Hi Nikolay,

Thanks for your review!

The crash can be reproduced follow this:

- first release the ITextSelection or IOleClientSite interfaces��completely;

- release ITextDocument interface;

- try to release the IRichEditOle (crash happen)

And this patch try to fix it.

(tests in attachment can reproduce the crash.)

2014-04-16 18:59 GMT+08:00 Nikolay Sivov <bunglehead@gmail.com>:

- �� This->txtSel->reOle = NULL;
- �� ITextSelection_Release(&This->txtSel->ITextSelection_iface);
- �� IOleClientSite_Release(&This->clientSite->IOleClientSite_iface);
+ �� if(This->txtSel)
+ �� {
+ �� This->txtSel->reOle = NULL;
+ �� ITextSelection_Release(&This->txtSel->ITextSelection_iface);
+ �� }
+ �� if(This->clientSite)
+ �� {
+ �� This->clientSite->reOle = NULL;
+ �� IOleClientSite_Release(&This->clientSite->IOleClientSite_iface);
+ �� }
�� heap_fr

This can't happen.

�� IOleClientSiteImpl *This = impl_from_IOleClientSite(iface);
�� ULONG ref = InterlockedDecrement(&This->ref);
�� if (ref == 0)
+ �� {
+ �� if(This->reOle)
+ �� This->reOle->clientSite = NULL;
�� heap_free(This);
+ �� }
�� return ref;

Why do you need this?

Regards,

Jactry Zeng