzhang(a)codeweavers.com>

This also fix a double free in uisettings_Release().
---
 dlls/windows.ui/Makefile.in  |   3 +-
 dlls/windows.ui/uisettings.c | 139 ++++-------------------------------
 dlls/windows.ui/weakref.c    | 125 +++++++++++++++++++++++++++++++
 dlls/windows.ui/weakref.h    |  70 ++++++++++++++++++
 4 files changed, 211 insertions(+), 126 deletions(-)
 create mode 100644 dlls/windows.ui/weakref.c
 create mode 100644 dlls/windows.ui/weakref.h

diff --git a/dlls/windows.ui/Makefile.in b/dlls/windows.ui/Makefile.in
index 953991cafba..e88a40188b1 100644
--- a/dlls/windows.ui/Makefile.in
+++ b/dlls/windows.ui/Makefile.in
@@ -6,4 +6,5 @@ SOURCES = \
 	inputpane.c \
 	main.c \
 	uisettings.c \
-	uiviewsettings.c
+	uiviewsettings.c \
+	weakref.c
diff --git a/dlls/windows.ui/uisettings.c b/dlls/windows.ui/uisettings.c
index d5eae44b797..e5032389da7 100644
--- a/dlls/windows.ui/uisettings.c
+++ b/dlls/windows.ui/uisettings.c
@@ -19,7 +19,7 @@
 
 #include "private.h"
 #include "initguid.h"
-#include "weakreference.h"
+#include "weakref.h"
 
 #include "wine/debug.h"
 
@@ -35,9 +35,7 @@ struct uisettings
     IUISettings4 IUISettings4_iface;
     IUISettings5 IUISettings5_iface;
     IWeakReferenceSource IWeakReferenceSource_iface;
-    IWeakReference IWeakReference_iface;
-    LONG ref_strong;
-    LONG ref_weak;
+    IWeakReference *weakref;
 };
 
 static inline struct uisettings *impl_from_IUISettings( IUISettings *iface )
@@ -94,20 +92,18 @@ static HRESULT WINAPI uisettings_QueryInterface( IUISettings *iface, REFIID iid,
 static ULONG WINAPI uisettings_AddRef( IUISettings *iface )
 {
     struct uisettings *impl = impl_from_IUISettings( iface );
-    ULONG ref = InterlockedIncrement( &impl->ref_strong );
+    ULONG ref = weak_reference_strong_add_ref( impl->weakref );
     TRACE( "iface %p, ref %lu.\n", iface, ref );
-    IWeakReference_AddRef( &impl->IWeakReference_iface );
     return ref;
 }
 
 static ULONG WINAPI uisettings_Release( IUISettings *iface )
 {
     struct uisettings *impl = impl_from_IUISettings( iface );
-    ULONG ref = InterlockedDecrement( &impl->ref_strong );
+    ULONG ref = weak_reference_strong_release( impl->weakref );
 
     TRACE( "iface %p, ref %lu.\n", iface, ref );
 
-    IWeakReference_Release( &impl->IWeakReference_iface );
     if (!ref) free( impl );
     return ref;
 }
@@ -480,119 +476,7 @@ static const struct IUISettings5Vtbl uisettings5_vtbl =
     uisettings5_remove_AutoHideScrollBarsChanged,
 };
 
-static inline struct uisettings *impl_from_IWeakReference( IWeakReference *iface )
-{
-    return CONTAINING_RECORD( iface, struct uisettings, IWeakReference_iface );
-}
-
-static HRESULT WINAPI weak_reference_QueryInterface( IWeakReference *iface, REFIID iid, void **out )
-{
-    struct uisettings *impl = impl_from_IWeakReference( iface );
-
-    TRACE( "iface %p, iid %s, out %p.\n", iface, debugstr_guid(iid), out );
-
-    if (IsEqualGUID( iid, &IID_IUnknown ) ||
-        IsEqualGUID( iid, &IID_IWeakReference ))
-    {
-        *out = &impl->IWeakReference_iface;
-        IInspectable_AddRef( *out );
-        return S_OK;
-    }
-
-    FIXME( "%s not implemented, returning E_NOINTERFACE.\n", debugstr_guid(iid) );
-    *out = NULL;
-    return E_NOINTERFACE;
-}
-
-static ULONG WINAPI weak_reference_AddRef( IWeakReference *iface )
-{
-    struct uisettings *impl = impl_from_IWeakReference( iface );
-    ULONG ref = InterlockedIncrement( &impl->ref_weak );
-    TRACE("iface %p increasing refcount to %lu.\n", iface, ref);
-    return ref;
-}
-
-static ULONG WINAPI weak_reference_Release( IWeakReference *iface )
-{
-    struct uisettings *impl = impl_from_IWeakReference( iface );
-    ULONG ref = InterlockedDecrement( &impl->ref_weak );
-    if (!ref)
-        free( impl );
-    return ref;
-}
-
-static HRESULT WINAPI weak_reference_Resolve( IWeakReference *iface, REFIID iid, IInspectable **out )
-{
-    struct uisettings *impl = impl_from_IWeakReference( iface );
-    HRESULT hr;
-    LONG ref;
-
-    TRACE( "iface %p, iid %s, out %p stub.\n", iface, debugstr_guid(iid), out );
-
-    *out = NULL;
-
-    do
-    {
-        if (!(ref = ReadNoFence( &impl->ref_strong )))
-            return S_OK;
-    } while (ref != InterlockedCompareExchange( &impl->ref_strong, ref + 1, ref ));
-
-    hr = IUISettings_QueryInterface( &impl->IUISettings_iface, iid, (void **)out );
-    InterlockedDecrement( &impl->ref_strong );
-    return hr;
-}
-
-static const struct IWeakReferenceVtbl weak_reference_vtbl =
-{
-    weak_reference_QueryInterface,
-    weak_reference_AddRef,
-    weak_reference_Release,
-    /* IWeakReference methods */
-    weak_reference_Resolve,
-};
-
-static inline struct uisettings *impl_from_IWeakReferenceSource( IWeakReferenceSource *iface )
-{
-    return CONTAINING_RECORD( iface, struct uisettings, IWeakReferenceSource_iface );
-}
-
-static HRESULT WINAPI weak_reference_source_QueryInterface( IWeakReferenceSource *iface, REFIID iid, void **out )
-{
-    struct uisettings *impl = impl_from_IWeakReferenceSource( iface );
-    return uisettings_QueryInterface( &impl->IUISettings_iface, iid, out );
-}
-
-static ULONG WINAPI weak_reference_source_AddRef( IWeakReferenceSource *iface )
-{
-    struct uisettings *impl = impl_from_IWeakReferenceSource( iface );
-    return uisettings_AddRef( &impl->IUISettings_iface );
-}
-
-static ULONG WINAPI weak_reference_source_Release( IWeakReferenceSource *iface )
-{
-    struct uisettings *impl = impl_from_IWeakReferenceSource( iface );
-    return uisettings_Release( &impl->IUISettings_iface );
-}
-
-static HRESULT WINAPI weak_reference_source_GetWeakReference( IWeakReferenceSource *iface, IWeakReference **ref )
-{
-    struct uisettings *impl = impl_from_IWeakReferenceSource(iface);
-
-    TRACE("iface %p, ref %p stub.\n", iface, ref);
-
-    *ref = &impl->IWeakReference_iface;
-    IWeakReference_AddRef( *ref );
-    return S_OK;
-}
-
-static const struct IWeakReferenceSourceVtbl weak_reference_source_vtbl =
-{
-    weak_reference_source_QueryInterface,
-    weak_reference_source_AddRef,
-    weak_reference_source_Release,
-    /* IWeakReferenceSource methods */
-    weak_reference_source_GetWeakReference,
-};
+DEFINE_WEAKREF_SOURCE(uisettings, IUISettings, struct uisettings);
 
 struct uisettings_statics
 {
@@ -662,6 +546,7 @@ static HRESULT WINAPI factory_GetTrustLevel( IActivationFactory *iface, TrustLev
 static HRESULT WINAPI factory_ActivateInstance( IActivationFactory *iface, IInspectable **instance )
 {
     struct uisettings *impl;
+    HRESULT hr;
 
     TRACE( "iface %p, instance %p.\n", iface, instance );
 
@@ -676,10 +561,14 @@ static HRESULT WINAPI factory_ActivateInstance( IActivationFactory *iface, IInsp
     impl->IUISettings3_iface.lpVtbl = &uisettings3_vtbl;
     impl->IUISettings4_iface.lpVtbl = &uisettings4_vtbl;
     impl->IUISettings5_iface.lpVtbl = &uisettings5_vtbl;
-    impl->IWeakReferenceSource_iface.lpVtbl = &weak_reference_source_vtbl;
-    impl->IWeakReference_iface.lpVtbl = &weak_reference_vtbl;
-    impl->ref_strong = 1;
-    impl->ref_weak = 1;
+
+    impl->IWeakReferenceSource_iface.lpVtbl = &uisettings_weakref_source_vtbl;
+    if (FAILED(hr = weak_reference_create( (IUnknown *)&impl->IUISettings_iface, &impl->weakref )))
+    {
+        *instance = NULL;
+        free( impl );
+        return hr;
+    }
 
     *instance = (IInspectable *)&impl->IUISettings5_iface;
     return S_OK;
diff --git a/dlls/windows.ui/weakref.c b/dlls/windows.ui/weakref.c
new file mode 100644
index 00000000000..a48f573024d
--- /dev/null
+++ b/dlls/windows.ui/weakref.c
@@ -0,0 +1,125 @@
+/* WinRT weak reference helpers
+ *
+ * Copyright 2025 Zhiyi Zhang for CodeWeavers
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#define COBJMACROS
+#include "weakref.h"
+
+/* The control block is contained in struct weakref so that we don't have to allocate a separate
+ * struct for it */
+struct weakref
+{
+    IWeakReference IWeakReference_iface;
+    IUnknown *object;
+    /* control block */
+    LONG ref_strong;
+    LONG ref_weak;
+};
+
+static inline struct weakref *impl_from_IWeakReference( IWeakReference *iface )
+{
+    return CONTAINING_RECORD(iface, struct weakref, IWeakReference_iface);
+}
+
+static HRESULT WINAPI weakref_QueryInterface( IWeakReference *iface, REFIID iid, void **out )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+
+    if (IsEqualGUID( iid, &IID_IUnknown ) || IsEqualGUID( iid, &IID_IWeakReference ))
+    {
+        *out = &impl->IWeakReference_iface;
+        IWeakReference_AddRef( *out );
+        return S_OK;
+    }
+
+    *out = NULL;
+    return E_NOINTERFACE;
+}
+
+static ULONG WINAPI weakref_AddRef( IWeakReference *iface )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    return InterlockedIncrement( &impl->ref_weak );
+}
+
+static ULONG WINAPI weakref_Release( IWeakReference *iface )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    ULONG ref = InterlockedDecrement( &impl->ref_weak );
+
+    if (!ref)
+        free( impl );
+    return ref;
+}
+
+static HRESULT WINAPI weakref_Resolve( IWeakReference *iface, REFIID iid, IInspectable **out )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    HRESULT hr;
+    LONG ref;
+
+    *out = NULL;
+    do
+    {
+        if (!(ref = ReadNoFence( &impl->ref_strong )))
+            return S_OK;
+    } while (ref != InterlockedCompareExchange( &impl->ref_strong, ref + 1, ref ));
+
+    hr = IUnknown_QueryInterface( impl->object, iid, (void **)out );
+    IUnknown_Release( impl->object );
+    return hr;
+}
+
+static const struct IWeakReferenceVtbl weakref_vtbl =
+{
+    weakref_QueryInterface,
+    weakref_AddRef,
+    weakref_Release,
+    weakref_Resolve,
+};
+
+HRESULT weak_reference_create( IUnknown *object, IWeakReference **out )
+{
+    struct weakref *weakref;
+
+    if (!(weakref = calloc( 1, sizeof(*weakref) )))
+        return E_OUTOFMEMORY;
+
+    weakref->IWeakReference_iface.lpVtbl = &weakref_vtbl;
+    weakref->ref_strong = 1;
+    weakref->ref_weak = 1;
+    weakref->object = object;
+    *out = &weakref->IWeakReference_iface;
+    return S_OK;
+}
+
+ULONG weak_reference_strong_add_ref( IWeakReference *iface )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    return InterlockedIncrement( &impl->ref_strong );
+}
+
+ULONG weak_reference_strong_release( IWeakReference *iface )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    ULONG ref = InterlockedDecrement( &impl->ref_strong );
+
+    if (!ref)
+        IWeakReference_Release( &impl->IWeakReference_iface );
+    return ref;
+}
diff --git a/dlls/windows.ui/weakref.h b/dlls/windows.ui/weakref.h
new file mode 100644
index 00000000000..974d416a219
--- /dev/null
+++ b/dlls/windows.ui/weakref.h
@@ -0,0 +1,70 @@
+/* WinRT weak reference helpers
+ *
+ * Copyright 2025 Zhiyi Zhang for CodeWeavers
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifndef __WINE_WEAKREF_H
+#define __WINE_WEAKREF_H
+
+#include "weakreference.h"
+
+/* Create a IWeakReference managing the object */
+HRESULT weak_reference_create( IUnknown *object, IWeakReference **out );
+/* Add a strong reference to the managed object */
+ULONG weak_reference_strong_add_ref( IWeakReference *iface );
+/* Release a strong reference to the managed object */
+ULONG weak_reference_strong_release( IWeakReference *iface );
+
+#define DEFINE_WEAKREF_SOURCE(pfx, iface_type, impl_type)                                    \
+static inline impl_type *pfx##_impl_from_IWeakReferenceSource( IWeakReferenceSource *iface ) \
+{                                                                                            \
+    return CONTAINING_RECORD(iface, impl_type, IWeakReferenceSource_iface);                  \
+}                                                                                            \
+static HRESULT WINAPI pfx##_weakref_source_QueryInterface( IWeakReferenceSource *iface,      \
+                                                           REFIID iid, void **out )          \
+{                                                                                            \
+    impl_type *impl = pfx##_impl_from_IWeakReferenceSource( iface );                         \
+    return pfx##_QueryInterface( &impl->iface_type##_iface, iid, out );                      \
+}                                                                                            \
+static ULONG WINAPI pfx##_weakref_source_AddRef( IWeakReferenceSource *iface )               \
+{                                                                                            \
+    impl_type *impl = pfx##_impl_from_IWeakReferenceSource( iface );                         \
+    return pfx##_AddRef( &impl->iface_type##_iface );                                        \
+}                                                                                            \
+static ULONG WINAPI pfx##_weakref_source_Release( IWeakReferenceSource *iface )              \
+{                                                                                            \
+    impl_type *impl = pfx##_impl_from_IWeakReferenceSource( iface );                         \
+    return pfx##_Release( &impl->iface_type##_iface );                                       \
+}                                                                                            \
+static HRESULT WINAPI pfx##_weakref_source_GetWeakReference( IWeakReferenceSource *iface,    \
+                                                             IWeakReference **ref )          \
+{                                                                                            \
+    impl_type *impl = pfx##_impl_from_IWeakReferenceSource( iface );                         \
+    TRACE("iface %p, ref %p.\n", iface, ref);                                                \
+    *ref = impl->weakref;                                                                    \
+    IWeakReference_AddRef( *ref );                                                           \
+    return S_OK;                                                                             \
+}                                                                                            \
+static const struct IWeakReferenceSourceVtbl pfx##_weakref_source_vtbl =                     \
+{                                                                                            \
+    pfx##_weakref_source_QueryInterface,                                                     \
+    pfx##_weakref_source_AddRef,                                                             \
+    pfx##_weakref_source_Release,                                                            \
+    pfx##_weakref_source_GetWeakReference,                                                   \
+};
+
+#endif /* __WINE_WEAKREF_H */
-- 
GitLab


https://gitlab.winehq.org/wine/wine/-/merge_requests/8078

[PATCH v5 3/3] geolocation: Use helpers to implement IWeakReference.

[Zhiyi Zhang]

From: Zhiyi Zhang <zzhang(a)codeweavers.com>

---
 dlls/geolocation/Makefile.in |   3 +-
 dlls/geolocation/main.c      | 137 ++++-------------------------------
 dlls/geolocation/private.h   |   1 -
 dlls/geolocation/weakref.c   | 125 ++++++++++++++++++++++++++++++++
 dlls/geolocation/weakref.h   |  70 ++++++++++++++++++
 5 files changed, 211 insertions(+), 125 deletions(-)
 create mode 100644 dlls/geolocation/weakref.c
 create mode 100644 dlls/geolocation/weakref.h

diff --git a/dlls/geolocation/Makefile.in b/dlls/geolocation/Makefile.in
index 283806d14bf..3afaae6d017 100644
--- a/dlls/geolocation/Makefile.in
+++ b/dlls/geolocation/Makefile.in
@@ -3,4 +3,5 @@ IMPORTS = combase uuid
 
 SOURCES = \
 	classes.idl \
-	main.c
+	main.c \
+	weakref.c
diff --git a/dlls/geolocation/main.c b/dlls/geolocation/main.c
index 92c62c0feb7..f9817c98e1f 100644
--- a/dlls/geolocation/main.c
+++ b/dlls/geolocation/main.c
@@ -19,6 +19,7 @@
 
 #include "initguid.h"
 #include "private.h"
+#include "weakref.h"
 
 #include "wine/debug.h"
 
@@ -34,9 +35,7 @@ struct geolocator
 {
     IGeolocator IGeolocator_iface;
     IWeakReferenceSource IWeakReferenceSource_iface;
-    IWeakReference IWeakReference_iface;
-    LONG ref_public;
-    LONG ref_weak;
+    IWeakReference *weakref;
 };
 
 static inline struct geolocator *impl_from_IGeolocator(IGeolocator *iface)
@@ -75,18 +74,17 @@ static HRESULT WINAPI geolocator_QueryInterface(IGeolocator *iface, REFIID iid,
 static ULONG WINAPI geolocator_AddRef(IGeolocator *iface)
 {
     struct geolocator *impl = impl_from_IGeolocator(iface);
-    ULONG ref = InterlockedIncrement(&impl->ref_public);
+    ULONG ref = weak_reference_strong_add_ref(impl->weakref);
     TRACE("iface %p increasing refcount to %lu.\n", iface, ref);
-    IWeakReference_AddRef(&impl->IWeakReference_iface);
     return ref;
 }
 
 static ULONG WINAPI geolocator_Release(IGeolocator *iface)
 {
     struct geolocator *impl = impl_from_IGeolocator(iface);
-    ULONG ref = InterlockedDecrement(&impl->ref_public);
+    ULONG ref = weak_reference_strong_release(impl->weakref);
     TRACE("iface %p decreasing refcount to %lu.\n", iface, ref);
-    IWeakReference_Release(&impl->IWeakReference_iface);
+    if (!ref) free( impl );
     return ref;
 }
 
@@ -211,118 +209,7 @@ static const struct IGeolocatorVtbl geolocator_vtbl =
     geolocator_remove_StatusChanged,
 };
 
-static inline struct geolocator *impl_from_IWeakReference(IWeakReference *iface)
-{
-    return CONTAINING_RECORD(iface, struct geolocator, IWeakReference_iface);
-}
-
-static HRESULT WINAPI weak_reference_QueryInterface(IWeakReference *iface, REFIID iid, void **out)
-{
-    struct geolocator *impl = impl_from_IWeakReference(iface);
-
-    TRACE("iface %p, iid %s, out %p.\n", iface, debugstr_guid(iid), out);
-
-    if (IsEqualGUID(iid, &IID_IUnknown) ||
-        IsEqualGUID(iid, &IID_IWeakReference))
-    {
-        *out = &impl->IWeakReference_iface;
-        IInspectable_AddRef(*out);
-        return S_OK;
-    }
-
-    FIXME("%s not implemented, returning E_NOINTERFACE.\n", debugstr_guid(iid));
-    *out = NULL;
-    return E_NOINTERFACE;
-}
-
-static ULONG WINAPI weak_reference_AddRef(IWeakReference *iface)
-{
-    struct geolocator *impl = impl_from_IWeakReference(iface);
-    ULONG ref = InterlockedIncrement(&impl->ref_weak);
-    TRACE("iface %p increasing refcount to %lu.\n", iface, ref);
-    return ref;
-}
-
-static ULONG WINAPI weak_reference_Release(IWeakReference *iface)
-{
-    struct geolocator *impl = impl_from_IWeakReference(iface);
-    ULONG ref = InterlockedDecrement(&impl->ref_weak);
-    if (!ref)
-        free(impl);
-    return ref;
-}
-
-static HRESULT WINAPI weak_reference_Resolve(IWeakReference *iface, REFIID iid, IInspectable **out)
-{
-    struct geolocator *impl = impl_from_IWeakReference(iface);
-    HRESULT hr;
-    LONG ref;
-
-    TRACE("iface %p, iid %s, out %p stub.\n", iface, debugstr_guid(iid), out);
-
-    *out = NULL;
-
-    do
-    {
-        if (!(ref = ReadNoFence(&impl->ref_public)))
-            return S_OK;
-    } while (ref != InterlockedCompareExchange(&impl->ref_public, ref + 1, ref));
-
-    hr = IGeolocator_QueryInterface(&impl->IGeolocator_iface, iid, (void **)out);
-    InterlockedDecrement(&impl->ref_public);
-    return hr;
-}
-
-static const struct IWeakReferenceVtbl weak_reference_vtbl =
-{
-    weak_reference_QueryInterface,
-    weak_reference_AddRef,
-    weak_reference_Release,
-    /* IWeakReference methods */
-    weak_reference_Resolve,
-};
-
-static inline struct geolocator *impl_from_IWeakReferenceSource(IWeakReferenceSource *iface)
-{
-    return CONTAINING_RECORD(iface, struct geolocator, IWeakReferenceSource_iface);
-}
-
-static HRESULT WINAPI weak_reference_source_QueryInterface(IWeakReferenceSource *iface, REFIID iid, void **out)
-{
-    struct geolocator *impl = impl_from_IWeakReferenceSource(iface);
-    return geolocator_QueryInterface(&impl->IGeolocator_iface, iid, out);
-}
-
-static ULONG WINAPI weak_reference_source_AddRef(IWeakReferenceSource *iface)
-{
-    struct geolocator *impl = impl_from_IWeakReferenceSource(iface);
-    return geolocator_AddRef(&impl->IGeolocator_iface);
-}
-
-static ULONG WINAPI weak_reference_source_Release(IWeakReferenceSource *iface)
-{
-    struct geolocator *impl = impl_from_IWeakReferenceSource(iface);
-    return geolocator_Release(&impl->IGeolocator_iface);
-}
-
-static HRESULT WINAPI weak_reference_source_GetWeakReference(IWeakReferenceSource *iface, IWeakReference **ref)
-{
-    struct geolocator *impl = impl_from_IWeakReferenceSource(iface);
-
-    TRACE("iface %p, ref %p stub.\n", iface, ref);
-    *ref = &impl->IWeakReference_iface;
-    IWeakReference_AddRef(*ref);
-    return S_OK;
-}
-
-static const struct IWeakReferenceSourceVtbl weak_reference_source_vtbl =
-{
-    weak_reference_source_QueryInterface,
-    weak_reference_source_AddRef,
-    weak_reference_source_Release,
-    /* IWeakReferenceSource methods */
-    weak_reference_source_GetWeakReference,
-};
+DEFINE_WEAKREF_SOURCE(geolocator, IGeolocator, struct geolocator);
 
 static inline struct geolocator_statics *impl_from_IActivationFactory(IActivationFactory *iface)
 {
@@ -389,6 +276,7 @@ static const struct IActivationFactoryVtbl factory_vtbl;
 static HRESULT WINAPI factory_ActivateInstance(IActivationFactory *iface, IInspectable **instance)
 {
     struct geolocator *impl;
+    HRESULT hr;
 
     TRACE("iface %p, instance %p.\n", iface, instance);
 
@@ -399,10 +287,13 @@ static HRESULT WINAPI factory_ActivateInstance(IActivationFactory *iface, IInspe
     }
 
     impl->IGeolocator_iface.lpVtbl = &geolocator_vtbl;
-    impl->IWeakReferenceSource_iface.lpVtbl = &weak_reference_source_vtbl;
-    impl->IWeakReference_iface.lpVtbl = &weak_reference_vtbl;
-    impl->ref_public = 1;
-    impl->ref_weak = 1;
+    impl->IWeakReferenceSource_iface.lpVtbl = &geolocator_weakref_source_vtbl;
+    if (FAILED(hr = weak_reference_create((IUnknown *)&impl->IGeolocator_iface, &impl->weakref)))
+    {
+        *instance = NULL;
+        free( impl );
+        return hr;
+    }
 
     *instance = (IInspectable *)&impl->IGeolocator_iface;
     return S_OK;
diff --git a/dlls/geolocation/private.h b/dlls/geolocation/private.h
index a188b5dacf3..44060ae21b0 100644
--- a/dlls/geolocation/private.h
+++ b/dlls/geolocation/private.h
@@ -28,7 +28,6 @@
 #include "winstring.h"
 
 #include "activation.h"
-#include "weakreference.h"
 
 #define WIDL_using_Windows_Foundation
 #define WIDL_using_Windows_Foundation_Collections
diff --git a/dlls/geolocation/weakref.c b/dlls/geolocation/weakref.c
new file mode 100644
index 00000000000..a48f573024d
--- /dev/null
+++ b/dlls/geolocation/weakref.c
@@ -0,0 +1,125 @@
+/* WinRT weak reference helpers
+ *
+ * Copyright 2025 Zhiyi Zhang for CodeWeavers
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#define COBJMACROS
+#include "weakref.h"
+
+/* The control block is contained in struct weakref so that we don't have to allocate a separate
+ * struct for it */
+struct weakref
+{
+    IWeakReference IWeakReference_iface;
+    IUnknown *object;
+    /* control block */
+    LONG ref_strong;
+    LONG ref_weak;
+};
+
+static inline struct weakref *impl_from_IWeakReference( IWeakReference *iface )
+{
+    return CONTAINING_RECORD(iface, struct weakref, IWeakReference_iface);
+}
+
+static HRESULT WINAPI weakref_QueryInterface( IWeakReference *iface, REFIID iid, void **out )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+
+    if (IsEqualGUID( iid, &IID_IUnknown ) || IsEqualGUID( iid, &IID_IWeakReference ))
+    {
+        *out = &impl->IWeakReference_iface;
+        IWeakReference_AddRef( *out );
+        return S_OK;
+    }
+
+    *out = NULL;
+    return E_NOINTERFACE;
+}
+
+static ULONG WINAPI weakref_AddRef( IWeakReference *iface )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    return InterlockedIncrement( &impl->ref_weak );
+}
+
+static ULONG WINAPI weakref_Release( IWeakReference *iface )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    ULONG ref = InterlockedDecrement( &impl->ref_weak );
+
+    if (!ref)
+        free( impl );
+    return ref;
+}
+
+static HRESULT WINAPI weakref_Resolve( IWeakReference *iface, REFIID iid, IInspectable **out )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    HRESULT hr;
+    LONG ref;
+
+    *out = NULL;
+    do
+    {
+        if (!(ref = ReadNoFence( &impl->ref_strong )))
+            return S_OK;
+    } while (ref != InterlockedCompareExchange( &impl->ref_strong, ref + 1, ref ));
+
+    hr = IUnknown_QueryInterface( impl->object, iid, (void **)out );
+    IUnknown_Release( impl->object );
+    return hr;
+}
+
+static const struct IWeakReferenceVtbl weakref_vtbl =
+{
+    weakref_QueryInterface,
+    weakref_AddRef,
+    weakref_Release,
+    weakref_Resolve,
+};
+
+HRESULT weak_reference_create( IUnknown *object, IWeakReference **out )
+{
+    struct weakref *weakref;
+
+    if (!(weakref = calloc( 1, sizeof(*weakref) )))
+        return E_OUTOFMEMORY;
+
+    weakref->IWeakReference_iface.lpVtbl = &weakref_vtbl;
+    weakref->ref_strong = 1;
+    weakref->ref_weak = 1;
+    weakref->object = object;
+    *out = &weakref->IWeakReference_iface;
+    return S_OK;
+}
+
+ULONG weak_reference_strong_add_ref( IWeakReference *iface )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    return InterlockedIncrement( &impl->ref_strong );
+}
+
+ULONG weak_reference_strong_release( IWeakReference *iface )
+{
+    struct weakref *impl = impl_from_IWeakReference( iface );
+    ULONG ref = InterlockedDecrement( &impl->ref_strong );
+
+    if (!ref)
+        IWeakReference_Release( &impl->IWeakReference_iface );
+    return ref;
+}
diff --git a/dlls/geolocation/weakref.h b/dlls/geolocation/weakref.h
new file mode 100644
index 00000000000..974d416a219
--- /dev/null
+++ b/dlls/geolocation/weakref.h
@@ -0,0 +1,70 @@
+/* WinRT weak reference helpers
+ *
+ * Copyright 2025 Zhiyi Zhang for CodeWeavers
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifndef __WINE_WEAKREF_H
+#define __WINE_WEAKREF_H
+
+#include "weakreference.h"
+
+/* Create a IWeakReference managing the object */
+HRESULT weak_reference_create( IUnknown *object, IWeakReference **out );
+/* Add a strong reference to the managed object */
+ULONG weak_reference_strong_add_ref( IWeakReference *iface );
+/* Release a strong reference to the managed object */
+ULONG weak_reference_strong_release( IWeakReference *iface );
+
+#define DEFINE_WEAKREF_SOURCE(pfx, iface_type, impl_type)                                    \
+static inline impl_type *pfx##_impl_from_IWeakReferenceSource( IWeakReferenceSource *iface ) \
+{                                                                                            \
+    return CONTAINING_RECORD(iface, impl_type, IWeakReferenceSource_iface);                  \
+}                                                                                            \
+static HRESULT WINAPI pfx##_weakref_source_QueryInterface( IWeakReferenceSource *iface,      \
+                                                           REFIID iid, void **out )          \
+{                                                                                            \
+    impl_type *impl = pfx##_impl_from_IWeakReferenceSource( iface );                         \
+    return pfx##_QueryInterface( &impl->iface_type##_iface, iid, out );                      \
+}                                                                                            \
+static ULONG WINAPI pfx##_weakref_source_AddRef( IWeakReferenceSource *iface )               \
+{                                                                                            \
+    impl_type *impl = pfx##_impl_from_IWeakReferenceSource( iface );                         \
+    return pfx##_AddRef( &impl->iface_type##_iface );                                        \
+}                                                                                            \
+static ULONG WINAPI pfx##_weakref_source_Release( IWeakReferenceSource *iface )              \
+{                                                                                            \
+    impl_type *impl = pfx##_impl_from_IWeakReferenceSource( iface );                         \
+    return pfx##_Release( &impl->iface_type##_iface );                                       \
+}                                                                                            \
+static HRESULT WINAPI pfx##_weakref_source_GetWeakReference( IWeakReferenceSource *iface,    \
+                                                             IWeakReference **ref )          \
+{                                                                                            \
+    impl_type *impl = pfx##_impl_from_IWeakReferenceSource( iface );                         \
+    TRACE("iface %p, ref %p.\n", iface, ref);                                                \
+    *ref = impl->weakref;                                                                    \
+    IWeakReference_AddRef( *ref );                                                           \
+    return S_OK;                                                                             \
+}                                                                                            \
+static const struct IWeakReferenceSourceVtbl pfx##_weakref_source_vtbl =                     \
+{                                                                                            \
+    pfx##_weakref_source_QueryInterface,                                                     \
+    pfx##_weakref_source_AddRef,                                                             \
+    pfx##_weakref_source_Release,                                                            \
+    pfx##_weakref_source_GetWeakReference,                                                   \
+};
+
+#endif /* __WINE_WEAKREF_H */
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/8078

[PATCH v5 0/3] MR8078: windows.ui: Fix a double free. - approved

[Nikolay Sivov (＠nsivov)]

This merge request was approved by Nikolay Sivov.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8078

[Rémi Bernon]

Rémi Bernon (@rbernon) commented about dlls/geolocation/weakref.h:
> + * You should have received a copy of the GNU Lesser General Public
> + * License along with this library; if not, write to the Free Software
> + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
> + */
> +
> +#ifndef __WINE_WEAKREF_H
> +#define __WINE_WEAKREF_H
> +
> +#include "weakreference.h"
> +
> +/* Create a IWeakReference managing the object */
> +HRESULT weak_reference_create( IUnknown *object, IWeakReference **out );
> +/* Add a strong reference to the managed object */
> +ULONG weak_reference_strong_add_ref( IWeakReference *iface );
> +/* Release a strong reference to the managed object */
> +ULONG weak_reference_strong_release( IWeakReference *iface );
> Hmm, I had missed that you also had macros for `IWeakReferenceSource` boilerplate. In that case and as it seems to me from https://gitlab.winehq.org/wine/wine/-/merge_requests/6207 that macros are frowned upon, what do you think about moving this to the source too, with something like that instead:

```suggestion:-5+0
struct weak_reference_source
{
    IWeakReferenceSource IWeakReferenceSource_iface;
    IWeakReference *weak_ref;
    IUnknown *object;
};

/* Create a IWeakReference managing the object */
HRESULT weak_reference_source_init( IUnkown *object, struct weak_reference_source *source );
/* Add a strong reference to the managed object */
ULONG weak_reference_strong_add_ref( weak_reference_source *iface );
/* Release a strong reference to the managed object */
ULONG weak_reference_strong_release( weak_reference_source *iface );
```

Classes can then embed a `struct weak_reference_source weak_reference_source;` member, and `weak_reference_source_init` would be implemented like that:
```
HRESULT weak_reference_source_init( IUnknown *object, struct weak_reference_source *source )
{
    source->IWeakReferenceSource_iface = weak_reference_source_vtbl;
    source->object = object;
    return weak_reference_create( object, &source->weak_ref );
}
```

That should allow to implement `IWeakReferenceSource` in a generic way (`impl_from_IWeakReferenceSource` would return the struct, which gives you access to the `IUnknown` pointer for dispatching `QueryInterface/AddRef/Release`).

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8078#note_104200