Jacek Caban : mshtml: Ensure that bind_event is not called multiple times for the same event.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 60538b4cd96a14eb25e78fdf6230dcc9734fbd38
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=60538b4cd96a14eb25e78fdf62...

Author: Jacek Caban <jacek(a)codeweavers.com>
Date:   Mon May  2 14:05:08 2016 +0200

mshtml: Ensure that bind_event is not called multiple times for the same event.

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/mshtml/htmlevent.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/dlls/mshtml/htmlevent.c b/dlls/mshtml/htmlevent.c
index 2226278..27b6c39 100644
--- a/dlls/mshtml/htmlevent.c
+++ b/dlls/mshtml/htmlevent.c
@@ -1386,6 +1386,7 @@ void detach_events(HTMLDocumentNode *doc)
     release_nsevents(doc);
 }
 
+/* Caller should ensure that it's called only once for given event in the target. */
 static void bind_event(EventTarget *event_target, eventid_t eid)
 {
     if(event_target->dispex.data->vtbl->bind_event)
@@ -1423,13 +1424,17 @@ static HRESULT set_event_handler_disp(EventTarget *event_target, eventid_t eid,
     if(!data)
         return E_OUTOFMEMORY;
 
-    if(!alloc_handler_vector(data, eid, 0))
-        return E_OUTOFMEMORY;
+    if(!data->event_table[eid]) {
+        if(!alloc_handler_vector(data, eid, 0))
+            return E_OUTOFMEMORY;
+
+        bind_event(event_target, eid);
+    }else if(data->event_table[eid]->handler_prop) {
+        IDispatch_Release(data->event_table[eid]->handler_prop);
+    }
 
     data->event_table[eid]->handler_prop = disp;
     IDispatch_AddRef(disp);
-
-    bind_event(event_target, eid);
     return S_OK;
 }
 
@@ -1522,15 +1527,15 @@ HRESULT attach_event(EventTarget *event_target, BSTR name, IDispatch *disp, VARI
             i++;
         if(i == data->event_table[eid]->handler_cnt && !alloc_handler_vector(data, eid, i+1))
             return E_OUTOFMEMORY;
-    }else if(!alloc_handler_vector(data, eid, i+1)) {
+    }else if(alloc_handler_vector(data, eid, i+1)) {
+        bind_event(event_target, eid);
+    }else {
         return E_OUTOFMEMORY;
     }
 
     IDispatch_AddRef(disp);
     data->event_table[eid]->handlers[i] = disp;
 
-    bind_event(event_target, eid);
-
     *res = VARIANT_TRUE;
     return S_OK;
 }