Gabriel Ivăncescu : mshtml: Release the returned lists from Gecko's QuerySelectorAll even on error.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 137a36529d5f9a1e1bdd20b7bed1ab40bc141ab6
URL:    https://gitlab.winehq.org/wine/wine/-/commit/137a36529d5f9a1e1bdd20b7bed1ab4...

Author: Gabriel Ivăncescu <gabrielopcode(a)gmail.com>
Date:   Fri Nov  3 20:47:58 2023 +0200

mshtml: Release the returned lists from Gecko's QuerySelectorAll even on error.

Gecko may return a pseudo-element-list even on error (such as with an
invalid selector, for example), which holds refs to elements and leaks.

Signed-off-by: Gabriel Ivăncescu <gabrielopcode(a)gmail.com>

---

 dlls/mshtml/htmldoc.c  | 18 ++++++++++++++----
 dlls/mshtml/htmlelem.c |  4 +++-
 dlls/mshtml/script.c   |  4 +++-
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/dlls/mshtml/htmldoc.c b/dlls/mshtml/htmldoc.c
index 4daf5ccc58d..540bbbd1626 100644
--- a/dlls/mshtml/htmldoc.c
+++ b/dlls/mshtml/htmldoc.c
@@ -2685,7 +2685,7 @@ static HRESULT WINAPI HTMLDocument3_getElementsByName(IHTMLDocument3 *iface, BST
         IHTMLElementCollection **ppelColl)
 {
     HTMLDocumentNode *This = impl_from_IHTMLDocument3(iface);
-    nsIDOMNodeList *node_list;
+    nsIDOMNodeList *node_list = NULL;
     nsAString selector_str;
     WCHAR *selector;
     nsresult nsres;
@@ -2715,6 +2715,8 @@ static HRESULT WINAPI HTMLDocument3_getElementsByName(IHTMLDocument3 *iface, BST
     free(selector);
     if(NS_FAILED(nsres)) {
         ERR("QuerySelectorAll failed: %08lx\n", nsres);
+        if(node_list)
+            nsIDOMNodeList_Release(node_list);
         return E_FAIL;
     }
 
@@ -2781,12 +2783,15 @@ static HRESULT WINAPI HTMLDocument3_getElementsByTagName(IHTMLDocument3 *iface,
             return E_UNEXPECTED;
         }
 
+        nslist = NULL;
         nsAString_InitDepend(&nsstr, v);
         nsres = nsIDOMDocumentFragment_QuerySelectorAll(docfrag, &nsstr, &nslist);
         nsAString_Finish(&nsstr);
         nsIDOMDocumentFragment_Release(docfrag);
         if(NS_FAILED(nsres)) {
             ERR("QuerySelectorAll failed: %08lx\n", nsres);
+            if(nslist)
+                nsIDOMNodeList_Release(nslist);
             return E_FAIL;
         }
     }
@@ -4751,7 +4756,7 @@ static HRESULT WINAPI DocumentSelector_querySelector(IDocumentSelector *iface, B
 static HRESULT WINAPI DocumentSelector_querySelectorAll(IDocumentSelector *iface, BSTR v, IHTMLDOMChildrenCollection **pel)
 {
     HTMLDocumentNode *This = impl_from_IDocumentSelector(iface);
-    nsIDOMNodeList *node_list;
+    nsIDOMNodeList *node_list = NULL;
     nsAString nsstr;
     nsresult nsres;
     HRESULT hres;
@@ -4773,6 +4778,8 @@ static HRESULT WINAPI DocumentSelector_querySelectorAll(IDocumentSelector *iface
 
     if(NS_FAILED(nsres)) {
         WARN("QuerySelectorAll failed: %08lx\n", nsres);
+        if(node_list)
+            nsIDOMNodeList_Release(node_list);
         return map_nsresult(nsres);
     }
 
@@ -5946,7 +5953,7 @@ static HRESULT HTMLDocumentNode_next_dispid(DispatchEx *dispex, DISPID id, DISPI
 {
     DWORD idx = (id == DISPID_STARTENUM) ? 0 : id - MSHTML_DISPID_CUSTOM_MIN + 1;
     HTMLDocumentNode *This = impl_from_DispatchEx(dispex);
-    nsIDOMNodeList *node_list;
+    nsIDOMNodeList *node_list = NULL;
     const PRUnichar *name;
     nsIDOMElement *nselem;
     nsIDOMNode *nsnode;
@@ -5973,8 +5980,11 @@ static HRESULT HTMLDocumentNode_next_dispid(DispatchEx *dispex, DISPID id, DISPI
     nsAString_InitDepend(&nsstr, L":-moz-any(applet,embed,form,iframe,img,object)[name]");
     nsres = nsIDOMHTMLDocument_QuerySelectorAll(This->html_document, &nsstr, &node_list);
     nsAString_Finish(&nsstr);
-    if(NS_FAILED(nsres))
+    if(NS_FAILED(nsres)) {
+        if(node_list)
+            nsIDOMNodeList_Release(node_list);
         return map_nsresult(nsres);
+    }
 
     for(i = 0, hres = S_OK; SUCCEEDED(hres); i++) {
         nsres = nsIDOMNodeList_Item(node_list, i, &nsnode);
diff --git a/dlls/mshtml/htmlelem.c b/dlls/mshtml/htmlelem.c
index cfc84523436..687e62f1784 100644
--- a/dlls/mshtml/htmlelem.c
+++ b/dlls/mshtml/htmlelem.c
@@ -6476,7 +6476,7 @@ static HRESULT WINAPI ElementSelector_querySelector(IElementSelector *iface, BST
 static HRESULT WINAPI ElementSelector_querySelectorAll(IElementSelector *iface, BSTR v, IHTMLDOMChildrenCollection **pel)
 {
     HTMLElement *This = impl_from_IElementSelector(iface);
-    nsIDOMNodeList *node_list;
+    nsIDOMNodeList *node_list = NULL;
     nsAString nsstr;
     nsresult nsres;
     HRESULT hres;
@@ -6493,6 +6493,8 @@ static HRESULT WINAPI ElementSelector_querySelectorAll(IElementSelector *iface,
     nsAString_Finish(&nsstr);
     if(NS_FAILED(nsres)) {
         WARN("QuerySelectorAll failed: %08lx\n", nsres);
+        if(node_list)
+            nsIDOMNodeList_Release(node_list);
         return map_nsresult(nsres);
     }
 
diff --git a/dlls/mshtml/script.c b/dlls/mshtml/script.c
index ad44a1ace41..149abcf70e2 100644
--- a/dlls/mshtml/script.c
+++ b/dlls/mshtml/script.c
@@ -1605,9 +1605,9 @@ void bind_event_scripts(HTMLDocumentNode *doc)
 {
     HTMLPluginContainer *plugin_container;
     nsIDOMHTMLScriptElement *nsscript;
+    nsIDOMNodeList *node_list = NULL;
     HTMLScriptElement *script_elem;
     EventTarget *event_target;
-    nsIDOMNodeList *node_list;
     nsIDOMNode *script_node;
     nsAString selector_str;
     IDispatch *event_disp;
@@ -1626,6 +1626,8 @@ void bind_event_scripts(HTMLDocumentNode *doc)
     nsAString_Finish(&selector_str);
     if(NS_FAILED(nsres)) {
         ERR("QuerySelectorAll failed: %08lx\n", nsres);
+        if(node_list)
+            nsIDOMNodeList_Release(node_list);
         return;
     }